apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: {{ .To.ServiceName }}
spec:
  selector:
    matchLabels:
      app: {{ .To.ServiceName }}
  jwtRules:
  - issuer: "******@****.***"
    jwksUri: "https://raw.githubusercontent.com/istio/istio/master/tests/common/jwt/jwks.json"
    outputPayloadToHeader: "x-test-payload"

	RequestAuthentication          = config.GroupVersionKind{Group: "security.istio.io", Version: "v1beta1", Kind: "RequestAuthentication"}
	RequestAuthentication_v1       = config.GroupVersionKind{Group: "security.istio.io", Version: "v1", Kind: "RequestAuthentication"}
	Secret                         = config.GroupVersionKind{Group: "", Version: "v1", Kind: "Secret"}

apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: {{ .To.ServiceName }}
spec:
  selector:
    matchLabels:
      app: {{ .To.ServiceName }}
  jwtRules:
  - issuer: "******@****.***"
    jwksUri: "https://raw.githubusercontent.com/istio/istio/master/tests/common/jwt/jwks.json"
    fromHeaders:
    - name: "x-jwt-token"
      prefix: "Value "
    - name: "auth-token"
      prefix: "Token "

---
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: request-authn
spec:
  selector:
    matchLabels:
      app: {{ .dst }}
  jwtRules:
  - issuer: "******@****.***"
    jwksUri: "http://example.com:8000/jwks"
    outputPayloadToHeader: "x-test-payload"
    forwardOriginalToken: true
---
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: jwt-server-se
spec:

apiVersion: release-notes/v2
kind: feature
area: security
releaseNotes:
- |

apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: {{ .To.ServiceName }}
spec:
  selector:
    matchLabels:
      app: {{ .To.ServiceName }}
  jwtRules:
  - issuer: "******@****.***"
    jwksUri: "{{ .JWTServer.JwksURI }}"
    outputPayloadToHeader: "x-test-payload"

apiVersion: release-notes/v2
kind: bug-fix
area: security
releaseNotes:
  - |
    **Fixed** an issue where gateways cannot fetch JWKS from `jwksUri` in RequestAuthentication 

---
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: request-authn
spec:
  selector:
    matchLabels:
      app: {{ .dst }}
  jwtRules:
  - issuer: "******@****.***"
    jwksUri: "http://example.com:8000/jwks"
    outputPayloadToHeader: "x-test-payload"
    forwardOriginalToken: true

	"istio.io/istio/pkg/maps"
)

var _ analysis.Analyzer = &SelectorAnalyzer{}

type SelectorAnalyzer struct{}

var policyGVKs = []config.GroupVersionKind{
	gvk.AuthorizationPolicy,
	gvk.RequestAuthentication,
	gvk.Telemetry,
	gvk.WasmPlugin,
}

type policy interface {
	GetSelector() *typev1beta1.WorkloadSelector
	GetTargetRef() *typev1beta1.PolicyTargetReference
}

---
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: request-authn
spec:
  selector: 
    matchLabels:
      app: {{ .dst }}
  jwtRules:
  - issuer: "******@****.***"
    # https jwt-server running in istio-system ns
    jwksUri: "https://jwt-server:8443/jwks" 
    outputPayloadToHeader: "x-test-payload"
    forwardOriginalToken: true