apiVersion: authentication.istio.io/v1alpha1
kind: Policy
metadata:
  name: ingress-jwt
spec:
  origins:
  - jwt:
      audiences:
      - TO_BE_PATCHED
      issuer: https://cloud.google.com/iap
      jwksUri: https://www.gstatic.com/iap/verify/public_key-jwk
      jwtHeaders:
      - x-goog-iap-jwt-assertion
      trigger_rules:
      - excluded_paths:
        - exact: /healthz/ready
  principalBinding: USE_ORIGIN
  targets:
  - name: istio-ingressgateway
    ports:
    - number: 80
