istioctl AuthorizationPolicy 允许/拒绝以相反的方式工作

Question

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: deny-transactions-authorizationpolicy
  namespace: default
spec:
  selector:
    matchLabels:
      app: transactions
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/default/checking-account"]
    to:
    - operation:
       methods: ["GET"]
       paths: ["/*"]

它拒绝支票账户访问交易工作量。

如果我将操作更改为拒绝。它允许支票账户访问交易工作量。

谁能帮我为什么允许是拒绝而拒绝是允许？

Answer 1

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: deny-transactions-authorizationpolicy
  namespace: default
spec:
  selector:
    matchLabels:
      app: transactions
  action: DENY
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/default/checking-account"]
  - to:
    - operation:
       methods: ["GET"]
       paths: ["/*"]

我需要把 - 放在 前面：

这解决了问题。