[authpolicy-v2] AuthPolicy v1beta2 #249
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov Report
@@ Coverage Diff @@
## main #249 +/- ##
==========================================
+ Coverage 63.42% 64.81% +1.39%
==========================================
Files 33 35 +2
Lines 3204 3806 +602
==========================================
+ Hits 2032 2467 +435
- Misses 999 1147 +148
- Partials 173 192 +19
Flags with carried forward coverage won't be shown. Click here to find out more.
|
|
So far this is looking good. I am not sure if there are verification steps to be carried out right now. |
guicassolato
force-pushed
the
authpolicy-v2
branch
3 times, most recently
from
afa63b1
to
6491b20
Compare
guicassolato
force-pushed
the
authpolicy-v2
branch
3 times, most recently
from
4820025
to
8818edb
Compare
guicassolato
force-pushed
the
authpolicy-v2
branch
from
7101dd3
to
702e821
Compare
maleck13
reviewed
Oct 12, 2023
maleck13
reviewed
Oct 12, 2023
|
changes all look reasonable. Bit unsure as to why RLP changed in the PR though ( I am sure there is a good reason) |
maleck13
approved these changes
Oct 16, 2023
|
/lgtm |
guicassolato
force-pushed
the
authpolicy-v2
branch
2 times, most recently
from
1ba111e
to
856d6d8
Compare
Defines new `v1beta2` version of the `AuthPolicy` CRD, based on Authorino's `AuthConfig/v1beta2`. Closes #247 Depends on Kuadrant/authorino#417, Kuadrant/authorino-operator#137 Bump Authorino to latest (unreleased) version Bump Authorino to latest (unreleased) version Bump Authorino to latest (unreleased) version Update AuthPolicy manifests based on latest AuthConfig v1beta2 changes Bump Authorino to latest (unreleased) version Bump Authorino to latest (unreleased) version
Enables [superseding of strict host subsets](https://github.com/Kuadrant/authorino/blob/main/docs/architecture.md#avoiding-host-name-collision) in Authorino – i.e., set `SupersedingHostSubsets` to `true` in the Authorino CR. Closes #264.
[authpolicy-v2] AuthConfig superseding of strict host subsets
…y) into all Istio AuthorizationPolicy rules that do not include hostnames already built from the route selectors, so we don't send a request to authorino for hosts that are not in the scope of the policy
…Rule and between HTTPRouteRules themselves
…conciling HTTPRoute ones
…entRefs of the route and finds all policies that target one of its parent resources, thus yielding events for those policies.
…sion and HeaderMatchRegularExpression
…or full HTTPRoute only (i.e. ignore config-level conditions)
+ unit tests from Istio AuthorizationPolicy rules from HTTPRouteRules and hostnames
… attached to HTTPRoutes
[authpolicy-v2] Well-known attributes in the generated AuthConfigs
[authpolicy-v2] route selectors
…el up This will pair the level of these policy-wide options to the top-level 'routeSelectors', rather than having two things that have semantics over the same scope defined at different levels in the API. This change also separates the auth scheme, making it now exclusively about auth rules.
[authpolicy-v2] Move AuthPolicy top-level 'patterns' and 'when' fields one level up
* docs: authpolicy v1beta2 * docs: addressing suggestions of enhancements to the authpolicy docs
guicassolato
force-pushed
the
authpolicy-v2
branch
from
ea01fc8
to
4bf902a
Compare
* prevent usage of routeSelectors in a gateway AuthPolicy * AuthPolicy CEL validation rules - Invalid targetRef.group - Invalid targetRef.kind - Route selectors not supported when targeting a Gateway Note: cannot set a validation rule for !has(spec.targetRef.namespace) || spec.targetRef.namespace == metadata.namespace, because Kubernetes does not allow accessing `metadata.namespace`. See https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#validation-rules
didierofrivia
approved these changes
Oct 20, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Base branch for the first chunk of #207.
Closes:
AuthSchemetypes to be based on AuthConfig v1beta2 types #253 → replaces versionv1beta1of theAuthPolicyCRD with newv1beta2(based on Authorino'sAuthConfig/v1beta2)As well as:
routeSelectorsfields to the AuthPolicy #248gateway.networking.k8s.io/policylabel at the AuthPolicy CRD #278targetRef.group/kind,routeSelectorsin gw policies)How to review/verify this PR
make local-setuping this branch and running a user guide such as https://github.com/Kuadrant/kuadrant-operator/blob/authpolicy-v2/doc/user-guides/auth-for-app-devs-and-platform-engineers.md