Istio JWT 验证：RequestAuthentication 与 AuthorizationPolicy

--- title: Istio JWT 验证：RequestAuthentication 与 AuthorizationPolicy keywords: - JWT - RequestAuthentication - AuthorizationPolicy - JWK - 受众校验 description: 在 Istio 中通过 RequestAuthentication 验证 JWT 并结合 AuthorizationPolicy 基于受众与主体进行访问控制。 categories: - 文章资讯 - 编程技术 --- # Istio JWT 验证：RequestAuthentication 与 AuthorizationPolicy ```yaml apiVersion: security.istio.io/v1beta1 kind: RequestAuthentication metadata: name: jwt namespace: app spec: selector: matchLabels: app: api jwtRules: - issuer: https://auth.example.com/ jwksUri: https://auth.example.com/.well-known/jwks.json audiences: - api ``` ```yaml apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: allow-jwt namespace: app spec: selector: matchLabels: app: api rules: - from: - source: requestPrincipals: [ "*" ] to: - operation: paths: [ "/api/" ] methods: [ "GET", "POST" ] when: - key: request.auth.audiences values: [ "api" ] ``` ## 总结 JWT 验证与基于受众的策略结合，可实现细粒度且高效的服务访问控制。