KS
This was a core requirement when I designed it. The inspiration came from migrating older services that had auth baked in, which made them tightly coupled to the existing infra. With this approach, a service can be upgraded or replaced without other components changing and without the auth flow changing. The one downside is the per-service header projection: each service needs its own EnvoyFilter to strip inbound identity headers and a RequestAuthentication to project the verified claim into a service-specific header (x-ms2-user, x-ms3-user, and so on). Its a tradeoff easier migration, security and isolation for a costlier bill :)