Istio跨命名空间：istio-system的RequestAuthentication未传递principal至foo的AuthorizationPolicy

问题核心原因 #

Istio网关层的RequestAuthentication解析JWT后，认证上下文（如request.auth.principal、request.auth.claims这类字段）是网关Envoy的本地数据，不会自动传递给后端服务的Sidecar。你配置的outputClaimToHeaders是主动将指定claim写入请求头，所以x-aaaa能正常传到后端，但默认情况下认证上下文不会被转发。

解决方案 #

方案1：让后端Sidecar重新解析JWT（保留request.auth.*字段使用）

这种方式会让后端Sidecar重新解析网关转发的原始JWT，生成对应的认证上下文，适配你现有AuthorizationPolicy的规则：

1. 修改网关的RequestAuthentication，添加forwardOriginalToken: true确保原始JWT被转发：

apiVersion: security.istio.io/v1
kind: RequestAuthentication
metadata:
  name: "jwt-example"
  namespace: istio-system
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  forwardOriginalToken: true
  jwtRules:
  - issuer: "testing@secure.istio.io"
    jwksUri: "https://raw.githubusercontent.com/istio/istio/release-1.25/security/tools/jwt/samples/jwks.json"
    outputClaimToHeaders:
    - header: "x-aaaa"
      claim: "foo"

2. 在foo命名空间给httpbin配置相同的RequestAuthentication，触发后端Sidecar解析JWT：

apiVersion: security.istio.io/v1
kind: RequestAuthentication
metadata:
  name: "httpbin-jwt"
  namespace: foo
spec:
  selector:
    matchLabels:
      app: httpbin
  jwtRules:
  - issuer: "testing@secure.istio.io"
    jwksUri: "https://raw.githubusercontent.com/istio/istio/release-1.25/security/tools/jwt/samples/jwks.json"

方案2：直接利用网关传递的自定义请求头（更高效）

既然网关已经将foo claim写入x-aaaa请求头，直接修改AuthorizationPolicy的判断条件，跳过重复解析JWT的步骤：

apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: httpbin
  namespace: foo
spec:
  selector:
    matchLabels:
      app: httpbin
  action: ALLOW
  rules:
  - from:
    - source:
        requestPrincipals: ["*"]
    to:
    - operation:
        paths: ["/headers"]
    when:
    - key: request.headers[x-aaaa]
      values: ["bar"]  

内容的提问来源于stack exchange，提问作者Pavel Serebryakov