I see that there is an error related to “https://www.h.net:30000/auth/realms/hproject” that is a Keycloak server hosted on the same cluster.
“https://www.h.net” is the address of the ingressgateway
I used this requestauthentication file:
sysop@hdev:~/software/hproject$ cat h-reqaut-ingress.yaml
apiVersion: "security.istio.io/v1beta1"
kind: "RequestAuthentication"
metadata:
name: "h-ingress-jwt"
namespace: istio-system
spec:
selector:
matchLabels:
istio: ingressgateway
jwtRules:
- issuer: "https://www.h.net:30000/auth/realms/hproject"
jwksUri: "https://www.h.net:30000/auth/realms/hproject/protocol/openid-connect/certs"
---
sysop@hdev:~/software/hproject$
The two uri seem to respond correctly
I’m doing something wrong?
Here is the part of the log. The entire log is here
2020-07-03T08:24:56.119865Z info FLAG: --appNamespace=""
2020-07-03T08:24:56.119959Z info FLAG: --caCertFile=""
2020-07-03T08:24:56.119969Z info FLAG: --clusterID="Kubernetes"
2020-07-03T08:24:56.119974Z info FLAG: --clusterRegistriesNamespace="istio-system"
2020-07-03T08:24:56.119977Z info FLAG: --configDir=""
2020-07-03T08:24:56.119981Z info FLAG: --consulserverURL=""
2020-07-03T08:24:56.119986Z info FLAG: --ctrlz_address="localhost"
2020-07-03T08:24:56.119992Z info FLAG: --ctrlz_port="9876"
2020-07-03T08:24:56.119998Z info FLAG: --disable-install-crds="true"
2020-07-03T08:24:56.120018Z info FLAG: --domain="cluster.local"
2020-07-03T08:24:56.120024Z info FLAG: --grpcAddr=":15010"
2020-07-03T08:24:56.120028Z info FLAG: --help="false"
2020-07-03T08:24:56.120031Z info FLAG: --httpAddr=":8080"
2020-07-03T08:24:56.120035Z info FLAG: --httpsAddr=":15017"
2020-07-03T08:24:56.120042Z info FLAG: --keepaliveInterval="30s"
2020-07-03T08:24:56.120046Z info FLAG: --keepaliveMaxServerConnectionAge="30m0s"
2020-07-03T08:24:56.120050Z info FLAG: --keepaliveTimeout="10s"
2020-07-03T08:24:56.120054Z info FLAG: --kubeconfig=""
2020-07-03T08:24:56.120058Z info FLAG: --log_as_json="false"
2020-07-03T08:24:56.120061Z info FLAG: --log_caller=""
2020-07-03T08:24:56.120065Z info FLAG: --log_output_level="default:info"
2020-07-03T08:24:56.120069Z info FLAG: --log_rotate=""
2020-07-03T08:24:56.120081Z info FLAG: --log_rotate_max_age="30"
2020-07-03T08:24:56.120103Z info FLAG: --log_rotate_max_backups="1000"
2020-07-03T08:24:56.120111Z info FLAG: --log_rotate_max_size="104857600"
2020-07-03T08:24:56.120117Z info FLAG: --log_stacktrace_level="default:none"
2020-07-03T08:24:56.120130Z info FLAG: --log_target="[stdout]"
2020-07-03T08:24:56.120146Z info FLAG: --mcpInitialConnWindowSize="1048576"
2020-07-03T08:24:56.120152Z info FLAG: --mcpInitialWindowSize="1048576"
2020-07-03T08:24:56.120160Z info FLAG: --mcpMaxMsgSize="4194304"
2020-07-03T08:24:56.120166Z info FLAG: --meshConfig="/etc/istio/config/mesh"
2020-07-03T08:24:56.120172Z info FLAG: --monitoringAddr=":15014"
2020-07-03T08:24:56.120183Z info FLAG: --namespace="istio-system"
2020-07-03T08:24:56.120187Z info FLAG: --networksConfig="/etc/istio/config/meshNetworks"
2020-07-03T08:24:56.120199Z info FLAG: --plugins="[authn,authz,health,mixer]"
2020-07-03T08:24:56.120215Z info FLAG: --profile="true"
2020-07-03T08:24:56.120229Z info FLAG: --registries="[Kubernetes]"
2020-07-03T08:24:56.120244Z info FLAG: --resync="1m0s"
2020-07-03T08:24:56.120251Z info FLAG: --tlsCertFile=""
2020-07-03T08:24:56.120257Z info FLAG: --tlsKeyFile=""
2020-07-03T08:24:56.120263Z info FLAG: --trust-domain="cluster.local"
2020-07-03T08:24:56.448933Z info mesh configuration: {
"disableMixerHttpReports": true,
"proxyListenPort": 15001,
"connectTimeout": "10s",
"protocolDetectionTimeout": "0.100s",
"ingressClass": "istio",
"ingressService": "istio-ingressgateway",
"ingressControllerMode": "STRICT",
"enableTracing": true,
"accessLogFile": "/dev/stdout",
"defaultConfig": {
"configPath": "./etc/istio/proxy",
"binaryPath": "/usr/local/bin/envoy",
"serviceCluster": "istio-proxy",
"drainDuration": "45s",
"parentShutdownDuration": "60s",
"discoveryAddress": "istiod.istio-system.svc:15012",
"proxyAdminPort": 15000,
"statNameLength": 189,
"concurrency": 2,
"tracing": {
"zipkin": {
"address": "zipkin.istio-system:9411"
}
},
"envoyAccessLogService": {
},
"envoyMetricsService": {
},
"proxyMetadata": {
"DNS_AGENT": ""
},
"statusPort": 15020
},
"outboundTrafficPolicy": {
"mode": "ALLOW_ANY"
},
"sdsUdsPath": "unix:/etc/istio/proxy/SDS",
"enableAutoMtls": true,
"trustDomain": "cluster.local",
"trustDomainAliases": [
],
"defaultServiceExportTo": [
"*"
],
"defaultVirtualServiceExportTo": [
"*"
],
"defaultDestinationRuleExportTo": [
"*"
],
"rootNamespace": "istio-system",
"localityLbSetting": {
"enabled": true
},
"dnsRefreshRate": "5s",
"reportBatchMaxEntries": 100,
"reportBatchMaxTime": "1s",
"certificates": [
],
"thriftConfig": {
},
"serviceSettings": [
],
"enablePrometheusMerge": false
}
…
2020-07-03T08:33:39.800484Z warn ads ADS:LDS: ACK ERROR router~10.42.1.154~istio-ingressgateway-66cc54b468-62n25.istio-system~istio-system.svc.cluster.local-6 Internal:Error adding/updating listener(s) 0.0.0.0_8080: Proto constraint validation failed (JwtAuthenticationValidationError.Providers[key]: ["embedded message failed validation"] | caused by JwtProviderValidationError.LocalJwks: ["embedded message failed validation"] | caused by DataSourceValidationError.InlineString: ["value length must be at least " '\x01' " bytes"]): providers {
key: "origins-0"
value {
issuer: "https://www.h.net:30000/auth/realms/hproject"
local_jwks {
inline_string: ""
}
payload_in_metadata: "https://www.h.net:30000/auth/realms/hproject"
}
}
rules {
match {
prefix: "/"
}
requires {
requires_any {
requirements {
provider_name: "origins-0"
}
requirements {
allow_missing {
}
}
}
}
}
0.0.0.0_8443: Proto constraint validation failed (JwtAuthenticationValidationError.Providers[key]: ["embedded message failed validation"] | caused by JwtProviderValidationError.LocalJwks: ["embedded message failed validation"] | caused by DataSourceValidationError.InlineString: ["value length must be at least " '\x01' " bytes"]): providers {
key: "origins-0"
value {
issuer: "https://www.h.net:30000/auth/realms/hproject"
local_jwks {
inline_string: ""
}
payload_in_metadata: "https://www.h.net:30000/auth/realms/hproject"
}
}
rules {
match {
prefix: "/"
}
requires {
requires_any {
requirements {
provider_name: "origins-0"
}
requirements {
allow_missing {
}
}
}
}
}
2020-07-03T08:33:42.967776Z info ads Push Status: {}
2020-07-03T08:33:48.497008Z info grpc: Server.Serve failed to complete security handshake from "10.42.1.153:39768": EOF
…
Istio core installed