diff --git a/istio/helloworld-jwt-enable.yaml b/istio/helloworld-jwt-enable.yaml
new file mode 100644
index 0000000..e131e75
--- /dev/null
+++ b/istio/helloworld-jwt-enable.yaml
@@ -0,0 +1,15 @@
+apiVersion: "authentication.istio.io/v1alpha1"
+kind: "Policy"
+metadata:
+  name: "jwt-example"
+spec:
+  targets:
+  - name: hello
+  peers:
+  - mtls: {}
+  origins:
+  - jwt:
+      issuer: "http-echo@http-echo.kubernetes.newtech.academy"
+      jwksUri: "http://auth.kubernetes.newtech.academy/.well-known/jwks.json"
+  principalBinding: USE_ORIGIN
+---
diff --git a/istio/helloworld-jwt.yaml b/istio/helloworld-jwt.yaml
new file mode 100644
index 0000000..d43f6bc
--- /dev/null
+++ b/istio/helloworld-jwt.yaml
@@ -0,0 +1,150 @@
+apiVersion: networking.istio.io/v1alpha3
+kind: Gateway
+metadata:
+  name: helloworld-gateway
+spec:
+  selector:
+    istio: ingressgateway # use istio default controller
+  servers:
+  - port:
+      number: 80
+      name: http
+      protocol: HTTP
+    hosts:
+    - "*"
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: VirtualService
+metadata:
+  name: helloworld-auth
+spec:
+  hosts:
+  - "auth.kubernetes.newtech.academy"
+  gateways:
+  - helloworld-gateway
+  http:
+  - route:
+    - destination:
+        host: auth.default.svc.cluster.local
+        port:
+          number: 8080
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: VirtualService
+metadata:
+  name: helloworld-hello
+spec:
+  hosts:
+  - "hello.kubernetes.newtech.academy"
+  gateways:
+  - helloworld-gateway
+  http:
+  - route:
+    - destination:
+        host: hello.default.svc.cluster.local
+        port:
+          number: 8080
+---
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: auth
+spec:
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: auth
+        version: v1
+    spec:
+      containers:
+      - name: auth
+        image: wardviaene/http-echo
+        env:
+        - name: TEXT
+          value: this is the authentication service
+        ports:
+        - name: http
+          containerPort: 8080
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: auth
+  labels:
+    app: auth
+spec:
+  selector:
+    app: auth
+  ports:
+  - name: http
+    port: 8080
+    targetPort: 8080
+---
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: hello
+spec:
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: hello
+        version: v1
+    spec:
+      containers:
+      - name: hello
+        image: wardviaene/http-echo
+        env:
+        - name: TEXT
+          value: Hello, you can only reach this service when authenticated
+        ports:
+        - name: http
+          containerPort: 8080
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hello
+  labels:
+    app: hello
+spec:
+  selector:
+    app: hello
+  ports:
+  - name: http
+    port: 8080
+    targetPort: 8080
+###
+### Enable TLS
+###
+---
+apiVersion: authentication.istio.io/v1alpha1
+kind: "MeshPolicy"
+metadata:
+  name: "default"
+spec:
+  peers:
+  - mtls: {}
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: "enable-mtls"
+  namespace: "default" # even though we specify a namespace, this rule applies to all namespaces
+spec:
+  host: "*.local"
+  trafficPolicy:
+    tls:
+      mode: ISTIO_MUTUAL
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+ name: "api-server"
+spec:
+ host: "kubernetes.default.svc.cluster.local"
+ trafficPolicy:
+   tls:
+     mode: DISABLE