Cannot Extract JWT Claims with Dotted Keys (kubernetes.io) in Istio

[Bredervik]

I have Kubernetes-managed service account tokens, and I would like to extract some values from the JWT payload using Istio's outputClaimToHeaders feature.

The problem arises when trying to extract a claim with a dotted key (.) in its name, such as kubernetes.io.namespace. The token structure looks like this:
{
"kubernetes.io": {
"namespace": "a-namespace"
}
}

When attempting to extract the namespace field using Istio's outputClaimToHeaders, the header is not set, and Istio does not correctly retrieve the value.

Steps to reproduce:

1. Deploy an Istio RequestAuthentication policy with the following configuration:
   `apiVersion: security.istio.io/v1beta1
   kind: RequestAuthentication
   metadata:
   name: jwt-auth
   namespace: istio-system
   spec:
   jwtRules:

   • issuer:
     jwksUri:
     fromHeaders:
     • name: Authorization
       prefix: "Bearer "
       outputClaimToHeaders:
     • header: istio-original-namespace
       claim: kubernetes.io.namespace`
     • header: iss-header-check
       claim: iss

2. Send a request with a valid JWT that contains kubernetes.io.namespace.

3. Check the headers in the downstream application

4. Observe that istio-original-namespace is missing, while other claims (e.g., iss) are correctly extracted

Some proposed fixes

• Support escaping dots in claims (e.g., kubernetes\.io.namespace).
• Allow bracket notation for nested keys (e.g., ["kubernetes.io"]["namespace"]).

[davidspek]

This seems related to #94 and envoyproxy/envoy#33603