feat: auth policy enforced condition

[KevFan]

Description

Part of #290 Kuadrant/architecture#38
Closes: #349

Add Enforced condition type to AuthPolicy.

Verification

Functionality is generally already tested with the integration tests added.

To verify manually instead:

Setup

• Checkout this branch
• Deploy using make local-setup
• Create HTTPRoute

kubectl apply -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: toystore
spec:
  parentRefs:
  - name: istio-ingressgateway
    namespace: istio-system
  hostnames:
  - api.toystore.com
  rules:
  - matches:
    - method: GET
      path:
        type: PathPrefix
        value: "/toys"
    backendRefs:
    - name: toystore
      port: 80
EOF

• Create AuthPolicy

kubectl apply -f - <<EOF
---
apiVersion: kuadrant.io/v1beta2
kind: AuthPolicy
metadata:
  name: auth0
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: toystore
  rules:
    authorization:
      deny-all:
        opa:
          rego: "allow = false"
    response:
      unauthorized:
        headers:
          "content-type":
            value: application/json
        body:
          value: |
            {
              "error": "Forbidden",
              "message": "Access denied by default by the gateway operator. If you are the administrator of the service, create a specific auth policy for the route."
            }
EOF

• Verify status:
  • Accepted - True
  • Enforced - False

kubectl get authpolicy -A -o wide
kubectl get authpolicy auth0 -o yaml | yq '.status'

• Deploy Kuadrant CR

kubectl apply -f - <<EOF
---                      
apiVersion: kuadrant.io/v1beta1
kind: Kuadrant
metadata:
  name: kuadrant-sample
spec: {}
EOF

• Verify status:
  • Accepted - True
  • Enforced - True

kubectl get authpolicy -A -o wide
kubectl get authpolicy auth0 -o yaml | yq '.status'

[codecov]

Codecov Report

Merging #411 (3b71908) into main (c831a70) will decrease coverage by 0.60%.
The diff coverage is 74.59%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #411      +/-   ##
==========================================
- Coverage   66.18%   65.59%   -0.60%     
==========================================
  Files          38       38              
  Lines        3901     3991      +90     
==========================================
+ Hits         2582     2618      +36     
- Misses       1131     1179      +48     
- Partials      188      194       +6     

Flag	Coverage Δ
integration	70.06% <81.25%> (-1.18%)	⬇️
unit	60.79% <67.24%> (+0.09%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
api/v1beta1 (u)	∅ <ø> (∅)
pkg/common (u)	77.72% <67.24%> (-0.88%)	⬇️
pkg/istio (u)	37.11% <ø> (ø)
pkg/log (u)	31.81% <ø> (ø)
pkg/reconcilers (u)	33.44% <ø> (ø)
pkg/rlptools (u)	56.46% <ø> (ø)
controllers (i)	70.06% <81.25%> (-1.18%)	⬇️

Files	Coverage Δ
api/v1beta2/authpolicy_types.go	70.83% <ø> (ø)
api/v1beta2/ratelimitpolicy_types.go	17.24% <ø> (ø)
controllers/authpolicy_authconfig.go	66.66% <100.00%> (+0.35%)	⬆️
controllers/authpolicy_controller.go	78.66% <100.00%> (ø)
pkg/common/errors.go	100.00% <100.00%> (ø)
controllers/authpolicy_status.go	86.17% <79.66%> (-7.28%)	⬇️
pkg/common/apimachinery_status_conditions.go	68.85% <52.50%> (-31.15%)	⬇️

... and 6 files with indirect coverage changes

[guicassolato]

Verification steps work as expected 🎉

After the last step, I've added:

kubectl apply -f - <<EOF
apiVersion: kuadrant.io/v1beta2
kind: AuthPolicy
metadata:
  name: gw-auth
  namespace: istio-system
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: istio-ingressgateway
  rules:
    authorization:
      allow-all:
        opa:
          rego: "allow = true"
EOF

Then:

kubectl get authpolicy -A -o wide

NAMESPACE      NAME      ACCEPTED   ENFORCED   TARGETREFKIND   TARGETREFNAME          AGE
default        auth0     True       True       HTTPRoute       toystore               19m
istio-system   gw-auth   True       False      Gateway         istio-ingressgateway   7s

kubectl get authpolicy gw-auth -n istio-system -o yaml | yq '.status'

conditions:
  - lastTransitionTime: "2024-02-13T13:23:05Z"
    message: AuthPolicy has been accepted
    reason: Accepted
    status: "True"
    type: Accepted
  - lastTransitionTime: "2024-02-13T13:23:05Z"
    message: AuthPolicy is overridden by [{"Namespace":"default","Name":"auth0"}]
    reason: Overridden
    status: "False"
    type: Enforced
observedGeneration: 1

kubectl delete authpolicy auth0

kubectl get authpolicy -A -o wide

NAMESPACE      NAME      ACCEPTED   ENFORCED   TARGETREFKIND   TARGETREFNAME          AGE
istio-system   gw-auth   True       True       Gateway         istio-ingressgateway   3m37s

kubectl get authpolicy gw-auth -n istio-system -o yaml | yq '.status'

conditions:
  - lastTransitionTime: "2024-02-13T13:23:05Z"
    message: AuthPolicy has been accepted
    reason: Accepted
    status: "True"
    type: Accepted
  - lastTransitionTime: "2024-02-13T13:26:34Z"
    message: AuthPolicy has been successfully enforced
    reason: Enforced
    status: "True"
    type: Enforced
observedGeneration: 1

[guicassolato]

Though the title says "auth policy", it's good to have this here as well, for completeness 👍

[guicassolato]

nitpick: I fail to see the logic behind how we group these dependencies. Maybe in another PR we can work on this and give them some order people can reason about. E.g. Kuadrant-controlled packages always grouped together, or layered based on proximity to the Golang std lib.

[KevFan]

Yeah, grouping is inconsistent in a few places. I think the main reason, at least for me, for this inconsistency is that these are frequently auto added by an IDE but ignores the groups that have been already been logically broken up previously. Goland IDE seems to always auto add a dependency to the first group list after the Golang std libs 🤔

[mikenairn]

fyi, i had opened a PR to add the openshift goimports to keep module grouping consistent #415. Backed it out as we seem to already use goimports in CI tests, but maybe we could look into it more.

[KevFan]

+1

[KevFan]

Created #426 to track this

[guicassolato]

Nice job!

I've tested it again after last refactoring and still working perfectly fine.