<p>My RequestAuthentication is this</p>
<pre><code>apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: testing-dev-authenticator
  namespace: istio-system
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  jwtRules:
  - issuer: &quot;https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com&quot;
    jwksUri: &quot;https://securetoken.google.com/&lt;project-name&gt;&quot;
</code></pre>
<p>My AuthorizationPolicy is this</p>
<pre><code>apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
 name: test-dev-authorizer-all-svc
 namespace: dev
spec:
 action: ALLOW
 rules:
 - from:
   - source:
       notRequestPrincipals: [&quot;*&quot;]
   to:
   - operation:
       notPaths: [&quot;/message/ping&quot;]
</code></pre>
<p>My requirement is i dont want jwt auth to check in the healthz(my case is /message/ping), but am getting always
<strong><strong>Response of the above is &quot;RBAC: access denied&quot;</strong></strong></p>

<blockquote>
<p>I wanted all the pods deployed in &quot;dev&quot; namespace to be authenticated except a healthcheck, path of it is path : [&quot;/user/ping&quot;, &quot;/message/ping&quot;] but iam unable to give both at a time</p>
</blockquote>
<p>I've reproduced your issue and I think it's working as you wanted it to work.</p>
<hr />
<p>There are my RequestAuthentication and AuthorizationPolicy yamls.</p>
<pre><code>apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: testing-dev-authenticator
  namespace: istio-system
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  jwtRules:
  - issuer: &quot;testing@secure.istio.io&quot;
    jwksUri: &quot;https://raw.githubusercontent.com/istio/istio/release-1.8/security/tools/jwt/samples/jwks.json&quot;

---

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: require-jwt
  namespace: istio-system
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  action: ALLOW
  rules:
  - from:
    - source:
        requestPrincipals: [&quot;*&quot;]
    to:
    - operation:
        paths: [&quot;/productpage&quot;]
  - to:
    - operation:
        paths: [&quot;/api/v1/products&quot;]
</code></pre>
<p>You can use the following to exclude path (e.g. &quot;/api/v1/products&quot; ) from JWT, when &quot;/productpage&quot; require JWT and will reject all requests without the token.</p>
<p>If you want to exclude more than one path then this should work:</p>
<pre><code>paths: [&quot;/api/v1/products&quot;,&quot;/login&quot;]
</code></pre>
<p>So in your case that would be</p>
<pre><code>paths: [&quot;/user/ping&quot;, &quot;/message/ping&quot;] 
</code></pre>
<hr />
<p>I have tested above configuration on <a href="https://istio.io/latest/docs/examples/bookinfo/" rel="nofollow noreferrer">bookinfo</a> application.</p>
<p>There is the token I have used</p>
<pre><code>TOKEN=$(curl https://raw.githubusercontent.com/istio/istio/release-1.8/security/tools/jwt/samples/demo.jwt -s)
</code></pre>
<p>Tests:</p>
<pre><code>api/v1/products
Without token
200
With token
200
------------------------------------------------------------------
/productpage
Without token
403
With token
200
</code></pre>
<hr />
<p>You also mentioned that you want to do that in particular namespace, then you could try with these RequestAuthentication and AuthorizationPolicy yamls.</p>
<pre><code>apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: testing-dev-authenticator
  namespace: dev
spec:
  jwtRules:
  - issuer: &quot;testing@secure.istio.io&quot;
    jwksUri: &quot;https://raw.githubusercontent.com/istio/istio/release-1.8/security/tools/jwt/samples/jwks.json&quot;

---

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
 name: test-dev-only-authorized-api
 namespace: dev
spec:
 action: DENY
 rules:
 - from:
   - source:
        notRequestPrincipals: [&quot;*&quot;]
   to:
   - operation:
       paths: [&quot;/productpage&quot;]
</code></pre>
<p>Also based on the <a href="https://istio.io/latest/docs/examples/bookinfo/" rel="nofollow noreferrer">bookinfo</a> application.</p>
<p>Tests:</p>
<pre><code>api/v1/products
Without token
200
With token
200
------------------------------------------------------------------
/productpage
Without token
403
With token
200
</code></pre>
<hr />
<p>Additional resources:</p>
<ul>
<li><a href="https://github.com/istio/istio/issues/27432" rel="nofollow noreferrer">Disable RequestAuthentication JWT rules for specific paths</a></li>
<li><a href="https://istio.io/latest/docs/tasks/security/authorization/authz-jwt/" rel="nofollow noreferrer">Authorization with JWT</a></li>
<li><a href="https://istio.io/latest/docs/tasks/security/authentication/authn-policy/#require-valid-tokens-per-path" rel="nofollow noreferrer">Authentication Policy</a></li>
</ul>
