Update Istio Envoy docs to use AuthorizationPolicy instead of EnvoyFilter

[tjons]

Resolves open-policy-agent/opa#5911 by rewriting the quick_start.yaml file to use the Istio AuthorizationPolicy with a CUSTOM authorizer instead of the unstable EnvoyFilter API. I've also added some instructions to the YAML file as a comment on how to register the OPA sidecars as an external authorizer in the meshconfig object.

I'm working on resolving the issues with the Istio e2e tests - the mesh config object needs to be modified directly in this case to register OPA as the external authorizer so I'm figuring out how to automate that in the end-to-end tests

[howardjohn]

LGTM (as an Istio maintainer)

[howardjohn]

Do we need this? if so, why?

[tjons]

nope! unnecessary

[howardjohn]

Suggested change

	apiVersion: networking.istio.io/v1alpha3
	apiVersion: networking.istio.io/v1beta1

nit, both will work

[tjons]

will fix

[howardjohn]

nit: mind be nice to add exportTo: [.] so it doesn't impact other namespaces

[tjons]

👍

[howardjohn]

Not sure the testing setup, but this seems to patch a lot more than what is needed. Maybe thats intended, though

[tjons]

this is intended. I found it impossible to just add the extensionProvider to the mesh config since is a nested yaml object... it doesn't play nicely with kubectl patch even with a json patch. Any thoughts? Otherwise this is just to restore the rest of the default data that is created when we install istio with the demo profile for our CI

[tjons]

@howardjohn addressed your comments - LMK if anything else should be addressed

[ashutosh-narkar]

LGTM. You may have already done this but have you tried these steps manually to ensure everything works end to end?

If you could squash your commits we can get this in.

[tjons]

@ashutosh-narkar yes, have tested manually a bunch of different ways. Squashed and pushed

[ashutosh-narkar]

Thanks @tjons!