JWT Claim based routing with OpenShift ServiceMesh not working - openshift

Question

I'm trying to perform some basic JWT claim based routing leveraging OpenShift Service Mesh. OpenShift version is 4.6.23. RedHat OpenShift Service Mesh version is 2.1.1-0.
Below is the ServiceMeshControlPlane resource I use to setup ServiceMesh on the OCP cluster :
apiVersion: maistra.io/v2
kind: ServiceMeshControlPlane
metadata:
name: basic
namespace: istio-system
spec:
version: v2.0
tracing:
type: Jaeger
sampling: 10000
addons:
jaeger:
name: jaeger
install:
storage:
type: Memory
kiali:
enabled: true
name: kiali
grafana:
enabled: true
Basically, I tried to follow this Istio documentation page to test the JWT claim routing
Here is the structure of the JWT token I'm using :
{
"iss": "https://eu-de.appid.cloud.ibm.com/oauth/v4/6f631e4d-7ecc-4a1c-8cf8-ea2d0a5c32e6",
"exp": 1646244105,
"aud": [
"f7f1e8bf-72d0-4e7d-90ff-cb76a8079c46"
],
"sub": "99bb916e-8f99-4e0a-8b1f-72c2171448d1",
"email_verified": true,
"amr": [
"cloud_directory"
],
"iat": 1646240505,
"tenant": "6f631e4d-7ecc-4a1c-8cf8-ea2d0a5c32e6",
"scope": "openid appid_default appid_readuserattr appid_readprofile appid_writeuserattr appid_authenticated",
"roles": [
"teamA"
]
}
The RequestAuthentication definition :
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
name: jwt-auth
namespace: sample-mesh
spec:
jwtRules:
- issuer: "https://eu-de.appid.cloud.ibm.com/oauth/v4/6f631e4d-7ecc-4a1c-8cf8-ea2d0a5c32e6"
jwksUri: "https://eu-de.appid.cloud.ibm.com/oauth/v4/6f631e4d-7ecc-4a1c-8cf8-ea2d0a5c32e6/publickeys"
And the definition of the VirtualService that is supposed to handle the routing :
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: catalog
spec:
hosts:
- '*'
gateways:
- sample-mesh-gateway
http:
- match:
- headers:
"#request.auth.claims.roles":
exact: teamA
route:
- destination:
host: catalog
subset: version-v1
- route:
- destination:
host: catalog
subset: version-v2
I would then expect the trafic to be routed to the catalog v1 when the roles claim contains the value teamA. But in practice, I observe that the trafic is always routed to catalog v2 even if the token has the required value in the claim.
Is there anything I missed in the configuration ?
Thanks :-)