Thola isitholi se-Istio JWKS ngaphambi kokusetha i-proxy yayo
Hlola imodi yokuthola ye-Istio 1.31, bese usetha umzila we-Go HTTP we-istiod noma uhlole ukuthuthwa kokhiye okukude kwe-Envoy.
RequestAuthentication.jwksUri ayikhombisi uhlelo njengomlandi. I-Istio 1.31 ibhala lezi zimo ze-PILOT_JWT_ENABLE_REMOTE_JWKS:
| Inani | Isitholi |
|---|---|
| istiod / false | istiod |
| hybrid / true | Envoy enokubuyela ku-istiod kumaseva angaphandle |
| envoy | Envoy |
Hlola inguqulo esetshenzisiwe kanye nemvelo yangempela yekhonsoli yokulawula ngaphambi kokukhetha igatsha.
umzila we-istiod
Isixazululi sakhe sokhiye sisebenzisa ukutholwa kwe-proxy kwemvelo ye-Go. Nge-Helm chart ye-istiod, hlanganisa amanani afana nale:
env:
HTTPS_PROXY: http://proxy.example:8080
NO_PROXY: localhost,127.0.0.1,.svc,.cluster.local,10.96.0.1Lokhu kucezu lwamanani e-chart, akuwona umthombo. Sebenzisa ikheli langempela lesevisi yeqembu, isijobelelo se-DNS kanye nezindlela zangaphakathi, bese usebenzisa ukusatshalaliswa okulawulwayo. Izinguqulo zohlelo noma i-ServiceEntry azikwazi ukunikeza imvelo ye-pod enye. Uma ama-URL e-JWKS esesidlangalaleni futhi ukuphuma nge-proxy yomphakathi kuvunyelwe, uhlu lwe-proxy ye-HTTP kunikeza abangeneleli benani le-HTTPS_PROXY le-istiod; gcina izindlela zangaphakathi zeqembu.
umzila we-Envoy
Hlola iqembu le-JWKS elikude nomzila wenethiwekhi. Ukubhalisa indawo ekuyiwa kuyo ku-mesh akukwengezi ngokwako ukugxuma kwe-CONNECT kwenkampani; izinguqulo ze-istiod azikwazi ukumisa ukuthuthwa kwe-Envoy.