Nemo mai ɗebo JWKS na Istio kafin saita proxy ɗinsa
Duba yanayin ɗebo na Istio 1.31, sannan saita hanyar HTTP ta Go na istiod ko duba jigilar maɓallan nesa ta Envoy.
RequestAuthentication.jwksUri ba ya nuna aikace-aikacen a matsayin mai saukewa. Istio 1.31 ya rubuta waɗannan yanayi na PILOT_JWT_ENABLE_REMOTE_JWKS:
| Daraja | Mai ɗebo |
|---|---|
| istiod / false | istiod |
| hybrid / true | Envoy tare da komawar istiod ga sabar waje |
| envoy | Envoy |
Duba sigar da aka tura da ainihin mahallin kulawa kafin zaɓar reshe.
hanyar istiod
Mai warware maɓallansa yana amfani da gano proxy na mahallin Go. Don ginshiƙin Helm na istiod, haɗa ƙima kamar:
env:
HTTPS_PROXY: http://proxy.example:8080
NO_PROXY: localhost,127.0.0.1,.svc,.cluster.local,10.96.0.1Wannan guntun ƙimar ginshiƙi ne, ba albarkatu ba. Yi amfani da ainihin adireshin sabis na gungu, ƙarin DNS da kewaye na ciki, sannan yi amfani da turawar da ake sarrafawa. Masu canjin aikace-aikace ko ServiceEntry ba za su iya samar da mahallin wani pod ba. Idan adiresoshin JWKS na jama'a ne kuma an yarda fitarwa ta proxy na jama'a, jerin proxy na HTTP yana ba da 'yan takara don ƙimar HTTPS_PROXY ta istiod; riƙe kewayen ciki na gungu.
hanyar Envoy
Duba gungun JWKS na nesa da hanyar cibiyar sadarwa. Yin rijistar manufa a cikin mesh ba ya ƙara tsallen CONNECT na kamfani da kansa; masu canjin istiod ba za su iya daidaita jigilar Envoy ba.