Update JWT/JWKS policy validation

[jjngx]

Proposed changes

This PR fixes JWT/JWKS policy validation.

When a user tries to apply JWKS without mandatory keyCache, the policy is rejected:

An example of the invalid policy (missing keyCache):

apiVersion: k8s.nginx.org/v1
kind: Policy
metadata:
  name: jwt-policy
spec:
  jwt:
    realm: MyProductAPI
    token: $http_token
    jwksURI: http://keycloak.default.svc.cluster.local:8080/realms/jwks-example/protocol/openid-connect/certs

kubectl describe policies.k8s.nginx.org jwt-policy
Name:         jwt-policy
Namespace:    default
Labels:       <none>
Annotations:  <none>
API Version:  k8s.nginx.org/v1
Kind:         Policy
Metadata:
  Creation Timestamp:  2023-08-01T13:29:20Z
  Generation:          1
  Resource Version:    19890
  UID:                 39ee839f-f606-45ab-8ffc-8d155d76ad14
Spec:
  Jwt:
    Jwks URI:  http://keycloak.default.svc.cluster.local:8080/realms/jwks-example/protocol/openid-connect/certs
    Realm:     MyProductAPI
    Token:     $http_token
Status:
  Message:  Policy default/jwt-policy is invalid and was rejected: spec.jwt.keyCache: Required value: key cache must be set when using JWKS
  Reason:   Rejected
  State:    Invalid
Events:
  Type     Reason    Age    From                      Message
  ----     ------    ----   ----                      -------
  Warning  Rejected  4m13s  nginx-ingress-controller  Policy default/jwt-policy is invalid and was rejected: spec.jwt.keyCache: Required value: key cache must be set when using JWKS

The same policy but with keyCache set to a valid value 1h:

apiVersion: k8s.nginx.org/v1
kind: Policy
metadata:
  name: jwt-policy
spec:
  jwt:
    realm: MyProductAPI
    token: $http_token
    jwksURI: http://keycloak.default.svc.cluster.local:8080/realms/jwks-example/protocol/openid-connect/certs
    keyCache: 1h

kubectl describe policies.k8s.nginx.org jwt-policy
Name:         jwt-policy
Namespace:    default
Labels:       <none>
Annotations:  <none>
API Version:  k8s.nginx.org/v1
Kind:         Policy
Metadata:
  Creation Timestamp:  2023-08-01T13:29:20Z
  Generation:          2
  Resource Version:    20779
  UID:                 39ee839f-f606-45ab-8ffc-8d155d76ad14
Spec:
  Jwt:
    Jwks URI:   http://keycloak.default.svc.cluster.local:8080/realms/jwks-example/protocol/openid-connect/certs
    Key Cache:  1h
    Realm:      MyProductAPI
    Token:      $http_token
Status:
  Message:  Policy default/jwt-policy was added or updated
  Reason:   AddedOrUpdated
  State:    Valid
Events:
  Type     Reason          Age    From                      Message
  ----     ------          ----   ----                      -------
  Normal   AddedOrUpdated  6s     nginx-ingress-controller  Policy default/jwt-policy was added or updated

Checklist

Before creating a PR, run through this checklist and mark each as complete.

• I have read the CONTRIBUTING doc
• I have added tests that prove my fix is effective or that my feature works
• I have checked that all unit tests pass after adding my changes
• I have updated necessary documentation
• I have rebased my branch onto main
• I will ensure my PR is targeting the main branch and pulling from my branch from my own fork

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Manifest Files

[codecov]

Codecov Report

Merging #4160 (0fcbd23) into main (ce43fba) will increase coverage by 0.04%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##             main    #4160      +/-   ##
==========================================
+ Coverage   51.90%   51.95%   +0.04%     
==========================================
  Files          59       59              
  Lines       16735    16743       +8     
==========================================
+ Hits         8686     8698      +12     
+ Misses       7749     7748       -1     
+ Partials      300      297       -3     

Files Changed	Coverage Δ
pkg/apis/configuration/validation/policy.go	92.80% <100.00%> (-0.12%)	⬇️

... and 3 files with indirect coverage changes

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more