Sync changes from OIDC repo, add field in policy

[lucacome]

Syncs changes from https://github.com/nginxinc/nginx-openid-connect fixing a couple of bugs.

[codecov-commenter]

Codecov Report

Merging #2654 (a081f09) into main (85e3c6e) will increase coverage by 0.06%.
The diff coverage is 45.51%.

@@            Coverage Diff             @@
##             main    #2654      +/-   ##
==========================================
+ Coverage   53.43%   53.49%   +0.06%     
==========================================
  Files          52       52              
  Lines       14696    14744      +48     
==========================================
+ Hits         7853     7888      +35     
- Misses       6581     6594      +13     
  Partials      262      262              

Impacted Files	Coverage Δ
cmd/nginx-ingress/main.go	6.81% <0.00%> (-0.05%)	⬇️
internal/configs/annotations.go	21.56% <0.00%> (ø)
internal/configs/config_params.go	76.74% <ø> (ø)
internal/configs/version2/http.go	0.00% <ø> (ø)
internal/k8s/spiffe.go	0.00% <0.00%> (ø)
internal/k8s/utils.go	11.76% <ø> (ø)
internal/metrics/collectors/latency.go	49.66% <ø> (ø)
internal/metrics/collectors/processes.go	0.00% <0.00%> (ø)
internal/nginx/fake_manager.go	0.00% <ø> (ø)
internal/configs/configurator.go	37.70% <10.00%> (+0.25%)	⬆️
... and 11 more

📣 Codecov can now indicate which changes are the most critical in Pull Requests. Learn more

[pleshakov]

There is a mismatch here. The documentation says the type is string, but the golang type is ZoneSyncLeeway *int

Additionally, the doc says 0s is the default, but this is an illegal value for an int.

I suggest using string as a golang type, as most of the other time-related fields use it (please see timeout-related fields in https://docs.nginx.com/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/ ). This way the new field will be consistent with the existing fields. For example:

zoneSyncLeeway: 500ms

[lucacome]

I made a mistake in the doc here. The value is not time in ms like in the nginx config, it's an integer that is passed to the javascript function to calculate the time.

[pleshakov]

From the documentation it is not clear why this field is needed, what problem it solves? Could we add that? For example, the doc could answer the following questions:

• when it is necessary to enable this field (for example, when what errors/conditions clients see or admins see an error in the logs)
• what values to use, how to pick the value
• what the downsides of enabling that field

Additionally, based on the description here nginxinc/nginx-openid-connect@bd4e9cb#diff-512d27cf176962c2b1cffd370bbd1adba80368558ad4aaa2a6255eea9ff453bdR47-R53 , would it make sense to make the default non-zero? Because with the Ingress Controller, it is usually at least 2 replicas of it running in a cluster with a load balancer in front them.