[authpolicy-v2] AuthPolicy validation rules

[guicassolato]

• Prevent usage of routeSelectors in a gateway AuthPolicy (enforced at reconciliation time)
• AuthPolicy validation rules using Common Language Expression (CEL) (enforced at the level of the API)
  • Invalid targetRef.group
  • Invalid targetRef.kind
  • Route selectors not supported when targeting a Gateway
  • Note: cannot set a validation rule for !has(spec.targetRef.namespace) || spec.targetRef.namespace == metadata.namespace, because Kubernetes does not allow accessing metadata.namespace (ref)
  • Note: kubebuilder currently does not support other validation rules fields such as reason and fieldPath that would allow improving error messages

Verification steps

❶ Setup

make local-setup

kubectl -n kuadrant-system apply -f - <<EOF
apiVersion: kuadrant.io/v1beta1
kind: Kuadrant
metadata:
  name: kuadrant
spec: {}
EOF

kubectl apply -f examples/toystore/toystore.yaml

kubectl apply -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: toystore
spec:
  parentRefs:
  - name: istio-ingressgateway
    namespace: istio-system
  hostnames:
  - api.toystore.com
  rules:
  - matches:
    - method: GET
      path:
        type: PathPrefix
        value: "/cars"
    - method: GET
      path:
        type: PathPrefix
        value: "/dolls"
    backendRefs:
    - name: toystore
      port: 80
  - matches:
    - path:
        type: PathPrefix
        value: "/admin"
    backendRefs:
    - name: toystore
      port: 80
EOF

❷ AuthPolicies

kubectl apply -f -<<EOF
# The AuthPolicy "gw-auth-1" is invalid: spec.targetRef: Invalid value: "object": Invalid targetRef.group. The only supported value is 'gateway.networking.k8s.io'
apiVersion: kuadrant.io/v1beta2
kind: AuthPolicy
metadata:
  name: gw-auth-1
  namespace: istio-system
spec:
  targetRef:
    group: networking.istio.io # invalid
    kind: Gateway
    name: istio-ingressgateway
  rules:
    authorization:
      deny-all:
        opa:
          rego: "allow = false"
    response:
      unauthorized:
        headers:
          "content-type":
            value: application/json
        body:
          value: |
            {
              "error": "Forbidden",
              "message": "Access denied by default by the gateway operator. If you are the administrator of the service, create a specific auth policy for the route."
            }
---
# The AuthPolicy "gw-auth-2" is invalid: spec.targetRef: Invalid value: "object": Invalid targetRef.kind. The only supported values are 'HTTPRoute' and 'Gateway'
apiVersion: kuadrant.io/v1beta2
kind: AuthPolicy
metadata:
  name: gw-auth-2
  namespace: istio-system
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Service # invalid
    name: istio-ingressgateway
  rules:
    authorization:
      deny-all:
        opa:
          rego: "allow = false"
    response:
      unauthorized:
        headers:
          "content-type":
            value: application/json
        body:
          value: |
            {
              "error": "Forbidden",
              "message": "Access denied by default by the gateway operator. If you are the administrator of the service, create a specific auth policy for the route."
            }
---
# The AuthPolicy "gw-auth-3" is invalid: spec: Invalid value: "object": route selectors not supported when targeting a Gateway
apiVersion: kuadrant.io/v1beta2
kind: AuthPolicy
metadata:
  name: gw-auth-3
  namespace: istio-system
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: istio-ingressgateway
  routeSelectors: # invalid
  - hostnames: ["api.toystore.com"]
  rules:
    authorization:
      deny-all:
        opa:
          rego: "allow = false"
    response:
      unauthorized:
        headers:
          "content-type":
            value: application/json
        body:
          value: |
            {
              "error": "Forbidden",
              "message": "Access denied by default by the gateway operator. If you are the administrator of the service, create a specific auth policy for the route."
            }
---
# The AuthPolicy "gw-auth-4" is invalid: spec: Invalid value: "object": route selectors not supported when targeting a Gateway
apiVersion: kuadrant.io/v1beta2
kind: AuthPolicy
metadata:
  name: gw-auth-4
  namespace: istio-system
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: istio-ingressgateway
  rules:
    authorization:
      deny-all:
        opa:
          rego: "allow = false"
        routeSelectors: # invalid
        - hostnames: ["api.toystore.com"]
    response:
      unauthorized:
        headers:
          "content-type":
            value: application/json
        body:
          value: |
            {
              "error": "Forbidden",
              "message": "Access denied by default by the gateway operator. If you are the administrator of the service, create a specific auth policy for the route."
            }
---
# authpolicy.kuadrant.io/gw-auth-5 created
apiVersion: kuadrant.io/v1beta2
kind: AuthPolicy
metadata:
  name: gw-auth-5
  namespace: istio-system
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: istio-ingressgateway
  rules:
    authorization:
      deny-all:
        opa:
          rego: "allow = false"
    response:
      unauthorized:
        headers:
          "content-type":
            value: application/json
        body:
          value: |
            {
              "error": "Forbidden",
              "message": "Access denied by default by the gateway operator. If you are the administrator of the service, create a specific auth policy for the route."
            }
---
# authpolicy.kuadrant.io/toystore created
apiVersion: kuadrant.io/v1beta2
kind: AuthPolicy
metadata:
  name: toystore
  namespace: default
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: toystore
  rules:
    authentication:
      "api-key-authn":
        apiKey:
          selector: {}
        credentials:
          authorizationHeader:
            prefix: APIKEY
    authorization:
      "only-admins":
        opa:
          rego: |
            groups := split(object.get(input.auth.identity.metadata.annotations, "kuadrant.io/groups", ""), ",")
            allow { groups[_] == "admins" }
        routeSelectors:
        - matches:
          - path:
              type: PathPrefix
              value: "/admin"
EOF

Expected:

authpolicy.kuadrant.io/gw-auth-5 created
authpolicy.kuadrant.io/toystore created
AuthPolicy.kuadrant.io "gw-auth-1" is invalid: spec.targetRef: Invalid value: "object": Invalid targetRef.group. The only supported value is 'gateway.networking.k8s.io'
AuthPolicy.kuadrant.io "gw-auth-2" is invalid: spec.targetRef: Invalid value: "object": Invalid targetRef.kind. The only supported values are 'HTTPRoute' and 'Gateway'
AuthPolicy.kuadrant.io "gw-auth-3" is invalid: spec: Invalid value: "object": route selectors not supported when targeting a Gateway
AuthPolicy.kuadrant.io "gw-auth-4" is invalid: spec: Invalid value: "object": route selectors not supported when targeting a Gateway

[codecov]

Codecov Report

Merging #281 (20d3ea3) into authpolicy-v2 (4bf902a) will increase coverage by 0.75%.
The diff coverage is 83.33%.

@@                Coverage Diff                @@
##           authpolicy-v2     #281      +/-   ##
=================================================
+ Coverage          64.03%   64.79%   +0.75%     
=================================================
  Files                 35       35              
  Lines               3776     3806      +30     
=================================================
+ Hits                2418     2466      +48     
+ Misses              1164     1148      -16     
+ Partials             194      192       -2     

Flag	Coverage Δ
integration	70.53% <ø> (+0.59%)	⬆️
unit	58.20% <83.33%> (+1.06%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
api/v1beta1 (u)	∅ <ø> (∅)
pkg/common (u)	73.92% <ø> (ø)
pkg/istio (u)	30.24% <ø> (ø)
pkg/log (u)	31.81% <ø> (ø)
pkg/reconcilers (u)	33.68% <ø> (ø)
pkg/rlptools (u)	56.41% <ø> (ø)
controllers (i)	70.53% <ø> (+0.59%)	⬆️

Files	Coverage Δ
api/v1beta2/authpolicy_types.go	77.57% <83.33%> (+16.53%)	⬆️

... and 5 files with indirect coverage changes

[adam-cattermole]

minor typo but the verification passed and the code looks good to me!