<p>There are ServiceA and ServiceB services deployed under the same namespace. There is istio enabled for validating request authentication. Any calls to the service needs to have 'Authrization' header with valid jwt token. It get validated with <a href="https://istio.io/latest/docs/reference/config/security/request_authentication/" rel="nofollow noreferrer">RequestAuthenication</a> along with <a href="https://istio.io/latest/docs/reference/config/security/authorization-policy/" rel="nofollow noreferrer">AuthorizationPolicy</a> set. It is working as expected and I can make http calls with valid auth token. Now the ServiceA needs to talk to ServiceB. I used the service-name <code>serviceb..&lt;namespace-name&gt;.svc.cluster.local</code>. The call is passed to ServiceB but fails with HTTP 403. It is expecting the auth token header.
How can I allow the calls between the services within the same namespace without auth token?
I am trying to find an example to customize the <a href="https://istio.io/latest/docs/reference/config/security/authorization-policy/" rel="nofollow noreferrer">AuthorizationPolicy</a>, so that it allows the calls with in the same namespace as trusted service without auth token. Please let me know, whether it is possible or if there an alternate way.</p>
<p>All my pods running under services are spring-boot and using RestTemplate for calling between services.</p>
<p>Below is the istio auth policy used</p>
<pre><code>apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: service-auth-policy
  namespace: namespace-dev
spec:
  rules:
  - from:
      - source:
          requestPrincipals: [&quot;*&quot;]
</code></pre>

Senthil
<p>I changed the original authorization policy from</p>
<pre><code>apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: service-auth-policy
  namespace: namespace-dev
spec:
  rules:
  - from:
      - source:
          requestPrincipals: [&quot;*&quot;]
</code></pre>
<p>including the namespace as below</p>
<pre><code>apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: catalog-auth-policy
  namespace: namespace-dev
spec:
  rules:
  - from:
      - source:
          requestPrincipals: [&quot;*&quot;]
      - source:
          namespaces: [&quot;namespace-dev&quot;]
</code></pre>
<p>and it worked as expected.</p>
