我有一个 dockerized 烧瓶应用程序，它在 Google Cloud Platform 中的 kuberneetes 上运行，并启用了 Identity-Aware Proxy。我可以运行“Hello World”网站，但是当我尝试使用签名的 JWT 标头时，就会出现问题。
在我的浏览器中，我看到了
There was a problem with your request. Error code 9
我的应用程序就像这个例子，我gunicorn用来运行应用程序。似乎麻烦发生在第一行
jwt = request.headers.get('x-goog-iap-jwt-assertion')
但这对我来说毫无意义。但我可以在该行之前返回一个字符串，但不能在之后返回。有什么建议么？
当前 Kubernetes 集群的详细信息
apiVersion: apps/v1
kind: Deployment
metadata:
name: internal-tools-app
spec:
selector:
matchLabels:
app: internal-tools
template:
metadata:
labels:
app: internal-tools
spec:
containers:
- name: internal-web-app
image: <<MY_IMAGE>>
---
apiVersion: cloud.google.com/v1beta1
kind: BackendConfig
metadata:
name: internal-tools-backend-config
namespace: default
spec:
iap:
enabled: true
oauthclientCredentials:
secretName: internal-tools-oauth
---
apiVersion: v1
kind: Service
metadata:
name: internal-tools-service
annotations:
beta.cloud.google.com/backend-config: '{"default": "internal-tools-backend-config"}'
spec:
type: NodePort
selector:
app: internal-tools
ports:
- name: it-first-port
protocol: TCP
port: 8080
targetPort: 8080
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.global-static-ip-name: internal-tools-ip
ingress.gcp.kubernetes.io/pre-shared-cert: "letsencrypt-internal-tools"
name: internal-tools-ingress
spec:
rules:
- host: <<MY_DOMAIN>>
http:
paths:
- backend:
serviceName: internal-tools-service
servicePort: it-first-port
编辑
进一步调查显示
ImportError: Error loading shared library libssl.so.45: No such file or directory (needed by /usr/local/lib/python3.6/site-packages/cryptography/hazmat/bindings/_openssl.abi3.so)
运行以下命令时
jwt.decode(
iap_jwt, key,
algorithms=['ES256'],
audience=expected_audience)