I'm trying to use istio for jwt verification. I have an app with label app=auth-verify running on port 3000, which has 1 endpoint /auth which will check the Authorization header. The main app has label app=backend expects the auth-verify app to verify jwt and add the header x-authenticated. Below is my CRD for the EnvoyFilter.

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: jwt-verification
  namespace: default
spec:
  workloadSelector:
    labels:
      app=backend
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_INBOUND
        listener:
          filterChain:
            filter:
              name: "envoy.filters.network.http_connection_manager"
              subFilter:
                name: "envoy.filters.http.router"
      patch:
        operation: INSERT_BEFORE
        filterClass: STATS
        value:
          name: envoy.filters.http.ext_authz
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
            http_service:
              server_uri:
                uri: http://auth-verify.default.svc.cluster.local:3000/auth
                cluster: outbound|3000||http://auth-verify
                timeout: 5s
            status_on_error:
              code: FailedDependency

When I check the logs on the backend pod, via kubectl logs --tail 1 -f backend-695cf5b89d-nkgps istio-proxy I can see this error.

debug	envoy config	ext_authz cluster 'outbound|3000||http://auth-verify' does not exist
debug	envoy http	[C9552][S4342964409469864253] Sending local reply with details ext_authz_error

How can I fix this?