apiVersion: networking.istio.io/v1alpha3v1
kind: GatewayService
metadata:
name: keycloak
namelabels:
emco-gatewayapp: keycloak
spec:
namespaceports:
istio-system specname: http
 selectorport: 8080
targetPort: 8080
- istioname: ingressgatewayhttps
#port: use8443
IstiotargetPort: default8443
gatewayselector:
implementationapp: keycloak
 serverstype: LoadBalancer
---
-
portapiVersion: apps/v1
kind: Deployment
metadata:
name: keycloak
numberlabels:
80app: keycloak
spec:
replicas: 1
selector:
matchLabels:
nameapp: httpkeycloak
template:
metadata:
labels:
app: keycloak
spec:
protocolcontainers:
HTTP- name: keycloak
  hostsimage: quay.io/keycloak/keycloak:9.0.2
volumeMounts:
- name: keycloak-certs
"*"
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: emco-credential
    hosts:
    - "*"

stioctl kube-inject -f ovn4k8sdb.yaml | kubectl apply -f -
istioctl kube-inject -f ovn4k8s.yaml | kubectl apply -f -

kubectl create -n istio-system secret tls emco-credential --key=v2.key --cert=v2.crt

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: orchestrator
  namespace: emco
spec:
  hosts:
  - "*"
  gateways:
  - emco-gateway.istio-system.svc.cluster.local
  http:
  - match:
    - uri:
        prefix: /v2/oauth
    - uri:
        prefix: /v2
 "filters": [  route:
    - destination:
  {      port:
      "oidc":    number: 9015
        host: {
                "authorization_uri": "orchestrator

apiVersion: "authentication.istio.io/v1alpha1"
kind: "Policy"
metadata:
  name: "emco-authn-policy"
  namespace: istio-system
spec:
  origins:
    - jwt:
   "token_uri"     issuer: "https://<Keycloak IP Address:port>/auth/realms/enterprise1/protocol/openid-connect/token",
        jwksUri: "http://<Keycloak IP Address:port>/auth/realms/enterprise1/protocol/openid-connect/certs"
  principalBinding:  "callback_uri": "USE_ORIGIN

kind: ConfigMap
apiVersion: v1
metadata:
  name: emco-authservice-configmap
  namespace: istio-system
data:
  config.json: |
    {
      "listen_address": "127.0.0.1",
        "clientlisten_idport": "emco10003",
        "log_level": "trace",
       "client_secretthreads": "Copy secret from keycloak",8,
      "chains": [
        {
          "trusted_certificate_authority": "-----BEGIN CERTIFICATE-----CA Certificate for the keycloak server in escaped format----END CERTIFICATE-----",
name": "idp_filter_chain",
          "filters": [
          {
    "scopes": [],        "oidc":
           "id_token": {  {
                "preambleauthorization_uri": "Bearerhttps://<Keycloak IP Address:port>/auth/realms/enterprise1/protocol/openid-connect/auth",
                  "headertoken_uri": "Authorization"
                }https://<Keycloak IP Address:port>/auth/realms/enterprise1/protocol/openid-connect/token",
                "access_token": {
 callback_uri": "https://<Istio Ingress service IP Address:port>/v2/oauth/callback",
                "preamblejwks": "Bearer",{Escaped Json output of the command --> curl http://<Keycloak    IP Address:port>/auth/realms/enterprise1/protocol/openid-connect/certs}",
      "header": "Authorization"         "client_id": "emco",
      }          "client_secret": "Copy secret from keycloak",
}             }   "trusted_certificate_authority": "-----BEGIN CERTIFICATE-----CA Certificate for the keycloak server in  ]escaped format----END CERTIFICATE-----",
          }      "scopes": [],
              }

$ kubectl edit  deployments istio-ingressgateway -n istio-system
Under containers section add:
- name: authservice
        image: adrianlzt/authservice:0.3.1-d3cd2d498169
        imagePullPolicy: Always
        ports:
          - containerPort: 10003
        volumeMounts:
          - name: emco-authservice-configmap-volume
            mountPath: /etc/authservice

In the volumes section add:
     - name: emco-authservice-configmap-volume
        configMap:
          name: emco-authservice-configmap

#
# Add the ext_authz filter to the istio-ingressgateway  Envoy filter chain.
# Configure the ext_authz filter to ask the authservice about every incoming request
# via GRPC. For every incoming request, the authservice will decide to either allow
# the request and add tokens as headers, or will cause the response to redirect for
# authentication.
#

---
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: sidecar-token-service-filter-for-ingress
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
      app: istio-ingressgateway
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: GATEWAY
      listener:
        filterChain:
          filter:
            name: "envoy.http_connection_manager"
            subFilter:
              name: "envoy.filters.http.jwt_authn"
    patch:
      operation: INSERT_BEFORE
      value:
       name: envoy.ext_authz
       config:
         stat_prefix: ext_authz
         grpc_service:
           envoy_grpc:
             cluster_name: ext_authz
           timeout: 10s # Timeout for the entire request (including authcode for token exchange with the IDP)
  - applyTo: CLUSTER
    match:
      context: ANY
      cluster: {} # this line is required starting in istio 1.4.0
    patch:
      operation: ADD
      value:
        name: ext_authz
        connect_timeout: 5s # This timeout controls the initial TCP handshake timeout - not the timeout for the entire request
        type: LOGICAL_DNS
        lb_policy: ROUND_ROBIN
        http2_protocol_options: {}
        load_assignment:
          cluster_name: ext_authz
          endpoints:
            - lb_endpoints:
                - endpoint:
                    address:
                      socket_address:
                        address: 127.0.0.1
                        port_value: 10003

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: orchestrator
  namespace: test
spec:
  hosts:
  - "*"
  gateways:
  - orchestrator-gateway
  http:
  - match:
    - uri:
        prefix: /v2/oauth
    - uri:
        prefix: /v2
    - uri:
        prefix: /v2/projects/enterprise1/oauth
    -uri:
        prefix: /v2/projects/enterprise2/oauth
    route:
    - destination:
        port:
          number: 9015
        host: orchestrator

---
  apiVersion: "authentication.istio.io/v1alpha1"
  kind: "Policy"
  metadata:
    name: "orchestrator-authn-policy"
    namespace: istio-system
  spec:
    origins:
      - jwt:
          issuer: "https://<url>/auth/realms/enterprise1"
          jwksUri: "http://<url>/auth/realms/enterprise1/protocol/openid-connect/certs"
      - jwt:
          issuer: "https://<url>/auth/realms/enterprise2"
          jwksUri: "http://<url>/auth/realms/enterprise2/protocol/openid-connect/certs"
    principalBinding: USE_ORIGIN

---
kind: ConfigMap
apiVersion: v1
metadata:
name: emco-authservice-configmap
namespace: istio-system
data:
config.json: |
  {
    "listen_address": "127.0.0.1",
    "listen_port": "10003",
    "log_level": "trace",
    "threads": 8,
    "chains": [
      {
        "name": "idp_filter_chain_1",
        "match": {
          "header": ":path",
          "prefix": "/v2/projects/enterprise1"
        },
        "filters": [
        {
          "oidc":
            {
              "authorization_uri": "https://x.x.x.x:<port>/auth/realms/enterprise1/protocol/openid-connect/auth",
              "token_uri": "https://x.x.x.x:<port>/auth/realms/enterprise1/protocol/openid-connect/token",
              "callback_uri": "https://x.x.x.x:<port>/v2/projects/enterprise1/oauth/callback",
              "jwks": "{\"keys\":[{\"kid\":\"xxxxx\",\"kty\":\"RSA\",\"alg\":\"RS256\",\"use\":\"sig\",\"n\":\"zzzzzzz\",\"e\":\"AQAB\",\"x5c\":[\"xxxxxx\"],\"x5t\":\"z7Qrc2nAlK8EVmkiKtz0bOWxugE\",\"x5t#S256\":\"xxxxxxxxx\"}]}",
              "client_id": "emco",
              "client_secret": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
              "trusted_certificate_authority": "-----BEGIN CERTIFICATE-----\r\nxxxxxxxx\r\n-----END CERTIFICATE-----\r\n",
              "scopes": [],
              "id_token": {
                "preamble": "Bearer",
                "header": "Authorization"
              },
              "access_token": {
                "preamble": "Bearer",
                "header": "Authorization"
              }
           imagePullPolicy: Always}
        ports:  }
        -]
containerPort: 10003     },
   volumeMounts:   {
       - "name: emco-authservice-configmap-volume": "idp_filter_chain_2",
        "match": {
    mountPath: /etc/authservice  In the volumes section add:"header": ":path",
     -    name: emco-authservice-configmap-volume
 "prefix": "/v2/projects/enterprise2"
       configMap: },
         name"filters": emco-authservice-configmap

apiVersion:   load_assignment"security.istio.io/v1beta1"
kind: AuthorizationPolicy
metadata:
        cluster_name: ext_authzallow-admin
  namespace: istio-system
spec:
     endpointsselector:
    matchLabels:
      app: istio-ingressgateway
lb_endpoints:  action: ALLOW
  rules:
  - when:
    -  - endpoint:key: request.auth.claims[role]
      values: ["ADMIN"]

---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-user
  addressnamespace: istio-system
spec:
  selector:
    matchLabels:
      app: istio-ingressgateway
    socket_addressaction: ALLOW
  rules:
  - to:
    - operation:
          address: 127.0.0.1paths: ["/v2/projects/enterprise1/*"]
    when:
    - key: request.auth.claims[role]
      values: ["USER"]     port_value: 10003