<p>I'm using the pre-packaged Kubernetes cluster that comes with docker desktop. I'm on a windows machine, running the Kubernetes on a Ubuntu-18.04 VM using WSL 2. On my Kubernetes cluster I run:</p>
<pre><code>istioctl install --set profile=demo --set values.global.jwtPolicy=third-party-jwt
</code></pre>
<p>But I get the message:</p>
<pre><code>Detected that your cluster does not support third party JWT authentication. Falling back to less secure first party JWT. See https://istio.io/v1.9/docs/ops/best-practices/security/#configure-third-party-service-account-tokens for details.
</code></pre>
<p>After that, it freezes on this until it times out:</p>
<pre><code>Processing resources for Istiod. Waiting for Deployment/istio-system/istiod
</code></pre>
<p>Is there a way of enabling third party JWT in my cluster?</p>

<p>In the error message that you've received there is a link that points to the documentation on that specific issue:</p>
<ul>
<li><em><a href="https://istio.io/latest/docs/ops/best-practices/security/#configure-third-party-service-account-tokens" rel="nofollow noreferrer">Istio.io: Latest: Docs: Ops: Best practices: Security: Configure third party service account tokens</a></em></li>
</ul>
<p>Citing the official documentation:</p>
<blockquote>
<h3>Configure third party service account tokens</h3>
<p>To authenticate with the Istio control plane, the Istio proxy will use a Service Account token. Kubernetes supports two forms of these tokens:</p>
<p>Third party tokens, which have a scoped audience and expiration.
First party tokens, which have no expiration and are mounted into all pods.
Because the properties of the first party token are less secure, Istio will default to using third party tokens. However, this feature is not enabled on all Kubernetes platforms.</p>
<p>If you are using istioctl to install, support will be automatically detected. This can be done manually as well, and configured by passing <code>--set values.global.jwtPolicy=third-party-jwt</code> or <code>--set values.global.jwtPolicy=first-party-jwt</code>.</p>
<p>To determine if your cluster supports third party tokens, look for the TokenRequest API. If this returns no response, then the feature is not supported:</p>
<p><code>$ kubectl get --raw /api/v1 | jq '.resources[] | select(.name | index(&quot;serviceaccounts/token&quot;))'</code></p>
<pre><code>{
    &quot;name&quot;: &quot;serviceaccounts/token&quot;,
    &quot;singularName&quot;: &quot;&quot;,
    &quot;namespaced&quot;: true,
    &quot;group&quot;: &quot;authentication.k8s.io&quot;,
    &quot;version&quot;: &quot;v1&quot;,
    &quot;kind&quot;: &quot;TokenRequest&quot;,
    &quot;verbs&quot;: [
        &quot;create&quot;
    ]
}
</code></pre>
<p>While most cloud providers support this feature now, many local development tools and custom installations may not prior to Kubernetes 1.20. To enable this feature, please refer to the <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-token-volume-projection" rel="nofollow noreferrer">Kubernetes documentation</a>.</p>
</blockquote>
<hr />
<p>I'm not sure if this feature is supported by Kubernetes (<code>1.19.7</code>) created with Docker Desktop but Kubernetes documentation shows a way how you could enable it:</p>
<blockquote>
<h3>Service Account Token Volume Projection</h3>
<p><strong>FEATURE STATE:</strong> Kubernetes v1.20 [stable]</p>
<p><strong>Note:</strong></p>
<p>To enable and use token request projection, you must specify each of the following command line arguments to kube-apiserver:</p>
<pre><code>--service-account-issuer
--service-account-key-file
--service-account-signing-key-file
--api-audiences
</code></pre>
</blockquote>
<p>You can edit your <code>kubeapi-server</code> manifest in a Docker Desktop with Kubernetes in a somewhat hacky way. You can read more about it by following this answer (which I am the author of):</p>
<ul>
<li><em><a href="https://stackoverflow.com/questions/64758012/location-of-kubernetes-config-directory-with-docker-desktop-on-windows/64774052#64774052">Stackoverflow.com: Questions: Location of Kubernetes config directory with Docker Desktop on Windows</a></em></li>
</ul>
<hr />
<h3>Workaround</h3>
<p>As you are using Docker on your host, you could also consider using <code>minikube</code> with its <code>--driver=docker</code>. It supports third party JWT tokens as described in the Istio documentation (it produces the response from the <code>$ kubectl get --raw ...</code> command).</p>
<blockquote>
<p>A side note!</p>
<p>I've tested this on a <code>minikube</code> version <code>1.19.0</code> and Kubernetes version <code>1.20.2</code>.</p>
</blockquote>
