实施 authpolicy 时在 virtualsvc 中重写不起作用 - Istio

Question

我正在按照https://github.com/istio/istio/issues/40579 中的一些说明使用带有 keycloak 的自定义 oauth2 提供程序来设置 Istio。

我有一个主要入口，它将一台主机上的所有流量发送到 istio-ingressgateway

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: istio-ingress-main
  namespace: istio-system
  spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - mlp.prod
      secretName: mlp-tls
  rules:
  - host: mlp.prod # A FQDN that describes the host where that rule should be applied
    http:
      paths:                            # A list of paths and handlers for that host
      - path: /
        pathType: Prefix
        backend:                      # How the ingress will handle the requests
          service:
            name: istio-ingressgateway # Which service the request will be forwarded to
            port:
              number: 80           # Which port in that service

我的入口网关定义如下

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: prod-gateway
  namespace : istio-system
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - 'mlp.prod'

我的一项服务是 mlflow，它安装在 mlflow 命名空间中，其虚拟服务定义如下

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: gateway-vs-mlflow
  namespace: mlflow
spec:
  hosts:
    - '*'
  gateways: 
    - istio-system/prod-gateway
  http:
    - match:
      - uri:
          prefix: "/mlflow"
      rewrite:
        uri: " "
      route:
      - destination:
          host: mlflow-service.mlflow.svc.cluster.local
          port:
            number: 5000

现在，当我尝试访问主机 mlp.prod/mlflow/ 时，我能够毫无问题地访问 MLFLOW 并且 UI 正确显示。

但是，如果我尝试在 authpolicy 中向 /mlflow 路由添加 oauth 提供程序，那么在完成 oauth 身份验证后我会得到 404 页面不可用

authpolicy 如下所示

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: oauth-policy
  namespace: istio-system
spec:
  selector:
    matchLabels:
      app: istio-ingressgateway
  action: CUSTOM
  provider:
    name: "oauth2-proxy"
  rules:
  - to:
    - operation:
        paths: ["/mlflow"]

请协助解决这个问题。虚拟服务中的重写是否应该仅在没有使用 oauth2-proxy 提供程序的 authpolicy 的情况下工作

请帮助

谢谢， 苏吉思。

Version
istioctl version
client version: 1.15.2
control plane version: 1.15.2
data plane version: 1.15.2 (8 proxies)

kubectl version --short
Flag --short has been deprecated, and will be removed in the future. The --short output will become the default.
Client Version: v1.24.2
Kustomize Version: v4.5.4
Server Version: v1.22.9
WARNING: version difference between client (1.24) and server (1.22) exceeds the supported minor version skew of +/-1

Answer 1

我可以通过使用以下新值设置 oauth 配置来解决此问题

上游=“静态：//200”

完成此操作后，oauth2 开始为经过身份验证的用户返回 200，一切都很好。