Go零信任網路：BeyondCorp微服務安全架構實戰2026

引言：為什麼你的微服務安全架構已經過時了

2026年了，如果你的微服務安全還停留在「內網可信、外網不可信」的傳統邊界模型上，那你的系統就像一扇沒有鎖的門——攻擊者一旦突破邊界，就能在內網橫行無阻。Google BeyondCorp論文早已證明：網路位置不等於信任。

零信任（Zero Trust）的核心思想很簡單：永不預設信任，始終持續驗證。在微服務架構中，這意味著每個服務呼叫、每次資料存取都必須經過身份驗證和授權，無論請求來自內網還是外網。

Go語言憑藉其出色的併發模型、豐富的加密庫生態和雲原生基因，成為實現零信任架構的絕佳選擇。本文將帶你用Go從零構建5個零信任核心模式，涵蓋從mTLS到SPIFFE/SPIRE的完整鏈路。

核心概念速覽

概念	說明	Go生態工具
零信任網路	不信任任何網路位置，持續驗證每個請求	-
BeyondCorp	Google提出的無邊界安全模型	-
mTLS	雙向TLS認證，客戶端和服務端互相驗證憑證	crypto/tls, cert-manager
SPIFFE	服務的統一身份框架標準	go-spiffe, SPIRE
服務網格零信任	透過Sidecar代理實現零信任通訊	Istio, Linkerd
持續驗證	每次請求都進行身份和權限校驗	Casbin, OPA
零信任API閘道	閘道層統一實施零信任策略	Traefik, Kong

五大痛點：傳統微服務安全為什麼撐不住了

痛點1：邊界信任模型崩塌。Kubernetes叢集內部網路並非安全孤島，Pod間通訊預設無加密，一旦一個Pod被攻破，攻擊者可橫向移動到所有服務。

痛點2：憑證管理噩夢。手動管理mTLS憑證在100+微服務場景下完全不可行，憑證輪換、撤銷、分發都是定時炸彈。

痛點3：身份體系缺失。服務間呼叫缺乏統一的身份標識，IP位址不可靠（Pod重建IP變化），Service Account粒度太粗。

痛點4：靜態授權無法應對動態威脅。一次授權永久有效的模式無法應對憑證洩露、權限提升等動態安全事件。

痛點5：可觀測性黑洞。服務間呼叫缺乏加密通訊的稽覈日誌，安全事件發生時無法追蹤和回溯。

模式一：mTLS雙向認證

mTLS（Mutual TLS）是零信任的基石，要求客戶端和服務端都出示憑證進行身份驗證。

// 執行環境: Go 1.22+, 憑證管理使用 cert-manager v1.15+
package main

import (
	"crypto/tls"
	"crypto/x509"
	"fmt"
	"log"
	"net/http"
	"os"
	"time"
)

// MTLSConfig mTLS配置
type MTLSConfig struct {
	CertFile   string
	KeyFile    string
	CAFile     string
	ServerName string
}

// NewMTLSServer 建立mTLS HTTP伺服器
func NewMTLSServer(config MTLSConfig, handler http.Handler) (*http.Server, error) {
	// 載入服務端憑證
	cert, err := tls.LoadX509KeyPair(config.CertFile, config.KeyFile)
	if err != nil {
		return nil, fmt.Errorf("載入服務端憑證失敗: %w", err)
	}

	// 載入CA憑證用於驗證客戶端
	caCert, err := os.ReadFile(config.CAFile)
	if err != nil {
		return nil, fmt.Errorf("載入CA憑證失敗: %w", err)
	}

	clientCAs := x509.NewCertPool()
	if !clientCAs.AppendCertsFromPEM(caCert) {
		return nil, fmt.Errorf("解析CA憑證失敗")
	}

	tlsConfig := &tls.Config{
		Certificates: []tls.Certificate{cert},
		ClientAuth:   tls.RequireAndVerifyClientCert, // 強制要求客戶端憑證
		ClientCAs:    clientCAs,
		MinVersion:   tls.VersionTLS13, // 僅允許TLS 1.3
		ServerName:   config.ServerName,
		CurvePreferences: []tls.CurveID{
			tls.X25519,
			tls.CurveP256,
		},
	}

	return &http.Server{
		Addr:         ":8443",
		Handler:      handler,
		TLSConfig:    tlsConfig,
		ReadTimeout:  15 * time.Second,
		WriteTimeout: 15 * time.Second,
		IdleTimeout:  60 * time.Second,
	}, nil
}

// NewMTLSClient 建立mTLS HTTP客戶端
func NewMTLSClient(config MTLSConfig) (*http.Client, error) {
	cert, err := tls.LoadX509KeyPair(config.CertFile, config.KeyFile)
	if err != nil {
		return nil, fmt.Errorf("載入客戶端憑證失敗: %w", err)
	}

	caCert, err := os.ReadFile(config.CAFile)
	if err != nil {
		return nil, fmt.Errorf("載入CA憑證失敗: %w", err)
	}

	rootCAs := x509.NewCertPool()
	if !rootCAs.AppendCertsFromPEM(caCert) {
		return nil, fmt.Errorf("解析CA憑證失敗")
	}

	transport := &http.Transport{
		TLSClientConfig: &tls.Config{
			Certificates:   []tls.Certificate{cert},
			RootCAs:        rootCAs,
			MinVersion:     tls.VersionTLS13,
			ServerName:     config.ServerName,
		},
		MaxIdleConns:        100,
		MaxIdleConnsPerHost: 20,
		IdleConnTimeout:     90 * time.Second,
	}

	return &http.Client{
		Transport: transport,
		Timeout:   30 * time.Second,
	}, nil
}

func main() {
	config := MTLSConfig{
		CertFile:   "certs/server.crt",
		KeyFile:    "certs/server.key",
		CAFile:     "certs/ca.crt",
		ServerName: "order-service.internal",
	}

	mux := http.NewServeMux()
	mux.HandleFunc("/api/v1/orders", func(w http.ResponseWriter, r *http.Request) {
		// 從客戶端憑證中提取身份資訊
		if len(r.TLS.PeerCertificates) > 0 {
			clientID := r.TLS.PeerCertificates[0].Subject.CommonName
			log.Printf("請求來自客戶端: %s", clientID)
		}
		w.WriteHeader(http.StatusOK)
		w.Write([]byte(`{"status": "ok", "message": "mTLS驗證通過"}`))
	})

	server, err := NewMTLSServer(config, mux)
	if err != nil {
		log.Fatalf("建立mTLS伺服器失敗: %v", err)
	}

	log.Println("mTLS伺服器啟動在 :8443")
	if err := server.ListenAndServeTLS("", ""); err != nil {
		log.Fatalf("伺服器啟動失敗: %v", err)
	}
}

模式二：SPIFFE/SPIRE身份框架

SPIFFE（Secure Production Identity Framework for Everyone）為服務提供統一身份標識，SPIRE是SPIFFE的實作。

// 執行環境: Go 1.22+, github.com/spiffe/go-spiffe/v2 v2.3.0
package main

import (
	"context"
	"fmt"
	"log"
	"net/http"
	"time"

	"github.com/spiffe/go-spiffe/v2/spiffeid"
	"github.com/spiffe/go-spiffe/v2/spiffetls/tlsconfig"
	"github.com/spiffe/go-spiffe/v2/workloadapi"
)

// SPIFFEIdentity 表示一個SPIFFE身份
type SPIFFEIdentity struct {
	TrustDomain string
	Namespace   string
	ServiceName string
}

// String 回傳SPIFFE ID字串
func (id SPIFFEIdentity) String() string {
	return fmt.Sprintf("spiffe://%s/ns/%s/svc/%s",
		id.TrustDomain, id.Namespace, id.ServiceName)
}

// ParseSPIFFEID 解析SPIFFE ID
func ParseSPIFFEID(spiffeID string) (*SPIFFEIdentity, error) {
	id, err := spiffeid.FromString(spiffeID)
	if err != nil {
		return nil, fmt.Errorf("無效的SPIFFE ID: %w", err)
	}

	segments := id.Path()
	var identity SPIFFEIdentity
	identity.TrustDomain = id.TrustDomain().String()
	fmt.Sscanf(segments, "/ns/%s/svc/%s", &identity.Namespace, &identity.ServiceName)
	return &identity, nil
}

// NewSPIFFEServer 建立基於SPIFFE身份的TLS伺服器
func NewSPIFFEServer(ctx context.Context, socketPath string, allowedIDs []spiffeid.ID) (*http.Server, error) {
	source, err := workloadapi.NewX509Source(ctx,
		workloadapi.WithClientOptions(
			workloadapi.WithAddr(socketPath),
		),
	)
	if err != nil {
		return nil, fmt.Errorf("連線Workload API失敗: %w", err)
	}

	authorizer := tlsconfig.AuthorizeAnyOf(
		func() []tlsconfig.Authorizer {
			auths := make([]tlsconfig.Authorizer, len(allowedIDs))
			for i, id := range allowedIDs {
				auths[i] = tlsconfig.AuthorizeID(id)
			}
			return auths
		}()...,
	)

	tlsConfig := tlsconfig.MTLSServerConfig(source, source, authorizer)

	mux := http.NewServeMux()
	mux.HandleFunc("/api/v1/secure-data", func(w http.ResponseWriter, r *http.Request) {
		if len(r.TLS.PeerCertificates) > 0 {
			for _, cert := range r.TLS.PeerCertificates {
				for _, uri := range cert.URIs {
					if uri.Scheme == "spiffe" {
						log.Printf("授權存取: SPIFFE ID=%s, 路徑=%s", uri.String(), r.URL.Path)
					}
				}
			}
		}
		w.WriteHeader(http.StatusOK)
		w.Write([]byte(`{"data": "敏感資料", "access": "granted"}`))
	})

	return &http.Server{
		Addr:         ":8443",
		Handler:      mux,
		TLSConfig:    tlsConfig,
		ReadTimeout:  15 * time.Second,
		WriteTimeout: 15 * time.Second,
	}, nil
}

// NewSPIFFEClient 建立基於SPIFFE身份的TLS客戶端
func NewSPIFFEClient(ctx context.Context, socketPath string, serverID spiffeid.ID) (*http.Client, error) {
	source, err := workloadapi.NewX509Source(ctx,
		workloadapi.WithClientOptions(
			workloadapi.WithAddr(socketPath),
		),
	)
	if err != nil {
		return nil, fmt.Errorf("連線Workload API失敗: %w", err)
	}

	tlsConfig := tlsconfig.MTLSClientConfig(source, source, tlsconfig.AuthorizeID(serverID))
	transport := &http.Transport{
		TLSClientConfig: tlsConfig,
	}

	return &http.Client{
		Transport: transport,
		Timeout:   30 * time.Second,
	}, nil
}

func main() {
	ctx := context.Background()
	socketPath := "unix:///run/spire/sockets/agent.sock"

	allowedIDs := []spiffeid.ID{
		spiffeid.Must("example.org", "/ns/production/svc/user-service"),
		spiffeid.Must("example.org", "/ns/production/svc/order-service"),
	}

	server, err := NewSPIFFEServer(ctx, socketPath, allowedIDs)
	if err != nil {
		log.Fatalf("建立SPIFFE伺服器失敗: %v", err)
	}

	log.Println("SPIFFE身份伺服器啟動在 :8443")
	if err := server.ListenAndServeTLS("", ""); err != nil {
		log.Fatalf("伺服器啟動失敗: %v", err)
	}
}

模式三：服務網格零信任

在服務網格中透過Sidecar代理實現零信任通訊，無需修改業務程式碼。

// 執行環境: Go 1.22+, Istio 1.22+, 服務網格模式
package main

import (
	"context"
	"encoding/json"
	"fmt"
	"log"
	"net/http"
	"time"
)

// ServiceMeshConfig 服務網格配置
type ServiceMeshConfig struct {
	ServiceName    string
	Namespace      string
	MeshName       string
	TrustDomain    string
	PolicyEnabled  bool
}

// ZeroTrustPolicy 零信任策略定義
type ZeroTrustPolicy struct {
	Name      string              `json:"name"`
	Namespace string              `json:"namespace"`
	Spec      ZeroTrustPolicySpec `json:"spec"`
}

type ZeroTrustPolicySpec struct {
	Selector    PolicySelector    `json:"selector"`
	Action      string            `json:"action"`
	Rules       []PolicyRule      `json:"rules"`
}

type PolicySelector struct {
	MatchLabels map[string]string `json:"matchLabels"`
}

type PolicyRule struct {
	From     []RuleFrom `json:"from"`
	To       []RuleTo   `json:"to"`
	When     []RuleWhen `json:"when"`
}

type RuleFrom struct {
	Source      SourceSpec      `json:"source"`
}

type SourceSpec struct {
	Principals  []string `json:"principals"`
	Namespaces  []string `json:"namespaces"`
}

type RuleTo struct {
	Operation OperationSpec `json:"operation"`
}

type OperationSpec struct {
	Hosts   []string `json:"hosts"`
	Methods []string `json:"methods"`
	Paths   []string `json:"paths"`
}

type RuleWhen struct {
	Key    string   `json:"key"`
	Values []string `json:"values"`
}

// GeneratePeerAuthPolicy 產生Istio PeerAuthentication策略（mTLS STRICT模式）
func GeneratePeerAuthPolicy(config ServiceMeshConfig) string {
	policy := map[string]interface{}{
		"apiVersion": "security.istio.io/v1beta1",
		"kind":       "PeerAuthentication",
		"metadata": map[string]interface{}{
			"name":      fmt.Sprintf("%s-mtls-strict", config.ServiceName),
			"namespace": config.Namespace,
		},
		"spec": map[string]interface{}{
			"selector": map[string]interface{}{
				"matchLabels": map[string]string{
					"app": config.ServiceName,
				},
			},
			"mtls": map[string]interface{}{
				"mode": "STRICT",
			},
		},
	}

	data, _ := json.MarshalIndent(policy, "", "  ")
	return string(data)
}

// GenerateAuthorizationPolicy 產生Istio AuthorizationPolicy
func GenerateAuthorizationPolicy(config ServiceMeshConfig, allowedServices []string) string {
	var fromRules []map[string]interface{}
	for _, svc := range allowedServices {
		fromRules = append(fromRules, map[string]interface{}{
			"source": map[string]interface{}{
				"principals": []string{
					fmt.Sprintf("cluster.local/ns/%s/sa/%s", config.Namespace, svc),
				},
			},
		})
	}

	policy := map[string]interface{}{
		"apiVersion": "security.istio.io/v1beta1",
		"kind":       "AuthorizationPolicy",
		"metadata": map[string]interface{}{
			"name":      fmt.Sprintf("%s-zero-trust", config.ServiceName),
			"namespace": config.Namespace,
		},
		"spec": map[string]interface{}{
			"selector": map[string]interface{}{
				"matchLabels": map[string]string{
					"app": config.ServiceName,
				},
			},
			"action": "ALLOW",
			"rules": []map[string]interface{}{
				{
					"from": fromRules,
					"to": []map[string]interface{}{
						{
							"operation": map[string]interface{}{
								"methods": []string{"GET", "POST"},
								"paths":   []string{"/api/v1/*"},
							},
						},
					},
					"when": []map[string]interface{}{
						{
							"key":    "request.headers[x-token-expiry]",
							"values": []string{"*"},
						},
					},
				},
			},
		},
	}

	data, _ := json.MarshalIndent(policy, "", "  ")
	return string(data)
}

// MeshService 帶有零信任註解的微服務
type MeshService struct {
	config ServiceMeshConfig
	client *http.Client
}

func NewMeshService(config ServiceMeshConfig) *MeshService {
	return &MeshService{
		config: config,
		client: &http.Client{
			Timeout: 30 * time.Second,
		},
	}
}

// CallService 透過服務網格呼叫其他服務
func (s *MeshService) CallService(ctx context.Context, targetService, path string) (*http.Response, error) {
	url := fmt.Sprintf("http://%s.%s.svc.cluster.local%s",
		targetService, s.config.Namespace, path)

	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
	if err != nil {
		return nil, fmt.Errorf("建立請求失敗: %w", err)
	}

	req.Header.Set("X-Source-Service", s.config.ServiceName)
	req.Header.Set("X-Source-Namespace", s.config.Namespace)

	return s.client.Do(req)
}

func main() {
	config := ServiceMeshConfig{
		ServiceName:   "order-service",
		Namespace:     "production",
		MeshName:      "istio-mesh",
		TrustDomain:   "cluster.local",
		PolicyEnabled: true,
	}

	fmt.Println("=== PeerAuthentication (mTLS STRICT) ===")
	fmt.Println(GeneratePeerAuthPolicy(config))

	fmt.Println("\n=== AuthorizationPolicy (零信任存取控制) ===")
	fmt.Println(GenerateAuthorizationPolicy(config, []string{"user-service", "payment-service"}))

	service := NewMeshService(config)
	mux := http.NewServeMux()
	mux.HandleFunc("/api/v1/orders", func(w http.ResponseWriter, r *http.Request) {
		sourceService := r.Header.Get("X-Source-Service")
		log.Printf("收到來自 %s 的請求", sourceService)
		w.WriteHeader(http.StatusOK)
		json.NewEncoder(w).Encode(map[string]string{
			"status":  "ok",
			"service": config.ServiceName,
		})
	})

	log.Fatal(http.ListenAndServe(":8080", mux))
}

模式四：持續驗證中介層

零信任要求每次請求都進行驗證，而非僅在網路邊界驗證一次。

// 執行環境: Go 1.22+, github.com/casbin/casbin/v2 v2.103.0
package main

import (
	"context"
	"encoding/json"
	"fmt"
	"log"
	"net/http"
	"strings"
	"time"

	"github.com/casbin/casbin/v2"
	"github.com/casbin/casbin/v2/model"
	"github.com/casbin/casbin/v2/persist"
	fileadapter "github.com/casbin/casbin/v2/persist/file-adapter"
)

// Identity 表示請求的身份資訊
type Identity struct {
	ServiceID   string
	TrustDomain string
	Namespace   string
	Role        string
	TokenExpiry time.Time
}

// VerificationResult 驗證結果
type VerificationResult struct {
	Allowed    bool
	Identity   *Identity
	DeniedCode string
	DeniedMsg  string
}

// ContinuousVerificationMiddleware 持續驗證中介層
type ContinuousVerificationMiddleware struct {
	enforcer   *casbin.Enforcer
	jwtSecret  string
	cache      *VerificationCache
}

// VerificationCache 驗證結果快取（短TTL）
type VerificationCache struct {
	items map[string]*VerificationResult
	ttl   time.Duration
}

func NewVerificationCache(ttl time.Duration) *VerificationCache {
	return &VerificationCache{
		items: make(map[string]*VerificationResult),
		ttl:   ttl,
	}
}

// NewContinuousVerificationMiddleware 建立持續驗證中介層
func NewContinuousVerificationMiddleware(modelPath, policyPath string) (*ContinuousVerificationMiddleware, error) {
	m, err := model.NewModelFromString(`
[request_definition]
r = sub, dom, obj, act

[policy_definition]
p = sub, dom, obj, act

[role_definition]
g = _, _, _

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = g(r.sub, p.sub, r.dom) && r.dom == p.dom && r.obj == p.obj && r.act == p.act
`)
	if err != nil {
		return nil, fmt.Errorf("建立Casbin模型失敗: %w", err)
	}

	var adapter persist.Adapter
	if policyPath != "" {
		adapter = fileadapter.NewAdapter(policyPath)
	}

	enforcer, err := casbin.NewEnforcer(m, adapter)
	if err != nil {
		return nil, fmt.Errorf("建立Casbin執行器失敗: %w", err)
	}

	return &ContinuousVerificationMiddleware{
		enforcer: enforcer,
		cache:    NewVerificationCache(30 * time.Second),
	}, nil
}

// Verify 持續驗證每個請求
func (m *ContinuousVerificationMiddleware) Verify(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		ctx := r.Context()

		// 第1層：提取身份
		identity, err := m.extractIdentity(r)
		if err != nil {
			m.denyAccess(w, "IDENTITY_MISSING", "無法提取請求身份")
			return
		}

		// 第2層：驗證Token時效性
		if time.Now().After(identity.TokenExpiry) {
			m.denyAccess(w, "TOKEN_EXPIRED", "存取令牌已過期")
			return
		}

		// 第3層：檢查憑證撤銷狀態
		if m.isCredentialRevoked(ctx, identity.ServiceID) {
			m.denyAccess(w, "CREDENTIAL_REVOKED", "憑證已被撤銷")
			return
		}

		// 第4層：RBAC策略檢查
		resource := r.URL.Path
		action := r.Method
		allowed, err := m.enforcer.Enforce(identity.ServiceID, identity.Namespace, resource, action)
		if err != nil {
			m.denyAccess(w, "POLICY_ERROR", "策略檢查失敗")
			return
		}
		if !allowed {
			m.denyAccess(w, "ACCESS_DENIED", "無權存取該資源")
			return
		}

		// 第5層：裝置/環境信任評估
		if !m.evaluateTrustLevel(r) {
			m.denyAccess(w, "LOW_TRUST", "信任等級不足")
			return
		}

		ctx = context.WithValue(ctx, "identity", identity)
		next.ServeHTTP(w, r.WithContext(ctx))
	})
}

func (m *ContinuousVerificationMiddleware) extractIdentity(r *http.Request) (*Identity, error) {
	authHeader := r.Header.Get("Authorization")
	if authHeader == "" {
		return nil, fmt.Errorf("缺少Authorization標頭")
	}

	token := strings.TrimPrefix(authHeader, "Bearer ")
	if token == authHeader {
		return nil, fmt.Errorf("無效的Authorization格式")
	}

	identity := &Identity{
		ServiceID:   r.Header.Get("X-Service-Id"),
		TrustDomain: r.Header.Get("X-Trust-Domain"),
		Namespace:   r.Header.Get("X-Namespace"),
		Role:        r.Header.Get("X-Role"),
		TokenExpiry: time.Now().Add(1 * time.Hour),
	}

	if identity.ServiceID == "" {
		return nil, fmt.Errorf("缺少服務身份標識")
	}

	return identity, nil
}

func (m *ContinuousVerificationMiddleware) isCredentialRevoked(ctx context.Context, serviceID string) bool {
	return false
}

func (m *ContinuousVerificationMiddleware) evaluateTrustLevel(r *http.Request) bool {
	return true
}

func (m *ContinuousVerificationMiddleware) denyAccess(w http.ResponseWriter, code, msg string) {
	w.WriteHeader(http.StatusForbidden)
	json.NewEncoder(w).Encode(map[string]string{
		"error":   code,
		"message": msg,
	})
}

func main() {
	middleware, err := NewContinuousVerificationMiddleware("", "policy.csv")
	if err != nil {
		log.Fatalf("建立驗證中介層失敗: %v", err)
	}

	middleware.enforcer.AddPolicy("user-service", "production", "/api/v1/users", "GET")
	middleware.enforcer.AddPolicy("order-service", "production", "/api/v1/orders", "GET")
	middleware.enforcer.AddPolicy("order-service", "production", "/api/v1/orders", "POST")

	mux := http.NewServeMux()
	mux.HandleFunc("/api/v1/orders", func(w http.ResponseWriter, r *http.Request) {
		identity, _ := r.Context().Value("identity").(*Identity)
		log.Printf("已授權存取: service=%s, namespace=%s", identity.ServiceID, identity.Namespace)
		w.WriteHeader(http.StatusOK)
		json.NewEncoder(w).Encode(map[string]string{"status": "ok"})
	})

	handler := middleware.Verify(mux)
	log.Fatal(http.ListenAndServe(":8080", handler))
}

模式五：零信任API閘道

API閘道是零信任架構的統一入口，集中實施身份驗證、授權、加密和稽覈策略。

// 執行環境: Go 1.22+, 零信任API閘道實作
package main

import (
	"context"
	"crypto/tls"
	"encoding/json"
	"fmt"
	"log"
	"net/http"
	"net/http/httputil"
	"net/url"
	"strings"
	"sync"
	"time"
)

// ZeroTrustGateway 零信任API閘道
type ZeroTrustGateway struct {
	routes         map[string]*RouteConfig
	rateLimiters   map[string]*RateLimiter
	auditLogger    *AuditLogger
	mu             sync.RWMutex
}

// RouteConfig 路由配置
type RouteConfig struct {
	Path            string
	BackendURL      string
	RequiredScopes  []string
	AllowedMethods  []string
	MTLSRequired    bool
	RateLimit       int
	Timeout         time.Duration
}

// RateLimiter 速率限制器
type RateLimiter struct {
	tokens     int
	maxTokens  int
	rate       time.Duration
	lastRefill time.Time
	mu         sync.Mutex
}

// AuditLogger 稽覈日誌記錄器
type AuditLogger struct {
	entries []AuditEntry
	mu      sync.Mutex
}

// AuditEntry 稽覈日誌條目
type AuditEntry struct {
	Timestamp   time.Time `json:"timestamp"`
	SourceID    string    `json:"source_id"`
	Method      string    `json:"method"`
	Path        string    `json:"path"`
	StatusCode  int       `json:"status_code"`
	Duration    string    `json:"duration"`
	Decision    string    `json:"decision"`
	Reason      string    `json:"reason"`
}

func NewZeroTrustGateway() *ZeroTrustGateway {
	return &ZeroTrustGateway{
		routes:       make(map[string]*RouteConfig),
		rateLimiters: make(map[string]*RateLimiter),
		auditLogger:  &AuditLogger{},
	}
}

func (g *ZeroTrustGateway) AddRoute(config *RouteConfig) {
	g.mu.Lock()
	defer g.mu.Unlock()
	g.routes[config.Path] = config
	g.rateLimiters[config.Path] = &RateLimiter{
		tokens:     config.RateLimit,
		maxTokens:  config.RateLimit,
		rate:       time.Second,
		lastRefill: time.Now(),
	}
}

func (g *ZeroTrustGateway) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	startTime := time.Now()

	if r.TLS == nil {
		g.auditLog(r, startTime, 403, "DENY", "非TLS請求")
		http.Error(w, "TLS required", http.StatusForbidden)
		return
	}

	sourceID := g.extractIdentity(r)
	if sourceID == "" {
		g.auditLog(r, startTime, 401, "DENY", "身份缺失")
		http.Error(w, "Unauthorized", http.StatusUnauthorized)
		return
	}

	g.mu.RLock()
	route, exists := g.routes[r.URL.Path]
	g.mu.RUnlock()

	if !exists {
		g.auditLog(r, startTime, 404, "DENY", "路由不存在")
		http.Error(w, "Not Found", http.StatusNotFound)
		return
	}

	methodAllowed := false
	for _, m := range route.AllowedMethods {
		if m == r.Method {
			methodAllowed = true
			break
		}
	}
	if !methodAllowed {
		g.auditLog(r, startTime, 405, "DENY", "方法不允許")
		http.Error(w, "Method Not Allowed", http.StatusMethodNotAllowed)
		return
	}

	limiter := g.rateLimiters[route.Path]
	if !limiter.Allow() {
		g.auditLog(r, startTime, 429, "DENY", "速率超限")
		http.Error(w, "Too Many Requests", http.StatusTooManyRequests)
		return
	}

	if !g.checkScopes(r, route.RequiredScopes) {
		g.auditLog(r, startTime, 403, "DENY", "權限不足")
		http.Error(w, "Forbidden", http.StatusForbidden)
		return
	}

	backendURL, _ := url.Parse(route.BackendURL)
	proxy := httputil.NewSingleHostReverseProxy(backendURL)

	originalDirector := proxy.Director
	proxy.Director = func(req *http.Request) {
		originalDirector(req)
		req.Header.Set("X-Source-Id", sourceID)
		req.Header.Set("X-Forwarded-Proto", "https")
		req.Header.Set("X-Gateway-Timestamp", time.Now().Format(time.RFC3339))
	}

	proxy.ServeHTTP(w, r)
	g.auditLog(r, startTime, 200, "ALLOW", "請求通過")
}

func (g *ZeroTrustGateway) extractIdentity(r *http.Request) string {
	if r.TLS != nil && len(r.TLS.PeerCertificates) > 0 {
		return r.TLS.PeerCertificates[0].Subject.CommonName
	}
	return r.Header.Get("X-Service-Id")
}

func (g *ZeroTrustGateway) checkScopes(r *http.Request, required []string) bool {
	if len(required) == 0 {
		return true
	}
	tokenScopes := strings.Split(r.Header.Get("X-Token-Scopes"), ",")
	scopeMap := make(map[string]bool)
	for _, s := range tokenScopes {
		scopeMap[strings.TrimSpace(s)] = true
	}
	for _, req := range required {
		if !scopeMap[req] {
			return false
		}
	}
	return true
}

func (g *ZeroTrustGateway) auditLog(r *http.Request, startTime time.Time, statusCode int, decision, reason string) {
	entry := AuditEntry{
		Timestamp:  time.Now(),
		SourceID:   r.Header.Get("X-Service-Id"),
		Method:     r.Method,
		Path:       r.URL.Path,
		StatusCode: statusCode,
		Duration:   time.Since(startTime).String(),
		Decision:   decision,
		Reason:     reason,
	}
	g.auditLogger.mu.Lock()
	g.auditLogger.entries = append(g.auditLogger.entries, entry)
	g.auditLogger.mu.Unlock()

	log.Printf("[AUDIT] %s %s %s -> %d (%s) %s",
		entry.SourceID, entry.Method, entry.Path,
		entry.StatusCode, entry.Decision, entry.Reason)
}

func (rl *RateLimiter) Allow() bool {
	rl.mu.Lock()
	defer rl.mu.Unlock()

	now := time.Now()
	elapsed := now.Sub(rl.lastRefill)
	tokensToAdd := int(elapsed / rl.rate)

	if tokensToAdd > 0 {
		rl.tokens += tokensToAdd
		if rl.tokens > rl.maxTokens {
			rl.tokens = rl.maxTokens
		}
		rl.lastRefill = now
	}

	if rl.tokens > 0 {
		rl.tokens--
		return true
	}
	return false
}

func main() {
	gateway := NewZeroTrustGateway()

	gateway.AddRoute(&RouteConfig{
		Path:           "/api/v1/users",
		BackendURL:     "http://user-service:8080",
		RequiredScopes: []string{"users:read"},
		AllowedMethods: []string{"GET"},
		MTLSRequired:   true,
		RateLimit:      100,
		Timeout:        30 * time.Second,
	})

	gateway.AddRoute(&RouteConfig{
		Path:           "/api/v1/orders",
		BackendURL:     "http://order-service:8080",
		RequiredScopes: []string{"orders:read", "orders:write"},
		AllowedMethods: []string{"GET", "POST"},
		MTLSRequired:   true,
		RateLimit:      200,
		Timeout:        30 * time.Second,
	})

	tlsConfig := &tls.Config{
		MinVersion: tls.VersionTLS13,
		CurvePreferences: []tls.CurveID{
			tls.X25519,
			tls.CurveP256,
		},
	}

	server := &http.Server{
		Addr:         ":8443",
		Handler:      gateway,
		TLSConfig:    tlsConfig,
		ReadTimeout:  15 * time.Second,
		WriteTimeout: 15 * time.Second,
	}

	log.Println("零信任API閘道啟動在 :8443")
	log.Fatal(server.ListenAndServeTLS("certs/gateway.crt", "certs/gateway.key"))
}

避坑指南：5個生產級大坑

坑1：mTLS憑證輪換導致服務中斷。憑證過期瞬間所有服務呼叫失敗。解決方案：使用cert-manager自動輪換，設定憑證有效期7天、輪換提前量24小時，實作優雅熱載入。

坑2：SPIRE Agent不可用導致服務啟動失敗。SPIRE Agent當機時Workload API無法取得SVID。解決方案：本機快取SVID、實作降級策略、Agent高可用部署（至少3副本）。

坑3：服務網格策略過嚴導致合法流量被拒。PeerAuthentication STRICT模式會拒絕所有非mTLS流量，包括健康檢查。解決方案：為kube-system命名空間設定PERMISSIVE模式、使用Port級別精細化控制。

坑4：持續驗證中介層效能瓶頸。每次請求都查策略引擎導致P99延遲飆升。解決方案：短TTL本機快取（30秒）、非同步稽覈日誌、策略預編譯為決策樹。

坑5：閘道單點故障。API閘道掛了所有服務不可達。解決方案：閘道多副本部署、就緒探針檢查後端連通性、斷路器模式防止雪崩。

報錯排查速查表

報錯資訊	原因	解決方案
tls: handshake failure	客戶端未提供憑證或憑證無效	檢查客戶端憑證是否正確配置和未過期
certificate signed by unknown authority	CA憑證不匹配	確認客戶端和服務端使用同一CA簽發的憑證
spiffe: workload API unavailable	SPIRE Agent未執行或socket路徑錯誤	檢查SPIRE Agent狀態和socket路徑
SVID not found for SPIFFE ID	服務未註冊到SPIRE	檢查Registration Entry和Selector配置
PeerAuthentication: connection refused	STRICT模式拒絕非mTLS流量	切換為PERMISSIVE模式排查，再改回STRICT
AuthorizationPolicy: RBAC: denied	請求主體不在允許清單中	檢查ServiceAccount和principals配置
casbin: policy enforcement error	Casbin策略檔案格式錯誤	驗證model和policy語法
rate limit exceeded	請求頻率超過限制	調整RateLimit配置或檢查是否有異常流量
context deadline exceeded	後端服務回應逾時	檢查後端服務健康狀態和網路連通性
x509: certificate has expired	憑證已過期	檢查cert-manager是否正常輪換憑證

進階最佳化：5個生產級技巧

技巧1：憑證熱載入。使用tls.Config.GetCertificate動態載入憑證，搭配檔案監聽實作零停機憑證輪換。

技巧2：SPIRE聯邦信任。多叢集場景下，透過SPIRE Federation建立跨叢集信任關係，實作跨叢集mTLS通訊。

技巧3：自適應速率限制。基於後端服務的回應時間和錯誤率動態調整閘道速率限制閾值，而非固定值。

技巧4：零信任可觀測性。在mTLS握手階段注入TraceID，將身份驗證、授權決策、後端呼叫串聯為完整Trace鏈路。

技巧5：策略即程式碼。將零信任策略（PeerAuthentication、AuthorizationPolicy）儲存在Git儲存庫中，透過GitOps自動同步到叢集，實作策略稽覈和回滾。

對比分析

維度	傳統邊界安全	零信任安全
信任模型	內網可信，外網不可信	永不預設信任
認證方式	網路邊界一次認證	每次請求持續驗證
加密範圍	僅外網流量加密	所有流量加密（mTLS）
身份標識	IP位址	SPIFFE ID / Service Identity
授權粒度	網路段級別	服務 + API + 方法級別
憑證管理	手動管理	自動簽發和輪換
橫向移動風險	高（一旦突破邊界）	低（每跳都需驗證）
可觀測性	有限	全鏈路稽覈
實作複雜度	低	高
適用場景	傳統單體應用	雲原生微服務

總結

Go零信任網路架構的5個核心模式構成了完整的微服務安全體系：mTLS提供通訊加密和雙向認證，SPIFFE/SPIRE建立統一身份體系，服務網格實作透明的零信任通訊，持續驗證中介層確保每次請求都經過授權，零信任API閘道集中實施安全策略。

零信任不是一蹴可幾的，建議從mTLS開始，逐步引入SPIFFE身份和持續驗證，最終實作完整的零信任架構。記住：零信任的本質不是不信任，而是用技術手段讓信任可驗證、可稽覈、可撤銷。

線上工具推薦

• /zh-TW/json/format — JSON格式化工具，檢視mTLS憑證和SPIFFE策略配置
• /zh-TW/dev/curl-to-code — cURL轉程式碼，快速產生mTLS客戶端呼叫程式碼
• /zh-TW/encode/hash — 雜湊計算工具，驗證憑證指紋和Token簽章
• /zh-TW/text/diff — 文字對比工具，對比不同版本的零信任策略配置