"Istio 授权策略与 mTLS：AuthorizationPolicy 与 PeerAuthentication"

Istio 授权策略与 mTLS：AuthorizationPolicy 与 PeerAuthentication强制 mTLSapiVersion: security.istio.io/v1beta1 kind: PeerAuthentication metadata: name: default namespace: default spec: mtls: mode: STRICT 授权策略apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: web-allow namespace: default spec: selector: matchLabels: app: web rules: - from: - source: principals: [ "cluster.local/ns/default/sa/api" ] to: - operation: paths: [ "/api/" ] methods: [ "GET", "POST" ] 总结结合 mTLS 与基于主体的授权策略，可实现细粒度的服务访问控制。