如何修复Istio AuthorizationPolicy以匹配x-forwarded-client-cert中的CN值？

现有配置与场景 #

你的Istio AuthorizationPolicy现有配置：

kind: AuthorizationPolicy
apiVersion: security.istio.io/v1
metadata:
  name: my-policy
  namespace: my-ns
spec:
  action: ALLOW
  rules:
    - to:
        - operation:
            paths:
              - /*
      when:
        - key: 'request.headers[x-forwarded-client-cert]'
          values:
            - *Source Sender*
  selector:
    matchLabels:
      app: my-api

你的x-forwarded-client-cert头格式为：

Headers: {host=test.com, accept=text/plain, application/json, application/*+json, */*, content-type=application/json, x-forwarded-client-cert=Hash=xyz;Subject="CN=Source Sender,L=Source Sender,OU=123,OU=Dev,OU=Test,O=Test,C=IN";URI=,x-num=1}

修改后的授权策略 #

要精准匹配该头中Subject字段内的CN=Source Sender值，需利用Istio支持的RE2正则表达式修改when条件：

kind: AuthorizationPolicy
apiVersion: security.istio.io/v1
metadata:
  name: my-policy
  namespace: my-ns
spec:
  action: ALLOW
  rules:
    - to:
        - operation:
            paths:
              - /*
      when:
        - key: 'request.headers[x-forwarded-client-cert]'
          values:
            - '.*Subject="CN=Source Sender.*"'
  selector:
    matchLabels:
      app: my-api

核心说明 #

• Istio AuthorizationPolicy的when条件默认支持RE2正则语法，无需额外配置
• 正则.*Subject="CN=Source Sender.*"会匹配所有包含目标CN值的x-forwarded-client-cert头内容，确保仅放行符合要求的请求
• 若需匹配多个CN值，可在values数组中添加对应正则条目，例如：

  values:
    - '.*Subject="CN=Source Sender.*"'
    - '.*Subject="CN=Backup Sender.*"'
  

内容的提问来源于stack exchange，提问作者pep8