kubernetes - Istio (1.6.2) : DENY policy in Authorization Policy does not work with Valid Token

Question

我是 Istio 的新手。我正在使用 JWT 实现授权。有效的 JWT token 不会反射(reflect) DENY 操作。我添加了 JWT Payload and Authorization Policy 以供引用。
我正在使用 Kubernetes 版本 v1.18.3 和 Istio 1.6.2。我在 minikube 上运行集群。
我首先在 ingressgateway 上应用了以下规则:

apiVersion: "security.istio.io/v1beta1"
kind: "RequestAuthentication"
metadata:
  name: ingress-auth-jwt
  namespace: istio-system
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  jwtRules:
  - issuer: "https://dev-n63ipah2.us.auth0.com/"
    jwksUri: "https://dev-n63ipah2.us.auth0.com/.well-known/jwks.json"
    audiences: 
    - "http://10.97.72.213/"
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
 name: ingress-authz
 namespace: istio-system
spec:
 selector:
   matchLabels:
     istio: ingressgateway
 action: ALLOW
 rules:
  - when:
    - key: request.auth.claims[iss]
      values: ["https://dev-n63ipah2.us.auth0.com/"]

之后，我为 dex-ms-contact 服务申请了以下政策

JWT Payload:
{
  "iss": "https://dev-n63ipah2.us.auth0.com/",
  "sub": "sEbjHGBcZ16D0jk8wohIp7vPoT0MWTO0@clients",
  "aud": "http://10.97.72.213/",
  "iat": 1594274641,
  "exp": 1594361041,
  "azp": "sEbjHGBcZ16D0jk8wohIp7vPoT0MWTO0",
  "gty": "client-credentials"
}

RequestAuthentication:

apiVersion: "security.istio.io/v1beta1"
kind: "RequestAuthentication"
metadata:
  name: dex-ms-contact-jwt
  namespace: default
spec:
  selector:
    matchLabels:
      app: dex-ms-contact
  jwtRules:
  - issuer: "https://dev-n63ipah2.us.auth0.com/"
    jwksUri: "https://dev-n63ipah2.us.auth0.com/.well-known/jwks.json"
    audiences: 
    - "http://10.97.72.213/"
---
apiVersion: "security.istio.io/v1beta1"
kind: "AuthorizationPolicy"
metadata:
  name: dex-ms-contact-require-jwt
  namespace: default
spec:
  selector:
    matchLabels:
      app: dex-ms-contact
  action: DENY
  rules:
  - when:
    - key: request.auth.claims[iss]
      values: ["https://dev-n63ipah2.us.auth0.com/"]

ingressgateway 策略运行良好。但是，当我在 dex-ms-contact 服务上应用 DENY 策略时，DENY 策略不会反射(reflect)在有效的 JWT token 中。理想情况下，它不应该让我访问 dex-ms-contact 服务吗？
预期的行为是什么？

Answer 1

根据 istio documentation :

Istio Authorization Policy enables access control on workloads in the mesh.

Authorization policy supports both allow and deny policies. When allow and deny policies are used for a workload at the same time, the deny policies are evaluated first. The evaluation is determined by the following rules:

1. If there are any DENY policies that match the request, deny the request.
2. If there are no ALLOW policies for the workload, allow the request.
3. If any of the ALLOW policies match the request, allow the request.
4. Deny the request.

因此，考虑到首先评估拒绝策略。您的请求可能首先在工作负载策略上被拒绝，然后在网关策略上被允许，这导致完全覆盖拒绝规则。
考虑到策略的评估顺序更具体，在 ALLOW 策略中应该允许什么可能会使您的权限模型成为可能。
希望能帮助到你。

编辑:
根据 istio documentation :

WORKLOAD

A binary deployed by operators to deliver some function of a service mesh application. Workloads have names, namespaces, and unique ids. These properties are available in policy and telemetry configuration using the following attributes:

• source.workload.name, source.workload.namespace, source.workload.uid
• destination.workload.name, destination.workload.namespace, destination.workload.uid

In Kubernetes, a workload typically corresponds to a Kubernetes deployment, while a workload instance corresponds to an individual pod managed by the deployment.

抱歉回复晚了，我已经离开一段时间了。