Istio Operator 的 Istio 外部授权错误

Question

我们已经在开发和生产环境中使用 helm-chart 部署了 Istio 1.11.0。我们在 istio configmap 中使用以下配置，我们已通过 istio-control helm-chart 对其进行了更新。

meshConfig:
  extensionProviders:
  - name: "ext-authz-grpc"
    envoyExtAuthzGrpc:
      service: "ext-auth-service.default.svc.cluster.local"
      port: "50051"
      includeHeadersInCheck: [ "authorization", "ws-protocol" ]
      headersToUpstreamOnAllow: [ "authorization", "x-role", "x-id" ]
  accessLogFile: /dev/stdout
  enablePrometheusMerge: true

基本上我们使用 grpc 服务作为外部授权服务器。以上配置工作正常。我们的一位客户使用 operator 部署了 Istio 1.9.8。 (他们有自己的 Istio 部署模型。不允许我们使用 helm-chart 部署 istio)当我们尝试使用运算符应用上述更改时，它给我们以下错误:

2022-04-05T10:23:09.657830Z info installer Loading values from compiled in VFS at path profiles/minimal.yaml
2022-04-05T10:23:09.657837Z info installer Loading values from compiled in VFS at path profiles/default.yaml
2022-04-05T10:23:09.679340Z error installer failed to merge base profile with user IstioOperator CR profile-poc-customized, failed to unmarshall mesh config: unknown field "includeHeadersInCheck" in v1alpha1.MeshConfig_ExtensionProvider_EnvoyExternalAuthorizationGrpcProvider moreInfo=The values in the selected spec.profile could not be merged with the user IstioOperator resource. impact=The operator controller cannot create and act upon the user defined IstioOperator resource. The Istio control plane will not be installed or updated. action=Check that the IstioOperator resource has the correct syntax. If you are sure your configuration is correct, see https://istio.io/latest/about/bugs for possible solutions. likelyCause=The likely cause is an incorrect or badly formatted configuration.Another possible cause could be an issue with the Istio code.

如果我们直接编辑 configmap 并进行更改，那么它就能够应用这些更改。但是当我们从运算符(operator)更新它时它会出错。谁能帮我理解为什么它不能与运营商合作？

Answer 1

includeHeadersInCheck 只适用于 http 而不是 grpc: https://istio.io/v1.10/docs/reference/config/istio.mesh.v1alpha1/#MeshConfig-ExtensionProvider-EnvoyExternalAuthorizationGrpcProvider