Authentication Policy Origins JWT - Internal vs Public Access

Security
2

There are 2 options to solve this:

  1. you can apply the JWT policy on your [3]Web-Interface but not on [1] Smoke-Detector-Service.
  2. you can set the JWT policy with originIsOptional: true and use Istio Authorization policy to enforce different access control based on the source of the request. You can write an authorization policy that requires JWT token only if the request is coming from [3] Web-Interface.