Find the Istio JWKS Fetcher Before Setting Its Proxy
Check Istio 1.31 fetch mode, then configure istiod's Go HTTP route or inspect Envoy's remote-key transport accordingly.
RequestAuthentication.jwksUri does not identify the application as the downloader. Istio 1.31 documents these PILOT_JWT_ENABLE_REMOTE_JWKS modes:
| Value | Fetcher |
|---|---|
| istiod / false | istiod |
| hybrid / true | Envoy with istiod fallback for external servers |
| envoy | Envoy |
Inspect the deployed version and actual control-plane environment before choosing a branch.
istiod path
Its key resolver uses Go environment proxy discovery. For the istiod Helm chart, merge values such as:
env:
HTTPS_PROXY: http://proxy.example:8080
NO_PROXY: localhost,127.0.0.1,.svc,.cluster.local,10.96.0.1This is a chart-values fragment, not a resource. Use the cluster's actual service address, DNS suffix and internal bypasses, then apply the managed rollout. Application variables or a ServiceEntry cannot supply another pod's environment. If the JWKS URLs are public and public-proxy egress is permitted, the HTTP proxy list supplies candidates for istiod’s HTTPS_PROXY value; retain the cluster’s internal bypasses.
Envoy path
Inspect its remote JWKS cluster and network route. Registering the destination with the mesh does not by itself add a corporate CONNECT hop; istiod's variables cannot configure Envoy's transport.