Rewrite in virtualsvc not working when authpolicy implemented - Istio - istio

Question

I am following some of the instructions in https://github.com/istio/istio/issues/40579 to setup Istio with an custom oauth2 provider with keycloak.
I have a main ingress which is sending all the traffic on one host to istio-ingressgateway
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: istio-ingress-main
namespace: istio-system
spec:
ingressClassName: nginx
tls:
- hosts:
- mlp.prod
secretName: mlp-tls
rules:
- host: mlp.prod # A FQDN that describes the host where that rule should be applied
http:
paths: # A list of paths and handlers for that host
- path: /
pathType: Prefix
backend: # How the ingress will handle the requests
service:
name: istio-ingressgateway # Which service the request will be forwarded to
port:
number: 80 # Which port in that service
My ingress gateway is defined as below
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
name: prod-gateway
namespace : istio-system
spec:
selector:
istio: ingressgateway
servers:
- port:
number: 80
name: http
protocol: HTTP
hosts:
- 'mlp.prod'
One of my services is mlflow which is installed in mlflow namespace for which the virtual service is defined as below
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: gateway-vs-mlflow
namespace: mlflow
spec:
hosts:
- '*'
gateways:
- istio-system/prod-gateway
http:
- match:
- uri:
prefix: "/mlflow"
rewrite:
uri: " "
route:
- destination:
host: mlflow-service.mlflow.svc.cluster.local
port:
number: 5000
Now when i try to access the host mlp.prod/mlflow/, I am able to access MLFLOW without any issues and the UI comes up correctly.
However if i try to add an oauth provider in an authpolicy towards the /mlflow route, then I get 404 page not available after the oauth authentication is done
The authpolicy is as in the below
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: oauth-policy
namespace: istio-system
spec:
selector:
matchLabels:
app: istio-ingressgateway
action: CUSTOM
provider:
name: "oauth2-proxy"
rules:
- to:
- operation:
paths: ["/mlflow"]
Please assist in this issue. Is the rewrite in Virtual service supposed to work only without authpolicy with oauth2-proxy provider
Kindly help
Thanks,
Sujith.
Version
istioctl version
client version: 1.15.2
control plane version: 1.15.2
data plane version: 1.15.2 (8 proxies)
kubectl version --short
Flag --short has been deprecated, and will be removed in the future. The --short output will become the default.
Client Version: v1.24.2
Kustomize Version: v4.5.4
Server Version: v1.22.9
WARNING: version difference between client (1.24) and server (1.22) exceeds the supported minor version skew of +/-1

Answer 1

I was able to resolve this by setting the oauth config with the below new value
upstreams="static://200"
Once this was done the oauth2 started returning 200 for authenticated users and everything was fine.