Istio：当我启用 JWT RequestAuthentication 时，健康检查/sidecar 失败

时间：2021-03-02 19:50:22

标签： istio kubernetes-health-check istio-sidecar

过时了：

我保留这篇文章以供进一步参考，但您可以在

中检查更好的诊断（尚未解决，但已解决）

Istio: RequestAuthentication jwksUri does not resolve internal services names

更新：

在 Istio 日志中，我们看到了下一个错误。 uaa 是一个 kubernetes pod，提供 OAUTH 认证/授权。它是通过普通服务以名称 uaa 访问的。我不知道为什么 istiod 找不到 uaa 主机名。我必须使用特定的名称吗？ （记住，标准服务可以完美地找到 uaa 主机）

2021-03-03T18:39:36.750311Z     error   model   Failed to fetch public key from "http://uaa:8090/uaa/token_keys": Get "http://uaa:8090/uaa/token_keys": dial tcp: lookup uaa on 10.96.0.10:53: no such host
2021-03-03T18:39:36.750364Z     error   Failed to fetch jwt public key from "http://uaa:8090/uaa/token_keys": Get "http://uaa:8090/uaa/token_keys": dial tcp: lookup uaa on 10.96.0.10:53: no such host
2021-03-03T18:39:36.753394Z     info    ads     LDS: PUSH for node:product-composite-5cbf8498c7-jd4n5.chp18 resources:29 size:134.3kB
2021-03-03T18:39:36.754623Z     info    ads     RDS: PUSH for node:product-composite-5cbf8498c7-jd4n5.chp18 resources:14 size:14.2kB
2021-03-03T18:39:36.790916Z     warn    ads     ADS:LDS: ACK ERROR sidecar~10.1.1.56~product-composite-5cbf8498c7-jd4n5.chp18~chp18.svc.cluster.local-10 Internal:Error adding/updating listener(s) virtualInbound: Provider 'origins-0' in jwt_authn config has invalid local jwks: Jwks RSA [n] or [e] field is missing or has a parse error

2021-03-03T18:39:55.618106Z     info    ads     ADS: "10.1.1.55:41162" sidecar~10.1.1.55~review-65b6886c89-bcv5f.chp18~chp18.svc.cluster.local-6 terminated rpc error: code = Canceled desc = context canceled

原始问题

在将 istio sidecar 注入标准 kubernetes pod 后，我有一个运行良好的服务。

我正在尝试添加 jwt 身份验证，为此，我正在遵循官方指南 Authorization with JWT

我的问题是

  • 如果我在注入 istio 依赖项后创建 JWT 资源（RequestAuthorization 和 AuthorizationPolicy），一切（似乎）都能正常工作
  • 但是，如果我创建 JWT 资源（RequestAuthorization 和 AuthorizationPolicy），然后注入 Istio，则 pod 不会启动。检查日志后，似乎 sidecar 无法工作（可能是检查健康状况？）

我的代码：

  1. JWT 资源
apiVersion: "security.istio.io/v1beta1"
kind: "RequestAuthentication"
metadata:
  name: "ra-product-composite"
spec:
  selector:
    matchLabels:
      app: "product-composite"
  jwtRules:
  - issuer: "http://uaa:8090/uaa/oauth/token"
    jwksUri: "http://uaa:8090/uaa/token_keys"
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: "ap-product-composite"
spec:
  selector:
    matchLabels:
      app: "product-composite"
  action: ALLOW
  # rules:
  # - from:
  #   - source:
  #      requestPrincipals: ["http://uaa:8090/uaa/oauth/token/faf5e647-74ab-42cc-acdb-13cc9c573d5d"]
  # b99ccf71-50ed-4714-a7fc-e85ebae4a8bb

2- 我使用目标规则如下

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: dr-product-composite
spec:
  host: product-composite
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL

3- 我的服务部署

apiVersion: apps/v1
kind: Deployment
metadata:
  name: product-composite
spec:
  replicas: 1
  selector:
    matchLabels:
      app: product-composite
  template:
    metadata:
      labels:
        app: product-composite
        version: latest
    spec:
      containers:
      - name: comp
        image: bthinking/product-composite-service
        imagePullPolicy: Never
        env:
          - name: SPRING_PROFILES_ACTIVE
            value: "docker"
          - name: SPRING_CONFIG_LOCATION
            value: file:/config-repo/application.yml,file:/config-repo/product-composite.yml
        envFrom:
          - secretRef:
              name: rabbitmq-client-secrets            
        ports:
        - containerPort: 80
        resources:
          limits:
            memory: 350Mi
        livenessProbe:
          httpGet:
            scheme: HTTP
            path: /actuator/info
            port: 4004
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 2
          failureThreshold: 20
          successThreshold: 1
        readinessProbe:
          httpGet:
            scheme: HTTP
            path: /actuator/health
            port: 4004
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 2
          failureThreshold: 3
          successThreshold: 1
        volumeMounts:
        - name: config-repo-volume
          mountPath: /config-repo
      volumes:
      - name: config-repo-volume
        configMap:
          name: config-repo-product-composite
---
apiVersion: v1
kind: Service
metadata:
  name: product-composite
spec:
  selector:
    app: "product-composite"
  ports:
    - port: 80
      name: http
      targetPort: 80
    - port: 4004
      name: http-mgm
      targetPort: 4004

4- pod 中的错误日志（组合服务和 sidecar）

2021-03-02 19:34:41.315 DEBUG 1 --- [undedElastic-12] o.s.s.w.s.a.AuthorizationWebFilter       : Authorization successful
2021-03-02 19:34:41.315 DEBUG 1 --- [undedElastic-12] .b.a.e.w.r.WebFluxEndpointHandlerMapping : [0e009bf1-133] Mapped to org.springframework.boot.actuate.endpoint.web.reactive.AbstractWebFluxEndpointHandlerMapping$ReadOperationHandler@e13aa23
2021-03-02 19:34:41.316 DEBUG 1 --- [undedElastic-12] ebSessionServerSecurityContextRepository : No SecurityContext found in WebSession: 'org.springframework.web.server.session.InMemoryWebSessionStore$InMemoryWebSession@48e89a58'
2021-03-02 19:34:41.319 DEBUG 1 --- [undedElastic-15] .s.w.r.r.m.a.ResponseEntityResultHandler : [0e009bf1-133] Using 'application/vnd.spring-boot.actuator.v3+json' given [*/*] and supported [application/vnd.spring-boot.actuator.v3+json, application/vnd.spring-boot.actuator.v2+json, application/json]
2021-03-02 19:34:41.320 DEBUG 1 --- [undedElastic-15] .s.w.r.r.m.a.ResponseEntityResultHandler : [0e009bf1-133] 0..1 [java.util.Collections$UnmodifiableMap<?, ?>]
2021-03-02 19:34:41.321 DEBUG 1 --- [undedElastic-15] o.s.http.codec.json.Jackson2JsonEncoder  : [0e009bf1-133] Encoding [{}]
2021-03-02 19:34:41.326 DEBUG 1 --- [or-http-epoll-3] r.n.http.server.HttpServerOperations     : [id: 0x0e009bf1, L:/127.0.0.1:4004 - R:/127.0.0.1:57138] Detected non persistent http connection, preparing to close
2021-03-02 19:34:41.327 DEBUG 1 --- [or-http-epoll-3] o.s.w.s.adapter.HttpWebHandlerAdapter    : [0e009bf1-133] Completed 200 OK
2021-03-02 19:34:41.327 DEBUG 1 --- [or-http-epoll-3] r.n.http.server.HttpServerOperations     : [id: 0x0e009bf1, L:/127.0.0.1:4004 - R:/127.0.0.1:57138] Last HTTP response frame
2021-03-02 19:34:41.328 DEBUG 1 --- [or-http-epoll-3] r.n.http.server.HttpServerOperations     : [id: 0x0e009bf1, L:/127.0.0.1:4004 - R:/127.0.0.1:57138] Last HTTP packet was sent, terminating the channel
2021-03-02T19:34:41.871551Z     warn    Envoy proxy is NOT ready: config not received from Pilot (is Pilot running?): cds updates: 1 successful, 0 rejected; lds updates: 0 successful, 1 rejected

5- Istio 注入

kubectl get deployment product-composite  -o yaml | istioctl kube-inject -f - | kubectl apply -f -

注意：我在 SO 中检查了很多帖子，似乎健康检查对 sidecar 和其他配置产生了很多问题。我检查了指南 Health Checking of Istio Services 没有成功。具体来说，我试图禁用 sidecar.istio.io/rewriteAppHTTPProbers: "false"，但情况更糟（在这种情况下，既不启动 sidecar，也不启动服务。

0 个答案:

没有答案
相关问题
最新问题