kubectl create ns keycloak
kubectl create -n keycloak secret tls ca-keycloak-certs --key keycloak.key --cert keycloak.crt
kubectl apply -f keycloak.yaml -n keycloak

apiVersion: v1
kind: Service
metadata:
name: keycloak
labels:
app: keycloak
spec:
ports:
- name: http
port: 8080
targetPort: 8080
- name: https
port: 8443
targetPort: 8443
selector:
app: keycloak
type: LoadBalancer
---

apiVersion: apps/v1
kind: Deployment
metadata:
name: keycloak
labels:
app: keycloak
spec:
replicas: 1
selector:
matchLabels:
app: keycloak
template:
metadata:
labels:
app: keycloak
spec:
containers:
- name: keycloak
image: quay.io/keycloak/keycloak:9.0.2
volumeMounts:
- name: keycloak-certs
mountPath: /etc/x509/https
readOnly: false
env:
- name: KEYCLOAK_USER
value: "admin"
- name: KEYCLOAK_PASSWORD
value: "admin"
- name: PROXY_ADDRESS_FORWARDING
value: "true"
ports:
- name: http
containerPort: 8080
- name: https
containerPort: 8443
readinessProbe:
httpGet:
path: /auth/realms/master
port: 8080
volumes:
- name: keycloak-certs
secret:
secretName: keycloak-certs
defaultMode: 420
optional: true

stioctl kube-inject -f ovn4k8sdb.yaml | kubectl apply -f -
istioctl kube-inject -f ovn4k8s.yaml | kubectl apply -f -

kubectl create -n istio-system secret tls emco-credential --key=v2.key --cert=v2.crt

$ kubectl create -n istio-system secret tls emco-credential --key=v2.key --cert=v2.crt

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: "emco-authn-policy"gateway
  namespace: istio-system
spec:
  originsselector:
    -istio: jwt:ingressgateway # use Istio default gateway implementation
  issuerservers:
"https://<Keycloak IP Address:port>/auth/realms/enterprise1"
  - port:
      number: 80
       jwksUriname: "http://<Keycloak IP Address:port>/auth/realms/enterprise1/protocol/openid-connect/certs"http
      principalBindingprotocol: USE_ORIGIN

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
 "threads"metadata:
8,  name: orchestrator
   "chains"namespace: [emco
spec:
  hosts:
  - "*"
{  gateways:
  - emco-gateway.istio-system.svc.cluster.local
    "name"http:
"idp_filter_chain",  - match:
    -   "filters"uri:
[        prefix: /v2/oauth
 {   - uri:
        "oidc"prefix: /v2
    route:
    - destination:
  {      port:
          "authorization_uri": "https://<Keycloak IP Address:port>/auth/realms/enterprise1/protocol/openid-connect/auth",number: 9015
                "token_uri": "https://<Keycloak IP Address:port>/auth/realms/enterprise1/protocol/openid-connect/token",
                "callback_uri": "https://<Istio Ingress service IP Address:port>/v2/oauth/callback",
     host: orchestrator

apiVersion: "authentication.istio.io/v1alpha1"
kind: "Policy"
metadata:
  name: "emco-authn-policy"
  namespace: istio-system
spec:
  origins:
    - jwt:
          "jwks"issuer: "{Escaped Json output of the command --> curl httphttps://<Keycloak IP Address:port>/auth/realms/enterprise1/protocol/openid-connect/certs}","
        jwksUri: "http://<Keycloak         "client_id": "emco",
                "client_secret": "Copy secret from keycloak",
                "trusted_certificate_authority": "-----BEGIN CERTIFICATE-----CA Certificate for the keycloak server in escaped format----END CERTIFICATE-----",
          IP Address:port>/auth/realms/enterprise1/protocol/openid-connect/certs"
  principalBinding: USE_ORIGIN

kind: ConfigMap
apiVersion: v1
metadata:
  name: emco-authservice-configmap
  namespace: istio-system
data:
  config.json: |
    {
      "scopeslisten_address": []"127.0.0.1",
         "listen_port": "10003",
      "idlog_tokenlevel": {"trace",
         "threads": 8,
        "preamblechains": "Bearer",[
        {
          "headername": "Authorizationidp_filter_chain",
          "filters": [
     },     {
            "access_tokenoidc":
{              {
    "preamble": "Bearer",
                  "header"authorization_uri": "Authorization"
  https://<Keycloak IP Address:port>/auth/realms/enterprise1/protocol/openid-connect/auth",
             }   "token_uri": "https://<Keycloak IP Address:port>/auth/realms/enterprise1/protocol/openid-connect/token",
        }        "callback_uri": "https://<Istio Ingress service  }IP Address:port>/v2/oauth/callback",
          ]      "jwks": "{Escaped Json }output of the command -->   ]
    }

$ kubectl edit  deployments istio-ingressgateway -n istio-system
Under containers section add:
- name: authservice
        image: adrianlzt/authservice:0.3.1-d3cd2d498169
        imagePullPolicy: Always
        ports:
          - containerPort: 10003
        volumeMounts:
          - name: emco-authservice-configmap-volume
            mountPath: /etc/authservice

In the volumes section add:
     - name: emco-authservice-configmap-volume
        configMap:
          name: emco-authservice-configmap

#
# Add the ext_authz filter to the istio-ingressgateway  Envoy filter chain.
# Configure the ext_authz filter to ask the authservice about every incoming request
# via GRPC. For every incoming request, the authservice will decide to either allow
# the request and add tokens as headers, or will cause the response to redirect for
# authentication.
#

---
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: sidecar-token-service-filter-for-ingress
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
      app: istio-ingressgateway
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: GATEWAY
      listener:
        filterChain:
          filter:
            name: "envoy.http_connection_manager"
            subFilter:
              name: "envoy.filters.http.jwt_authn"
    patch:
      operation: INSERT_BEFORE
      value:
       name: envoy.ext_authz
       config:
         stat_prefix: ext_authz
         grpc_service:
           envoy_grpc:
             cluster_name: ext_authz
           timeout: 10s # Timeout for the entire request (including authcode for token exchange with the IDP)
  - applyTo: CLUSTER
    match:
      context: ANY
      cluster: {} # this line is required starting in istio 1.4.0
    patch:
      operation: ADD
      value:
        name: ext_authz
        connect_timeout: 5s # This timeout controls the initial TCP handshake timeout - not the timeout for the entire request
        type: LOGICAL_DNS
        lb_policy: ROUND_ROBIN
        http2_protocol_options: {}
        load_assignment:
          cluster_name: ext_authz
          endpoints:
            - lb_endpoints:
                - endpoint:
                    address:
                      socket_address:
                        address: 127.0.0.1
                        port_value: 10003

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: orchestrator
  namespace: test
spec:
  hosts:
  - "*"
  gateways:
  - orchestrator-gateway
  http:
  - match:
    - uri:
        prefix: /v2/oauth
    - uri:
        prefix: /v2
    - uri:
        prefix: /v2/projects/enterprise1/oauth
    -uri:
        prefix: /v2/projects/enterprise2/oauth
    route:
    - destination:
        port:
          number: 9015
        host: orchestrator

---
  apiVersion: "authentication.istio.io/v1alpha1"
  kind: "Policy"
  metadata:
    name: "orchestrator-authn-policy"
    namespace: istio-system
  spec:
    origins:
      - jwt:
          issuer: "https://<url>/auth/realms/enterprise1"
          jwksUri: "http://<url>/auth/realms/enterprise1/protocol/openid-connect/certs"
      - jwt:
          issuer: "https://<url>/auth/realms/enterprise2"
          jwksUri: "http://<url>/auth/realms/enterprise2/protocol/openid-connect/certs"
    principalBinding: USE_ORIGIN

---
kind: ConfigMap
apiVersion: v1
metadata:
name: emco-authservice-configmap
namespace: istio-system
data:
config.json: |
  {
    "listen_address": "127.0.0.1",
    "listen_port": "10003",
    "log_level": "trace",
    "threads": 8,
    "chains": [
      {
        "name": "idp_filter_chain_1",
        "match": {
          "header": ":path",
          "prefix": "/v2/projects/enterprise1"
        },
        "filters": [
        {
          "oidc":
            {
              "authorization_uri": "https://x.x.x.x:<port>/auth/realms/enterprise1/protocol/openid-connect/auth",
              "token_uri": "https://x.x.x.x:<port>/auth/realms/enterprise1/protocol/openid-connect/token",
              "callback_uri": "https://x.x.x.x:<port>/v2/projects/enterprise1/oauth/callback",
              "jwks": "{\"keys\":[{\"kid\":\"xxxxx\",\"kty\":\"RSA\",\"alg\":\"RS256\",\"use\":\"sig\",\"n\":\"zzzzzzz\",\"e\":\"AQAB\",\"x5c\":[\"xxxxxx\"],\"x5t\":\"z7Qrc2nAlK8EVmkiKtz0bOWxugE\",\"x5t#S256\":\"xxxxxxxxx\"}]}",
              "client_id": "emco",
              "client_secret": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
              "trusted_certificate_authority": "-----BEGIN CERTIFICATE-----\r\nxxxxxxxx\r\n-----END CERTIFICATE-----\r\n",
              "scopes": [],
              "id_token": {
                "preamble": "Bearer",
                "header": "Authorization"
              },
              "access_token": {
                "preamble": "Bearer",
                "header": "Authorization"
              }
           imagePullPolicy: Always}
        ports:  }
        -]
containerPort: 10003     },
   volumeMounts:   {
       - "name: emco-authservice-configmap-volume": "idp_filter_chain_2",
        "match": {
    mountPath: /etc/authservice  In the volumes section add:"header": ":path",
     -    name: emco-authservice-configmap-volume
 "prefix": "/v2/projects/enterprise2"
       configMap: },
         name"filters": emco-authservice-configmap

apiVersion:   load_assignment"security.istio.io/v1beta1"
kind: AuthorizationPolicy
metadata:
        cluster_name: ext_authzallow-admin
  namespace: istio-system
spec:
     endpointsselector:
    matchLabels:
      app: istio-ingressgateway
lb_endpoints:  action: ALLOW
  rules:
  - when:
    -  - endpoint:key: request.auth.claims[role]
      values: ["ADMIN"]

---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-user
  addressnamespace: istio-system
spec:
  selector:
    matchLabels:
      app: istio-ingressgateway
    socket_addressaction: ALLOW
  rules:
  - to:
    - operation:
          address: 127.0.0.1paths: ["/v2/projects/enterprise1/*"]
    when:
    - key: request.auth.claims[role]
      values: ["USER"]     port_value: 10003