kubernetes - Kubernetes Istio 配置与 Keycloak 用于 JWT 令牌验证

Question

我有以下架构：
一个 minikube 集群，我可以在其中使用 Keycloak 检索有效的 JWT 令牌进行登录。
我的下一步是使用 keycloak 配置 Istio，以便在访问我的微服务 API 之前验证令牌。
Keycloak 安装到集群中。这是我正在使用的 yaml：

apiVersion: "security.istio.io/v1beta1"
kind: "RequestAuthentication"
metadata:
  name: "myapp-jwt"
  namespace: istio-system
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  jwtRules:
  - issuer: "http://auth.xxxxxxxx.com/auth/realms/xxxxxxxx"
    jwksUri: "http://keycloak.auth.svc.cluster.local/auth/realms/xxxxxxxx/protocol/openid-connect/certs"

我得到Jwks 没有匹配来自 Jwt 的 child 或 alg 的密钥

这些是我的另一个 yaml：

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: myapp-gateway
spec:
  selector:
    istio: ingressgateway # use Istio default gateway implementation
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "myapp.xxxxxxxx.com"
    - "auth.xxxxxxxx.com"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: myapp
spec:
  hosts:
    - "myapp.xxxxxxxx.com"
  gateways:
    - myapp-gateway
  http:
    - match:
        - uri:
            prefix: /actions
      route:
        - destination:
            host: action-api-service.default.svc.cluster.local
            port:
              number: 3000
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: myapp-auth
  namespace: auth
spec:
  hosts:
    - "auth.xxxxxxxx.com"
  gateways:
    - default/myapp-gateway
  http:
    - match:
        - uri:
            prefix: /
      route:
        - destination:
            host: keycloak.auth.svc.cluster.local
            port:
              number: 8080

标签： kubernetesmicroserviceskeycloakistio