feat: RequestAuthentication add presence field to JWTRule (#60823)

releasenotes/notes/jwt-required-field.yaml

@@ -0,0 +1,13 @@
+apiVersion: release-notes/v2
+kind: feature
+area: security
+issue:
+  - https://github.com/istio/istio/issues/60823
+
+releaseNotes:
+  - |
+    **Added** `presence` field in `RequestAuthentication` under `spec.jwtRules` to configure
+    whether a JWT token is required (`REQUIRED`) or optional (`OPTIONAL`, default).
+    When set to `REQUIRED`, requests missing the token are rejected with 401 even if other
+    JWT rules are satisfied, enabling configurations where all tokens must be present and valid simultaneously.
+    The default behavior is `OPTIONAL`, which allows requests to pass if at least one JWT rule is satisfied, even if others are missing or invalid (current behavior).

security/v1beta1/request_authentication.proto

@@ -487,8 +487,26 @@ message JWTRule {
   // +kubebuilder:validation:MaxItems=64
   repeated string space_delimited_claims = 14;
 
+  // Specifies whether the JWT token is required or optional in the request.
+  enum JWTRequirement {
+    // The JWT token is optional. Requests without a token are allowed as long as
+    // no invalid token is present. This is the default behavior.
+    OPTIONAL = 0;
+
+    // The JWT token must be present and valid. Requests without this token will
+    // be rejected with 401 even if other JWT rules are satisfied.
+    REQUIRED = 1;
+  }
+
+  // Configures whether the JWT token must be present in the request.
+  // When set to `REQUIRED`, requests without this token will be rejected with 401
+  // even if other JWT rules are satisfied. When `OPTIONAL` (the default), a missing
+  // token is allowed as long as no invalid token is present. This is useful when
+  // multiple JWT rules are configured and all tokens must be present and valid simultaneously.
+  JWTRequirement presence = 15;
+
   // $hide_from_docs
-  // Next available field number: 15
+  // Next available field number: 16
 }
 
 // This message specifies a header location to extract JWT token.

tests/testdata/reqauth-invalid.yaml

@@ -221,3 +221,13 @@ spec:
     spaceDelimitedClaims:
     - ""
 ---
+_err: 'Unsupported value: "MANDATORY"'
+apiVersion: security.istio.io/v1
+kind: RequestAuthentication
+metadata:
+  name: invalid-presence-value
+spec:
+  jwtRules:
+  - issuer: example
+    presence: MANDATORY
+---

tests/testdata/reqauth-valid.yaml

@@ -23,3 +23,4 @@ spec:
     spaceDelimitedClaims:
     - "custom_scope"
     - "provider.login.scope"
+    presence: REQUIRED