如何在envoyproxy中配置公共访问web api？

Question

我是envoyproxy的新手，在不提供Authorization标头的情况下尝试访问终结点时，我收到'jwt is missing‘错误。如何访问没有auth头部的公共接口，即http://hostaddress/v1/fares/locations/location?searchTerm=ABC

下面的代码显示了已经添加的使用Jwt身份验证的现有集群。

 http_filters:
              - name: envoy.filters.http.grpc_http1_bridge
                typed_config: {}
              - name: envoy.filters.http.cors
                typed_config: {}
              - name: envoy.filters.http.jwt_authn
                typed_config:
                  "@type": type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication
                  providers:
                    identity_api:
                      issuer: 'null'
                      audiences:
                      - apigw
                      forward: true
                      remote_jwks:
                        http_uri:
                          uri: http://abc.identity.api/.well-known/openid-configuration/jwks
                          cluster: identity_api
                          timeout: 1s   
                        cache_duration:
                          seconds: 30
                      from_headers:
                      - name: Authorization
                        value_prefix: "Bearer "
                  rules:
                  - match: { prefix: /v1/newhubs/ }
                  - match: { prefix: / }
                    requires:
                      provider_name: identity_api
              - name: envoy.filters.http.ext_authz
                typed_config:
                  "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
                  transport_api_version: V3
                  grpc_service:
                    envoy_grpc:
                      cluster_name: permissions_api_grpc
                    timeout: 3s
                  with_request_body:
                    max_request_bytes: 819200
                    allow_partial_message: true
              - name: envoy.filters.http.router
                typed_config: {}

Answer 1

您的jwt_authn通过根路径match: { prefix: / }与所有路径进行匹配。

删除match: { prefix: / }条目以使您的jwt_authn筛选器仅与/v1/newhubs/匹配