Istio external authorizer available not only for IstioOperator

[didierofrivia]

This PR aims to fix the registration of our Authorino as an external authorizer using Istio when it's not installed via its Operator.

Closes #168

Notes

• Reconciles also the Istio ConfigMap with the external authorizers
• If the IstioOperator CR returns an error, it continues reconciling CM

Verification Steps

❶ Create a cluster with Gateway API and Istio:

make kind-create-cluster gateway-api-install istioctl

./bin/istioctl install -f config/dependencies/istio/istio-operator.yaml

make deploy-gateway

❷ Deploy Kuadrant dependencies and a local build, then apply its CR:

Create the namespace for kuadrant control plane

kubectl create namespace kuadrant-system 

Then install dependencies and a local kuadrant image

make deploy-dependencies local-deploy

Then apply Kuadrant CR

kubectl -n kuadrant-system apply -f - <<EOF
---
apiVersion: kuadrant.io/v1beta1
kind: Kuadrant
metadata:
  name: kuadrant-sample
spec: {}
EOF

❸ Apply toystore example service and create an HTTPRoute

kubectl apply -f examples/toystore/toystore.yaml

kubectl apply -f - <<EOF
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: HTTPRoute
metadata:
  name: toystore
  labels:
    app: toystore
spec:
  parentRefs:
    - name: istio-ingressgateway
      namespace: istio-system
  hostnames: ["*.toystore.com"]
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: "/toy"
          method: GET
      backendRefs:
        - name: toystore
          port: 80
EOF

❹ Create API Key as Secrets for user Bob

kubectl apply -f -<<EOF
---
apiVersion: v1
kind: Secret
metadata:
  annotations:
    secret.kuadrant.io/user-id: bob
  name: bob-key
  labels:
    authorino.kuadrant.io/managed-by: authorino
    app: toystore
stringData:
  api_key: IAMBOB
type: Opaque
EOF

❺ Apply Authorino AuthPolicy

kubectl apply -f - <<EOF
---
apiVersion: kuadrant.io/v1beta1
kind: AuthPolicy
metadata:
  name: toystore
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: toystore
  rules:
  - paths: ["/toy*"]
  authScheme:
    identity:
    - name: friends
      apiKey:
        allNamespaces: true
        selector:
          matchLabels:
            app: toystore
      credentials:
        in: authorization_header
        keySelector: APIKEY
    response:
    - json:
        properties:
          - name: userID
            value: null
            valueFrom:
              authJSON: auth.identity.metadata.annotations.secret\.kuadrant\.io/user-id
      name: rate-limit-apikey
      wrapper: envoyDynamicMetadata
      wrapperKey: ext_auth_data
EOF

❻ Send requests:

curl -v -H 'Host: api.toystore.com' http://localhost:9080/toy # 401

curl -v -H 'Authorization: APIKEY IAMBOB' -H 'Host: api.toystore.com' http://localhost:9080/toy # 200

TODO:

• Update the unregister function with the new functionality
• Refactor the istio functions into pkg/common
• Tests
• Verification steps

[guicassolato]

Maybe in a next iteration unregisterExternalAuthorizerIstio and unregisterExternalAuthorizerOSSM can become one, and similarly registerExternalAuthorizerIstio and registerExternalAuthorizerOSSM. Fundamentally, and given the new abstractions now introduced with this PR, these pairs of functions are not very different between them – if any different at all.

getIstioConfigObjects could become simply getConfigObjects (or perhaps getGatewayProviderConfigObjects to be more literal with the name), and return all gateway provider config objects that need to be patched.

Istio or OSSM, it doesn't really matter. In the end, it all reduces to iterating over all configs, passing them into the calls to common.UnregisterKuadrantAuthorizer and common.RegisterKuadrantAuthorizer. Thanks to this PR, the details of how to patch each kind of config is decoupled from the caller, but abstracted by each config wrapper itself.

[didierofrivia]

Makes total sense now, I'll keep in mind this for the next refactor, that most possibly will be the plugin way of using GWs

[guicassolato]

Nice job @didierofrivia!

I've left a couple additional comments, which, if you agree, can be addressed in this PR still or in another iteration.

Verification steps succeeded. Additionally, after step ❷:

❯ kubectl get istiooperator/installed-state-istiocontrolplane -n istio-system -o yaml | grep authorino
❯ kubectl get configmap/istio -n istio-system -o yaml | grep authorino
        service: authorino-authorino-authorization.kuadrant-system.svc.cluster.local