<p>The authentication using kyecloak isn't working as expected, it been used Istio vs Keycloak.
Istio components configured :  Gateway, Virtualservice, AuthorizationPolicy, RequestAuthentication</p>
<p>using a valid token: <strong>401 Jwt issuer is not configured</strong></p>
<p><a href="https://i.stack.imgur.com/zYMaM.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/zYMaM.png" alt="enter image description here" /></a></p>
<p>ISTIO CONFIGURATION FOR SECURITY:</p>
<pre><code>---  
 kubectl apply -f - &lt;&lt;EOF
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: &quot;jwt-example&quot;
  namespace: istio-system
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  jwtRules:
  - issuer: &quot;http://localhost:30080/auth/realms/master&quot;
    jwksUri: &quot;http://localhost:30080/auth/realms/master/protocol/openid-connect/certs&quot;
    forwardOriginalToken: true
    outputPayloadToHeader: x-jwt-payload
    EOF
---
 kubectl apply -f - &lt;&lt;EOF
apiVersion: &quot;security.istio.io/v1beta1&quot;
kind: &quot;AuthorizationPolicy&quot;
metadata:
  name: &quot;frontend-ingress&quot;
  namespace: istio-system
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  action: DENY
  rules:
  - from:
    - source:
        notRequestPrincipals: [&quot;*&quot;]
  principalBinding: USE_ORIGIN
    EOF
--- 
</code></pre>
<p>once there is no authorization Bearer</p>
<p><a href="https://i.stack.imgur.com/sWgyM.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/sWgyM.png" alt="enter image description here" /></a></p>
<p>for double check i used istio's example and worked :</p>
<pre><code> kubectl apply -f - &lt;&lt;EOF
apiVersion: &quot;security.istio.io/v1beta1&quot;
kind: &quot;RequestAuthentication&quot;
metadata:
  name: &quot;jwt-example&quot;
  namespace: istio-system
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  jwtRules:
  - issuer: &quot;testing@secure.istio.io&quot;
    jwksUri: &quot;https://raw.githubusercontent.com/istio/istio/release-1.8/security/tools/jwt/samples/jwks.json&quot;
EOF
kubectl apply -f - &lt;&lt;EOF
apiVersion: &quot;security.istio.io/v1beta1&quot;
kind: &quot;AuthorizationPolicy&quot;
metadata:
  name: &quot;frontend-ingress&quot;
  namespace: istio-system
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  action: DENY
  rules:
  - from:
    - source:
        notRequestPrincipals: [&quot;*&quot;]
EOF
</code></pre>
<p>ISTIO GTW and VS :</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3    
kind: Gateway                               
metadata:                                   
  name: keycloak-gateway
  namespace: default
spec:                                       
  selector:                                 
    istio: ingressgateway                   
  servers:                                  
  - hosts:                                  
    - '*'                                   
    port:                                   
      name: http                            
      number: 80                            
      protocol: HTTP

---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: enterprise-vs
spec:
  hosts:
    - '*'
  gateways:
    - default/keycloak-gateway
  http:
    - match:
        - uri:
            prefix: '/enterprise/'
      rewrite:
        uri: /
      fault:
        delay:
          fixedDelay: 1s
      route:
        - destination:
            host: enterprise
            port:
              number: 8080
            subset: enterprise-s1
          weight: 90
        - destination:
            host: enterprise
            port:
              number: 8080
            subset: enterprise-s2
          weight: 10
</code></pre>

<p>I encountered similar issue.</p>
<p>The JWT token had following value for issuer:
&quot;iss&quot;: &quot;http://localhost:8080/auth/realms/dev&quot;</p>
<p>I matched the same value in my JwtRules i.e. localhost.
However I changed jwksUri to cluster IP address of Keycloak.
This seems to have worked.</p>
<p>jwtRules:</p>
<pre><code>- issuer: 'http://localhost:8080/auth/realms/dev'

  jwksUri: 'http://10.105.250.41:8080/auth/realms/dev/protocol/openid-connect/certs'
</code></pre>
