基于Istio在GKE上实现JWT认证的问题排查与优化

1. 调整RequestAuthentication，仅对非Internal主机生效 #

修改原有的RequestAuthentication资源，添加match条件过滤请求，只对非internal-*开头的Host应用JWT校验和Header输出逻辑，避免内部请求触发JWT规则导致Header被覆盖。

apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: req-auth-jwt-required
  namespace: istio-testing-ns
spec:
  selector:
    matchLabels:
      app: istio-testing-service
  # 仅对非internal开头的Host请求应用JWT规则
  match:
    operation:
      notHosts: ["internal-*"]
  jwtRules:
    - issuer: "https://abc.us.com/"
      jwksUri: https://abc.us.com/.well-known/jwks.json
      outputClaimToHeaders:
        - header: X-MemberId
          claim: x-member-id

2. 拆分AuthorizationPolicy，明确放行Internal请求 #

将原有的单条DENY规则拆分为两条独立的AuthorizationPolicy，优先放行所有Internal主机的请求，避免DENY规则误拦截内部通信：

# 优先放行所有Internal主机的请求
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: req-auth-policy-allow-internal
  namespace: istio-testing-ns
spec:
  selector:
    matchLabels:
      app: istio-testing-service
  action: ALLOW
  rules:
    - to:
        - operation:
            hosts: ["internal-*"]
---
# 保留原有的DENY规则，仅针对非Internal和非Actuator的外部请求
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: req-auth-policy-deny-unauthenticated
  namespace: istio-testing-ns
spec:
  selector:
    matchLabels:
      app: istio-testing-service
  action: DENY
  rules:
    - from:
        - source:
            notRequestPrincipals: ["*"]
      to:
        - operation:
            notPaths: ["/istio-test/service/v1/actuator*"]
            notHosts: ["internal-*"]
            methods: ["GET"]
    - to:
        - operation:
            paths: ["/istio-test/service/v1/categories*"]
            notHosts: ["internal-*"]
            methods: ["GET", "POST"]
      when:
        - key: request.auth.claims[x-permissions]
          notValues: ["categories-lookup"]

3. 额外优化建议 #

• 验证Header传递逻辑：测试内部服务调用时，自定义的X-MemberId Header会原样传递到后端，不会被Istio Sidecar修改。
• 拆分权限规则：将不同业务的权限控制拆分为独立的AuthorizationPolicy资源，便于后续维护和问题排查。
• 覆盖边界测试场景：
  • 外部请求不带JWT，访问非Actuator端点会被拒绝
  • 外部请求携带合法JWT，X-MemberId Header会被正确注入
  • 内部请求不带JWT，可正常访问所有端点，自定义Header不被覆盖
  • 外部请求访问categories端点但无对应权限，会被拒绝

内容的提问来源于stack exchange，提问作者RookieDev