stio-system
spec:
  selector:
    matchLabels:
      app: istio-ingressgateway
  rules:
  - from:
    - source:
        requestPrincipals: [&quot;*&quot;]
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: route-jwt
spec:
  hosts:
  - foo.prod.svc.cluster.local
  gateways:
  - istio-ingressgateway
  http:
  - name: &quot;v2&quot;
    match:
    - headers:
        &quot;@request.auth.claims.sub&quot;:
          exact: &quot;dev&quot;
    route:
    - destination:
        host