ISTIO OAUTH滤波器错误带有秘密创建 - 更新侦听器0.0.0.0.8443：路径必须参考系统中现有路径不存在

Question

我正在kubernetes上运行istio（容器istio/proxyv2：1.13.2），目前使用oauth2-proxy pod使用KeyCloak进行身份验证。我需要用ISTIO OAUTH过滤器替换OAuth2-Proxy，并且我正在尝试通过关注此博客。在下面部署YAML时，我会在ISTIOD日志中看到以下错误：

2022-05-12T16：59：58.080449Z WARN ADS ADS ADS：LDS：ACK错误ISTIO-ISTIO-ENGRESSGATEWAY-7FD568FC99-FC99-FC99-FVVVCC.ISTONENTENT-150 INTENTLENTEN ：错误添加/更新侦听器0.0.0.0_8443：路径必须参考系统中的现有路径：'/etc/istio/config/token-secret.yaml'不存在

它看起来在我身上使用SDS将秘密YAML文件加载到Ingressgateway Pod中存在问题 - 但是我可能是错误的，因为我不完全了解此示例中该秘密加载应该如何工作。我无法在最新的ISTIO版本中找到有关此文件的文档，因此我正在努力。较旧的文档谈论在Istiogateway Pod中运行的SDS容器，但这似乎与最近的ISTIO版本无关。

谁能在我关注的示例中提供帮助，或解释如何将秘密加载到Ingressgateway中，以及可能是什么问题/如何诊断？感激地收到的任何帮助。

代码如下：

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: oauth2-ingress
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: CLUSTER
    match:
      cluster:
        service: oauth
    patch:
      operation: ADD
      value:
        name: oauth
        dns_lookup_family: V4_ONLY
        type: LOGICAL_DNS
        connect_timeout: 10s
        lb_policy: ROUND_ROBIN
        transport_socket:
          name: envoy.transport_sockets.tls
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
            sni: keycloak.mydomain.com
        load_assignment:
          cluster_name: oauth
          endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    address: keycloak.mydomain.com
                    port_value: 443
  - applyTo: HTTP_FILTER
    match:
      context: GATEWAY
      listener:
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
            subFilter:
              name: "envoy.filters.http.jwt_authn"
    patch:
      operation: INSERT_BEFORE
      value:
       name: envoy.filters.http.oauth2
       typed_config:
         "@type": type.googleapis.com/envoy.extensions.filters.http.oauth2.v3.OAuth2
         config:
          token_endpoint:
            cluster: oauth
            uri: https://keycloak.mydomain.com/auth/realms/myrealm/protocol/openid-connect/token
            timeout: 3s
          authorization_endpoint: https://keycloak.mydomain.com/auth/realms/myrealm/protocol/openid-connect/auth
          redirect_uri: "https://%REQ(:authority)%/callback"
          redirect_path_matcher:
            path:
              exact: /callback
          signout_path:
            path:
              exact: /signout
          credentials:
            client_id: myclient
            token_secret:
              name: token
              sds_config:
                path: "/etc/istio/config/token-secret.yaml"
            hmac_secret:
              name: hmac
              sds_config:
                path: "/etc/istio/config/hmac-secret.yaml"
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: istio-oauth2
  namespace: istio-system
data:
  token-secret.yaml: |-
    resources:
      - "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"
        name: token
        generic_secret:
          secret:
            inline_string: "myclientsecrettext"
  hmac-secret.yaml: |-
    resources:
      - "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"
        name: hmac
        generic_secret:
          secret:
            # generated using `head -c 32 /dev/urandom | base64`
            inline_bytes: "XYJ7ibKwXwmRrO/yL/37ZV+T3Q/WB+xfhmVlio+wmc0="
---
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: jwt-authentication
  namespace: istio-system
spec:
  selector:
    matchLabels:
      app: istio-ingressgateway
  jwtRules:
    - issuer: "https://keycloak.mydomain.com/auth/realms/myrealm"
      jwksUri: "https://keycloak.mydomain.com/auth/realms/myrealm/protocol/openid-connect/certs"
      forwardOriginalToken: true
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: known-user
  namespace: istio-system
spec:
  selector:
    matchLabels:
      app: istio-ingressgateway
  rules:
  - when:
    - key: request.headers[Authorization]
      notValues:
      - 'Bearer*'
  - when:
    - key: request.auth.audiences
      values:
        - 'oauth'
    - key: request.auth.presenter
      values: