如何在istio kubernetes集群中拒绝默认但允许HTTP和TCP流量？

我有一个启用了istio注入并定义了蟑螂db状态集的集群：

apiVersion: v1
kind: ServiceAccount
metadata:
  name: cockroachdb-serviceaccount
---
apiVersion: v1
kind: Service
metadata:
  # This service is meant to be used by clients of the database. It exposes a ClusterIP that will
  # automatically load balance connections to the different database pods.
  name: cockroachdb-public
  labels:
    app: cockroachdb
spec:
  ports:
  # The main port, served by gRPC, serves Postgres-flavor SQL, internode
  # traffic and the cli.
  - port: 26257
    targetPort: 26257
    name: tcp
  # The secondary port serves the UI as well as health and debug endpoints.
  - port: 8080
    targetPort: 8080
    name: http
  selector:
    app: cockroachdb
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: cockroachdb-statefulset
  labels:
    version: v20.1.2
spec:
  serviceName: cockroachdb
  replicas: 3
  selector:
    matchLabels:
      app: cockroachdb
  template:
    metadata:
      labels:
        app: cockroachdb
        version: v20.1.2
    spec:
      serviceAccountName: cockroachdb-serviceaccount
      containers:
      - name: cockroachdb
        image: cockroachdb/cockroach:v20.1.2
        ports:
        - containerPort: 26257
          name: tcp
        - containerPort: 8080
          name: http
        volumeMounts:
        - name: datadir
          mountPath: /cockroach/cockroach-data
        env:
        - name: COCKROACH_CHANNEL
          value: kubernetes-insecure
        command:
          - "/bin/bash"
          - "-ecx"
          # The use of qualified `hostname -f` is crucial:
          # Other nodes aren't able to look up the unqualified hostname.
          - "exec /cockroach/cockroach start --logtostderr --insecure --advertise-host $(hostname -f) --http-addr 0.0.0.0 --join cockroachdb-statefulset-0.cockroachdb,cockroachdb-statefulset-1.cockroachdb,cockroachdb-statefulset-2.cockroachdb --cache 25% --max-sql-memory 25%"
      # No pre-stop hook is required, a SIGTERM plus some time is all that's
      # needed for graceful shutdown of a node.
      terminationGracePeriodSeconds: 5
      volumes:
      - name: datadir
        persistentVolumeClaim:
          claimName: datadir
  podManagementPolicy: Parallel
  updateStrategy:
    type: RollingUpdate
  volumeClaimTemplates:
  - metadata:
      name: datadir
    spec:
      accessModes:
        - "ReadWriteOnce"
      resources:
        requests:
          storage: 4Gi
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: cockroachdb-public
spec:
  host: cockroachdb-public
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: cockroachdb-public
spec:
  hosts:
  - cockroachdb-public
  http:
  - match:
    - port: 8080
    route:
    - destination:
        host: cockroachdb-public
        port:
          number: 8080
  tcp:
  - match:
    - port: 26257
    route:
    - destination:
        host: cockroachdb-public
        port:
          number: 26257

以及访问它的服务：

apiVersion: v1
kind: ServiceAccount
metadata:
  name: downstream-serviceaccount
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: downstream-deployment-v1
  labels:
    app: downstream
    version: v1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: downstream
      version: v1
  template:
    metadata:
      labels:
        app: downstream
        version: v1
    spec:
      serviceAccountName: downstream-serviceaccount
      containers:
      - name: downstream
        image: downstream:0.1
        ports:
        - containerPort: 80
        env:
          - name: DATABASE_URL
            value: postgres://roach@cockroachdb-public:26257/roach?sslmode=disable
---
apiVersion: v1
kind: Service
metadata:
  name: downstream-service
  labels:
    app: downstream
spec:
  type: ClusterIP
  selector:
    app: downstream
  ports:
    - port: 80
      targetPort: 80
      name: http
      protocol: TCP
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: downstream-service
spec:
  host: downstream-service
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: downstream-service
spec:
  hosts:
  - downstream-service
  http:
  - name: "downstream-service-routes"
    match:
    - port: 80
    route:
    - destination:
        host: downstream-service
        port:
          number: 80

现在我想限制对cockroach db的访问仅限于

下游服务和cockroach db本身（因为节点之间需要相互通信）

我试图用这样的方式限制交通：

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
 name: default-deny-all
 namespace: default
spec:
  {}
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
 name: cockroachdb-authorizationpolicy-allow-from-downstream
 namespace: default
spec:
 selector:
   matchLabels:
     app: cockroachdb
 action: ALLOW
 rules:
  - from:
    - source:
       principals: ["cluster.local/ns/default/sa/downstream-serviceaccount"]
  - to:
    - operation:
       ports: ["26257"]
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
 name: cockroachdb-authorizationpolicy-allow-from-cockroachdb
 namespace: default
spec:
 selector:
   matchLabels:
     app: cockroachdb
 action: ALLOW
 rules:
  - from:
    - source:
       principals: ["cluster.local/ns/default/sa/cockroachdb-serviceaccount"]
  - to:
    - operation:
       ports: ["26257"]

但似乎什么都没做。例如，我仍然可以从下游服务访问
cockroachdb public:8080
cluster HTTP UI

现在，当我添加以下内容时：

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
 name: default-deny-all-to-cockroachdb
 namespace: default
spec:
  selector:
    matchLabels:
      app: cockroachdb
  action: DENY
  rules:
  - to:
    - operation:
        ports: ["26257"]

然后所有流量都被阻塞（包括cockroachdb节点之间的流量）

我做错了什么？
你和几天前的一个家伙有同样的问题。在授权策略中，您有两个策略：


来自默认命名空间的服务帐户
下游serviceaccount
（以及其他授权策略的
cockroachdb serviceaccount
）可以使用
默认
命名空间上任何端口上的标签
app:cockroachdb
访问服务

来自任何命名空间的任何服务帐户都可以访问端口26257上带有标签的服务

为了使其成为和，您可以执行以下操作：

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
 name: cockroachdb-authorizationpolicy-allow-from-cockroachdb
 namespace: default
spec:
 selector:
   matchLabels:
     app: cockroachdb
 action: ALLOW
 rules:
  - from:
    - source:
       principals: ["cluster.local/ns/default/sa/cockroachdb-serviceaccount"]
    to:                  <- remove the dash from here
    - operation:
       ports: ["26257"]

apiVersion:security.istio.io/v1beta1
种类：授权政策
元数据：
名称：cockroachdb授权策略允许来自cockroachdb
名称空间：默认值
规格：
选择器：
火柴标签：
应用程序：蟑螂
行动：允许
规则：
-发件人：
-资料来源：
主体：[“cluster.local/ns/default/sa/cockroachdb serviceaccount”]
致：天哪，难怪人们抱怨yaml。谢谢！顺便说一句，在创建允许规则之后，所有其他内容都被拒绝：我可以在文档中的何处找到它？从这里：。这一部分解释了开头的4点。最后一个说
4。拒绝请求
，这基本上意味着如果存在明确的拒绝或允许，则拒绝或允许请求，最后拒绝所有其他内容。我也亲眼目睹了这种情况的发生。我也曾多次抱怨过他们的文档。这都是基于实例，但理论不是很全面。