Istio JWT 鉴权与路径授权策略实践

---

title: Istio JWT 鉴权与路径授权策略实践

keywords: RequestAuthentication, AuthorizationPolicy, audiences, request.auth.claims,

paths

description: 通过 RequestAuthentication 验证 JWT，并用 AuthorizationPolicy 限制特定受众与路径访问，提升零信任安全。

categories:

• 文章资讯
• 技术教程

---

JWT 验证（受众限制）：

apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: api-jwt
  namespace: default
spec:
  selector:
    matchLabels:
      app: api
  jwtRules:
  - issuer: https://issuer.example.com/
    audiences:
      - my-audience
    jwksUri: https://issuer.example.com/.well-known/jwks.json

路径授权（仅允许携带合法 JWT 的访问）：

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: api-allow-jwt
  namespace: default
spec:
  selector:
    matchLabels:
      app: api
  rules:
  - from:
    - source:
        requestPrincipals: ["*"]
    to:
    - operation:
        paths: ["/api/secure/*"]
    when:
    - key: request.auth.claims[aud]
      values: ["my-audience"]