Istio JWT 鉴权与路径授权策略实践

--- title: Istio JWT 鉴权与路径授权策略实践 keywords: RequestAuthentication, AuthorizationPolicy, audiences, request.auth.claims, paths description: 通过 RequestAuthentication 验证 JWT，并用 AuthorizationPolicy 限制特定受众与路径访问，提升零信任安全。 categories: - 文章资讯 - 技术教程 --- JWT 验证（受众限制）： ``` apiVersion: security.istio.io/v1beta1 kind: RequestAuthentication metadata: name: api-jwt namespace: default spec: selector: matchLabels: app: api jwtRules: - issuer: https://issuer.example.com/ audiences: - my-audience jwksUri: https://issuer.example.com/.well-known/jwks.json ``` 路径授权（仅允许携带合法 JWT 的访问）： ``` apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: api-allow-jwt namespace: default spec: selector: matchLabels: app: api rules: - from: - source: requestPrincipals: ["*"] to: - operation: paths: ["/api/secure/*"] when: - key: request.auth.claims[aud] values: ["my-audience"] ```