istio에 jwt 검증 proxy 추가하기

curl -L https://istio.io/downloadIstio | sh -
cd istio-*
export PATH=$PWD/bin:$PATH

istioctl install --set profile=demo -y

kubectl get pods -n istio-system

NAME                                    READY   STATUS    RESTARTS   AGE
istio-ingressgateway-6fdd76d6d7-mz9ps   1/1     Running   0          2m
istiod-8454df4fbb-7z8xz                 1/1     Running   0          2m

apiVersion: security.istio.io/v1
kind: RequestAuthentication
metadata:
  name: httpbin
  namespace: foo
spec:
  selector:
    matchLabels:
      app: httpbin
  jwtRules:
    - issuer: "https://your-issuer.com"
      jwksUri: https://example.com/.well-known/jwks.json
      forwardOriginalToken: true

apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: jwt-authz-policy
  namespace: my-namespace
spec:
  selector:
    matchLabels:
      app: my-app
  rules:
    - from:
        - source:
            requestPrincipals: ["*"]
      to:
        - operation:
            methods: ["GET", "POST"]

apiVersion: apps/v1
kind: Deployment
metadata:
  name: example-app
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: example-app
  template:
    metadata:
      labels:
        app: example-app
      annotations:
        sidecar.istio.io/inject: "false" # 사이드카 주입 비활성화
    spec:
      containers:
        - name: example-app
          image: example-app:latest

{
  "kty": "RSA",
  "use": "sig",
  "kid": "12345",
  "alg": "RS256",
  "n": "0vx7agoebGcQSuuPiLJXZptN29WJna...",
  "e": "AQAB"
}

{
  "keys": [
    {
      "kty": "RSA",
      "use": "sig",
      "kid": "12345",
      "alg": "RS256",
      "n": "0vx7agoebGcQSuuPiLJXZptN29WJna...",
      "e": "AQAB"
    },
    {
      "kty": "EC",
      "use": "sig",
      "kid": "67890",
      "alg": "ES256",
      "crv": "P-256",
      "x": "f83OJ3D2xF4F2JfSJwsFrLWLOHkXtw...",
      "y": "x_FEzRu9VVjX9JHgBVMwD1tE44D07..."
    }
  ]
}

apiVersion: security.istio.io/v1
kind: RequestAuthentication
metadata:
  name: httpbin
  namespace: foo
spec:
  selector:
    matchLabels:
      app: httpbin
  jwtRules:
    - issuer: "https://your-issuer.com"
      jwksUri: https://example.com/.well-known/jwks.json

apiVersion: security.istio.io/v1
kind: RequestAuthentication
metadata:
  name: httpbin
  namespace: foo
spec:
  selector:
    matchLabels:
      app: httpbin
  jwtRules:
    - issuer: "https://your-issuer.com"
      jwksUri: https://example.com/api/jwks

NAME                                    READY   STATUS    RESTARTS   AGE
istio-egressgateway-568ccc69d8-ccftb    1/1     Running   0          43d
istio-ingressgateway-64fc6d787b-5lxjm   1/1     Running   0          43d
istiod-cdfc8b464-gwbxd                  1/1     Running   0          43d

apiVersion: security.istio.io/v1
kind: RequestAuthentication
metadata:
  name: httpbin
  namespace: foo
spec:
  selector:
    matchLabels:
      app: httpbin
  jwtRules:
    - issuer: "https://your-issuer.com"
      jwksUri: https://example.com/.well-known/jwks.json
      fromHeaders:
        - name: "X-Custom-Authorization"  # JWT가 담긴 헤더 이름
          valuePrefix: "Bearer "          # JWT 토큰의 접두사 (필요 없으면 생략 가능)

apiVersion: security.istio.io/v1
kind: RequestAuthentication
metadata:
  name: query-param-jwt
  namespace: foo
spec:
  selector:
    matchLabels:
      app: httpbin
  jwtRules:
    - issuer: "https://your-issuer.com"
      jwksUri: "https://your-issuer.com/.well-known/jwks.json"
      fromParams:
        - "access_token"  # JWT가 담긴 쿼리 파라미터 이름

apiVersion: security.istio.io/v1
kind: RequestAuthentication
metadata:
  name: httpbin
  namespace: foo
spec:
  selector:
    matchLabels:
      app: httpbin
  jwtRules:
    - issuer: "https://your-issuer.com"
      jwksUri: https://example.com/.well-known/jwks.json
      forwardOriginalToken: true