Istio AuthorizationPolicy结合JWT出现403 RBAC权限拒绝问题求助

问题概述 #

使用Istio AuthorizationPolicy结合JWT时，GET请求（如/metrics、/health等）可正常访问，但携带有效JWT令牌的POST请求https://my-app.dev.company.com/test/generate返回403 RBAC: access denied错误。即使将AuthorizationPolicy中第一条规则的requestPrincipals设为*，问题仍未解决。查看istio-proxy日志，显示rbac_access_denied_matched_policy[none]，说明没有匹配到任何允许规则。

相关配置 #

AuthorizationPolicy #

apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: my-app
  namespace: dev
spec:
  action: ALLOW
  rules:
  - from:
    - source:
        requestPrincipals:
        - mlp/73-DEV-1692600995774
    to:
    - operation:
        methods:
        - POST
        paths:
        - /generate*
  - to:
    - operation:
        methods:
        - GET
        paths:
        - /metrics
        - /health
        - /info
  selector:
    matchLabels:
      app: my-app

JWT Payload #

{
  "sub": "73-DEV-1692600995774",
  "aud": "73-DEV",
  "nbf": 1692662400,
  "iss": "mlp",
  "exp": 1724284799,
  "iat": 1692724523,
  "jti": "1b893ac3-d49d-4e78-ab4f-b97a1a6255f2"
}

Gateway #

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: my-app
  namespace: dev
spec:
  selector:
    istio: ingressgateway
  servers:
  - hosts:
    - my-app.dev.company.com
    port:
      name: https
      number: 443
      protocol: HTTPS
    tls:
      credentialName: my-app
      mode: SIMPLE

Virtual Service #

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: my-app
  namespace: dev
spec:
  gateways:
  - my-app
  hosts:
  - '*'
  http:
  - match:
    - uri:
        prefix: /test/
    rewrite:
      uri: /
    route:
    - destination:
        host: my-app
        port:
          number: 8080

App Service #

apiVersion: v1
kind: Service
metadata:      
  labels:
    app: my-app
  name: my-app
  namespace: dev
spec:
  ports:
  - name: http
    port: 8080
    protocol: TCP
    targetPort: 8080
  selector:
    app: my-app
  type: ClusterIP

排查方向及解决方案 #

1. 缺失JWT认证配置（核心问题） #

Istio需要通过RequestAuthentication配置来解析、验证JWT，进而生成requestPrincipal。如果未配置该资源，AuthorizationPolicy中基于requestPrincipals的规则将永远无法匹配。

添加以下RequestAuthentication配置（替换实际的JWKS地址）：

apiVersion: security.istio.io/v1
kind: RequestAuthentication
metadata:
  name: jwt-auth
  namespace: dev
spec:
  selector:
    matchLabels:
      app: my-app # 若需在Ingress Gateway层面验证，可改为`istio: ingressgateway`
  jwtRules:
  - issuer: "mlp"
    jwksUri: "https://your-jwks-endpoint/.well-known/jwks.json"
    audiences:
    - "73-DEV"

2. AuthorizationPolicy作用范围验证 #

当前AuthorizationPolicy仅针对app: my-app的后端Pod，但请求可能在Ingress Gateway层面就被RBAC拦截。可尝试：

• 新增针对Ingress Gateway的AuthorizationPolicy，允许经过JWT验证的请求转发
• 或调整现有AuthorizationPolicy的selector为istio: ingressgateway，统一在网关层面做权限控制

3. 路径匹配校验 #

Virtual Service将/test/前缀重写为/，实际到达后端的路径是/generate，AuthorizationPolicy中的/generate*规则理论上可匹配，但可临时改为/*测试是否为路径匹配问题，逐步缩小范围排查。

4. 开启详细日志排查 #

将istio-proxy的日志级别调整为debug，查看RBAC匹配的详细过程：

kubectl exec -n dev <pod-name> -c istio-proxy -- curl -X POST http://localhost:15000/logging?rbac=debug

内容的提问来源于stack exchange，提问作者Pravin Gadakh