Istio Authorization Policy未应用于Istio Gateway问题求助

我在GKE中配置了带静态区域IP的Gateway，使用Kubernetes Gateway API，但AuthorizationPolicy始终未生效。相关配置如下：

Gateway配置 #

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: my-gateway
  namespace: istio-ingress
spec:
  gatewayClassName: istio
  listeners:
    - name: http
      port: 80
      protocol: HTTP
      allowedRoutes:
        namespaces:
          from: All
  addresses:
    - value: "x.x.x.x"
      type: IPAddress

Service配置 #

apiVersion: v1
kind: Service
metadata:
  name: my-gateway-istio
  namespace: istio-ingress
  labels:
    gateway.istio.io/managed: istio.io-gateway-controller
spec:
  externalTrafficPolicy: Local
  ports:
    - appProtocol: tcp
      name: status-port
      port: 15021
      protocol: TCP
      targetPort: 15021
    - appProtocol: http
      name: http
      port: 80
      protocol: TCP
      targetPort: 80
  selector:
    istio.io/gateway-name: my-gateway
  type: LoadBalancer

HTTPRoute配置 #

apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: my-gateway-http-route
spec:
  parentRefs:
    - name:  my-gateway
      namespace: istio-ingress
  rules:
    - matches:
        - path:
            type: Exact
            value: "/test"
      backendRefs:
        - name: my-service
          port: 8080

AuthorizationPolicy配置 #

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: my-gateway-authorization-policy
  namespace: istio-ingress
spec:
  selector:
    matchLabels:
      istio.io/gateway-name: my-gateway
  action: ALLOW
  rules:
    - from:
        - source:
            ipBlocks:
              - x.x.x.x # Test IP

已尝试的操作 #

• 修改配置并重新部署
• 调整Istio Pod日志级别为debug排查：

  kubectl patch deployment my-gateway -n istio-ingress -p'{"spec":{"template":{"spec":{"containers":[{"name":"istio-proxy","args":["proxy", "sidecar", "--proxyLogLevel=debug"]}]}}}}'
  

排查建议 #

1. 验证策略选择器匹配
   确认Gateway Pod的labels包含istio.io/gateway-name: my-gateway，执行命令检查：

   kubectl get pods -n istio-ingress -l istio.io/gateway-name=my-gateway --show-labels
   

   若labels不匹配，策略无法绑定到目标Pod。

2. 完善AuthorizationPolicy规则
   当前策略仅限定了来源IP，未指定允许访问的端口和路径，可能导致逻辑不严谨。补充规则示例：

   apiVersion: security.istio.io/v1beta1
   kind: AuthorizationPolicy
   metadata:
     name: my-gateway-authorization-policy
     namespace: istio-ingress
   spec:
     selector:
       matchLabels:
         istio.io/gateway-name: my-gateway
     action: ALLOW
     rules:
       - from:
           - source:
               ipBlocks:
                 - x.x.x.x # Test IP
         to:
           - operation:
               ports: ["80"]
               paths: ["/test"]
   

3. 检查Istio与Gateway API兼容性
   确认Istio版本支持Gateway API v1beta1，执行命令查看版本：

   istioctl version
   

   旧版本可能存在兼容性问题，需升级至支持该API版本的Istio。

4. 确认客户端真实IP传递
   由于Service设置了externalTrafficPolicy: Local，需验证GKE是否正确传递客户端真实IP。查看Istio访问日志：

   kubectl logs -n istio-ingress -l istio.io/gateway-name=my-gateway -c istio-proxy | grep "x.x.x.x"
   

   若日志中显示集群内部IP而非客户端真实IP，IP白名单会失效，需检查GKE LoadBalancer配置是否启用客户端IP保留。

5. 排查策略优先级冲突
   检查是否存在其他AuthorizationPolicy（如DENY策略）覆盖当前规则，执行命令查看所有策略：

   kubectl get authorizationpolicy -n istio-ingress
   

   可通过priority字段调整策略优先级，数值越高优先级越高。

内容的提问来源于stack exchange，提问作者Bruno Macedo