It’s not mentioned in the docs as to how a principal name is constructed. By principal I mean the name in the client certificate that istio sidecar creates and can be referenced in istio AuthorizationPolicy objects in the from directives of the spec.
By looking at the example yaml files used in the docs I was able to see that kubernetes ServiceAccount are part of the process. It appears to me that the ServiceAccount name is what’s used as part of the principal but that’s just a guess from looking at the examples. It’s not documented. So all I can infer is that a principal name is in the format:
cluster.local/ns/<namespace>/sa/<serviceaccountname>
Is there a guide for regular mere mortals?