There is a problem with setting Authorization for workloads in waypoint managed.

[LiZhenCheng9527]

What happened:

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-by-srcip
  namespace: default
spec:
  selector:
    matchLabels:
      app: httpbin
  action: ALLOW
  rules:
  - from:
    - source:
        ipBlocks:
        - 10.244.1.46/32

When httpbin is managed by waypoint, even 10.244.1.46 access to httpbin is denied.

What you expected to happen:

How to reproduce it (as minimally and precisely as possible):

Anything else we need to know?:

Environment:

• Kmesh version:
• Kmesh mode(kmesh has Kernel-Native Mode and Duel-Engine Mode):
• Istio version:
• Kernel version:
• Others:

[LiZhenCheng9527]

Because when src accesses dst, if dst is managed by waypoint. Then for http access, the access link is src->waypoint->dst.
The src addr obtained by dst will become the waypoint's addr, because the waypoint's addr will replace the src's addr. This will result in the link failing to pass the Authorization Policy and the link will fail to be established.

[LiZhenCheng9527]

/assign