incipal will be empty if JWT validation failed.
In other words, the policy allows requests if the request principal is non-empty.
<code>"*"</code> means non-empty match and using with <code>notRequestPrincipals</code> means matching on empty request principal.</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: require-jwt
  namespace: istio-system
spec:
  selector:
    matchLabels:
      istio: ingressgate