在“authorizationpolicy”中使用通配符路径时，istio返回“rbac:access denied”，请参见文件：
api-key-test-authorization.yml接口

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: api-key-test-authorization
  namespace: test
spec:
  selector:
    matchLabels:
      api-key-secured: enabled
  rules:
  - to:
    - operation:
        paths: ["*/test1", "*/test2/*", "*/test4*"]
  - to:
    - operation:
        paths: ["/*"]
    when:
    - key: request.headers[api-key]
      values: ["XXXXXXXX"]

资源.java

...
enter code here
@GetMapping(value = "/test1")
@ResponseBody
public ResponseEntity<Resource> getTest1(HttpServletResponse response) throws IOException {

    System.out.println("Test 1");

    return ResponseEntity.ok().build();
}

@GetMapping(value = "/test2/{id}/xpto")
@ResponseBody
public ResponseEntity<Resource> getTest2(@PathVariable("id") String id, HttpServletResponse response) throws IOException {

    System.out.println(id + " XPTO");

    return ResponseEntity.ok().build();
}

@GetMapping(value = "/test3/{id}")
@ResponseBody
public ResponseEntity<Resource> getTest3(@PathVariable("id") String id, HttpServletResponse response) throws IOException {

    System.out.println(id + " of Test 3");

    return ResponseEntity.ok().build();
}

结果：
"http://example.com/test1“：工作很好；
"http://example.com/test2//xpto“：return”rbac:拒绝访问“；
"http://example.com/test3/“：return”rbac:拒绝访问“；
这些路径配置为不需要传递“api密钥”，但是当路径中存在通配符（*）时，它会返回要求传递“api密钥”的错误。
我用的是istio.1.4.9