遵循 Istio 1.5 安全性时的授权策略问题答案

【问题标题】：Authorization Policy Issue when followed Istio 1.5 Security遵循 Istio 1.5 安全性时的授权策略问题
【发布时间】：2020-03-31 22:38:29
【问题描述】：

我试图按照 Istio 1.5 Security 设置授权策略，

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: require-jwt
  namespace: foo
spec:
  selector:
    matchLabels:
      app: httpbin 
  action: ALLOW
  rules:
  - from:
    - source:
       requestPrincipals: ["testing@secure.istio.io/testing@secure.istio.io"]

但是当我为我的服务应用此政策时，我会收到“RBAC：访问被拒绝”

请在下面找到特使代理日志，

[Envoy (Epoch 0)] [2020-03-27 14:40:31.225][24][debug][rbac] [external/envoy/source/extensions/filters/http/rbac/rbac_filter.cc:68] checking request: remoteAddress: 10.1.0.65:57780, localAddress: 10.1.0.64:9080, ssl: uriSanPeerCertificate: spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account, subjectPeerCertificate: , 

headers: ‘:authority’, ‘localhost’
    ‘:path’, ‘/productpage’
    ‘:method’, ‘GET’
    ‘content-type’, ‘application/json’
    **‘authorization’, ‘Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IkRIRmJwb0lVcXJZOHQyenBBMnFYZkNtcjVWTzVaRXI0UnpIVV8tZW52dlEiLCJ0eXAiOiJKV1QifQ.eyJleHAiOjM1MzczOTExMDQsImdyb3VwcyI6WyJncm91cDEiLCJncm91cDIiXSwiaWF0IjoxNTM3MzkxMTA0LCJpc3MiOiJ0ZXN0aW5nQHNlY3VyZS5pc3Rpby5pbyIsInNjb3BlIjpbInNjb3BlMSIsInNjb3BlMiJdLCJzdWIiOiJ0ZXN0aW5nQHNlY3VyZS5pc3Rpby5pbyJ9.EdJnEZSH6X8hcyEii7c8H5lnhgjB5dwo07M5oheC8Xz8mOllyg–AHCFWHybM48reunF–oGaG6IXVngCEpVF0_P5DwsUoBgpPmK1JOaKN6_pe9sh0ZwTtdgK_RP01PuI7kUdbOTlkuUi2AO-qUyOm7Art2POzo36DLQlUXv8Ad7NBOqfQaKjE9ndaPWT7aexUsBHxmgiGbz1SyLH879f7uHYPbPKlpHU6P9S-DaKnGLaEchnoKnov7ajhrEhGXAQRukhDPKUHO9L30oPIr5IJllEQfHYtt6IZvlNUGeLUcif3wpry1R5tBXRicx2sXMQ7LyuDremDbcNy_iE76Upg’**
    ‘user-agent’, ‘PostmanRuntime/7.22.0’
    ‘accept’, ‘/’
    ‘cache-control’, ‘no-cache’
    ‘postman-token’, ‘f06a794e-1bd7-4c03-ad78-1638a309b71a’
    ‘accept-encoding’, ‘gzip, deflate, br’
    ‘content-length’, ‘4868’
    ‘x-forwarded-for’, ‘192.168.65.3’
    ‘x-forwarded-proto’, ‘http’
    ‘x-request-id’, ‘012804b1-67ca-942d-9636-40478e932e75’
    ‘x-b3-traceid’, ‘f8f9e4f94847aec5ce7dec347a5bfa5d’
    ‘x-b3-spanid’, ‘ce7dec347a5bfa5d’
    ‘x-b3-sampled’, ‘1’
    ‘x-envoy-internal’, ‘true’
    ‘x-forwarded-client-cert’, ‘By=spiffe://cluster.local/ns/default/sa/bookinfo-productpage;Hash=5e82efecebbaf212aae6359cec7cbc0b6aa281ddeaf3e7adb280c503a5c04a5f;Subject="";URI=spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account’
    , dynamicMetadata: filter_metadata {
    key: “istio_authn”
    value {
    fields {
    key: “request.auth.principal”
    value {
    string_value: “cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account”
    }
    }
    fields {
    key: “source.namespace”
    value {
    string_value: “istio-system”
    }
    }
    fields {
    key: “source.principal”
    value {
    string_value: “cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account”
    }
    }
    fields {
    key: “source.user”
    value {
    string_value: “cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account”
    }
    }
    }
    }

**[Envoy (Epoch 0)] [2020-03-27 14:40:31.225][24][debug][rbac] [external/envoy/source/extensions/filters/http/rbac/rbac_filter.cc:111] enforced denied**
[2020-03-27T14:40:31.224Z] “GET /productpage HTTP/1.1” 403 - “-” “-” 0 19 1 - “192.168.65.3” “PostmanRuntime/7.22.0” “012804b1-67ca-942d-9636-40478e932e75” “localhost” “-” - - 10.1.0.64:9080 192.168.65.3:0 outbound_.9080_._.productpage.default.svc.cluster.local -

请帮我解决这个问题。提前致谢

【问题讨论】：

检查请求主体是否与您的列表匹配。从你的日志中它说它的cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account 被拒绝了。
请求主体正确（令牌已在日志中）。这就是我感到惊讶的原因。
您好，问题解决了吗？如果是，请您分享解决方案。我也面临同样的问题。

标签： authorization istio

【解决方案1】：

尝试将 istio 更新为 v 1.5.1。

根据istio 文档，修复了一个影响您正在使用的身份验证策略security.istio.io/v1beta1 的错误：

已修复 OpenID 发现不适用于 beta 请求身份验证策略 (Issue 21954)

要执行 istio 升级，请查看 istio upgrade 文档页面。

希望对你有帮助。

【讨论】：