�结果可以在代理调试日志中找到，格式为
<code>shadow denied, matched policy ns[foo]-policy[deny-path-headers]-rule[0]</code>。
运行以下命令检查日志：</p><pre><code class=language-bash data-expandlinks=true data-repo=istio>$ kubectl logs &#34;$(kubectl -n foo -l app=httpbin get pods -o jsonpath={.items..metadata.name})&#34; -c istio-proxy -n foo | grep &#34;shadow denied&#34;
2021-11-19T20:20:48.733099Z debug envoy rbac shadow denied, matched policy ns[foo]-policy[deny-path-header