Raadi soo-qaadaha JWKS ee Istio ka hor inta aadan dhigin proxy-ga
Hubi habka soo-qaadista Istio 1.31, kadib dhig marin Go HTTP ee istiod ama baadh gaadiidka furaha fog ee Envoy.
RequestAuthentication.jwksUri ma aqoonsado barnaamijka inuu yahay soo-dejiyaha. Istio 1.31 waxay diiwaangelisaa hababkan PILOT_JWT_ENABLE_REMOTE_JWKS:
| Qiimaha | Soo-qaade |
|---|---|
| istiod / false | istiod |
| hybrid / true | Envoy oo leh istiod dib-u-noqosho serverada dibadda |
| envoy | Envoy |
Baadh nuqulka la dhigay iyo deegaanka dhabta ah ee kontoroolka ka hor intaadan dooran laan.
marinka istiod
Xalliyaha furaha wuxuu isticmaalaa ogaanshaha proxy deegaanka Go. Chart-ka Helm ee istiod, isku dar qiimayaal sida:
env:
HTTPS_PROXY: http://proxy.example:8080
NO_PROXY: localhost,127.0.0.1,.svc,.cluster.local,10.96.0.1Kani waa qayb ka mid ah qiimayaasha chart-ka, ma aha kheyraad. Isticmaal cinwaanka adeegga dhabta ah ee kooxda, lifaaqa DNS iyo dhaafka gudaha, kadib ku dhaqan geli baahinta la maareeyo. Doorsoomayaasha barnaamijka ama ServiceEntry ma bixin karaan deegaanka pod kale. Haddii JWKS URLs yihiin kuwo dadweyne oo loo oggol yahay ka bixista proxy dadweyne, liiska proxy HTTP waxay bixisaa musharraxiin qiimaha HTTPS_PROXY ee istiod; hayso dhaafka gudaha ee kooxda.
marinka Envoy
Baadh kooxda JWKS fog iyo marinka shabakadda. Diiwaangelinta meesha loo socdo mesh lafteeda ma kordhiso bood CONNECT shirkadeed; doorsoomayaasha istiod ma qaabayn karaan gaadiidka Envoy.