---

title: Istio JWT 验证：RequestAuthentication 与 AuthorizationPolicy

keywords:

• JWT
• RequestAuthentication
• AuthorizationPolicy
• JWK
• 受众校验

description: 在 Istio 中通过 RequestAuthentication 验证 JWT 并结合 AuthorizationPolicy 基于受众与主体进行访问控制。

categories:

• 文章资讯
• 编程技术

---

Istio JWT 验证：RequestAuthentication 与 AuthorizationPolicy

apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: jwt
  namespace: app
spec:
  selector:
    matchLabels:
      app: api
  jwtRules:
    - issuer: https://auth.example.com/
      jwksUri: https://auth.example.com/.well-known/jwks.json
      audiences:
        - api

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-jwt
  namespace: app
spec:
  selector:
    matchLabels:
      app: api
  rules:
    - from:
        - source:
            requestPrincipals: [ "*" ]
      to:
        - operation:
            paths: [ "/api/" ]
            methods: [ "GET", "POST" ]
      when:
        - key: request.auth.audiences
          values: [ "api" ]

总结

JWT 验证与基于受众的策略结合，可实现细粒度且高效的服务访问控制。