feat: accepted policy status condition

[KevFan]

Description

Part of Kuadrant/architecture#38

Implements the Accepted Status Condition to RateLimitPolicy and AuthPolicy

Verfication

Functionality is generally already tested with the integration tests added.

To verify manually instead:

Setup

• Checkout this branch
• Deploy using make local-setup
• Create HTTPRoute

kubectl apply -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: toystore
spec:
  parentRefs:
  - name: istio-ingressgateway
    namespace: istio-system
  hostnames:
  - api.toystore.com
  rules:
  - matches:
    - method: GET
      path:
        type: PathPrefix
        value: "/toys"
    backendRefs:
    - name: toystore
      port: 80
EOF

AuthPolicy

• Create AuthPolicies

kubectl apply -f - <<EOF
# Accepted
---
apiVersion: kuadrant.io/v1beta2
kind: AuthPolicy
metadata:
  name: auth0
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: toystore
  rules:
    authorization:
      deny-all:
        opa:
          rego: "allow = false"
    response:
      unauthorized:
        headers:
          "content-type":
            value: application/json
        body:
          value: |
            {
              "error": "Forbidden",
              "message": "Access denied by default by the gateway operator. If you are the administrator of the service, create a specific auth policy for the route."
            }
---
# Conflict
apiVersion: kuadrant.io/v1beta2
kind: AuthPolicy
metadata:
  name: auth1
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: toystore
  rules:
    authorization:
      deny-all:
        opa:
          rego: "allow = false"
    response:
      unauthorized:
        headers:
          "content-type":
            value: application/json
        body:
          value: |
            {
              "error": "Forbidden",
              "message": "Access denied by default by the gateway operator. If you are the administrator of the service, create a specific auth policy for the route."
            }
---
# target not found
apiVersion: kuadrant.io/v1beta2
kind: AuthPolicy
metadata:
  name: auth2
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: istio-ingressgateway-not-found
  rules:
    authorization:
      deny-all:
        opa:
          rego: "allow = false"
    response:
      unauthorized:
        headers:
          "content-type":
            value: application/json
        body:
          value: |
            {
              "error": "Forbidden",
              "message": "Access denied by default by the gateway operator. If you are the administrator of the service, create a specific auth policy for the route."
            }
---
# invalid
apiVersion: kuadrant.io/v1beta2
kind: AuthPolicy
metadata:
  name: auth3
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: istio-ingressgateway
    namespace: istio-system
  rules:
    authorization:
      deny-all:
        opa:
          rego: "allow = false"
    response:
      unauthorized:
        headers:
          "content-type":
            value: application/json
        body:
          value: |
            {
              "error": "Forbidden",
              "message": "Access denied by default by the gateway operator. If you are the administrator of the service, create a specific auth policy for the route."
            }
EOF

• Verify accepted condition status is as expected

kubectl get authpolicies -n default -o yaml | yq '.items[].status'

Sample Output

conditions:
  - lastTransitionTime: "2023-12-14T17:25:00Z"
    message: AuthPolicy has been accepted
    reason: Accepted
    status: "True"
    type: Accepted
observedGeneration: 2
conditions:
  - lastTransitionTime: "2023-12-14T17:25:00Z"
    message: 'AuthPolicy is conflicted by default/auth0: the gateway.networking.k8s.io/v1, Kind=HTTPRoute target default/toystore is already referenced by policy default/auth0'
    reason: Conflicted
    status: "False"
    type: Accepted
observedGeneration: 2
conditions:
  - lastTransitionTime: "2023-12-14T17:25:00Z"
    message: AuthPolicy target istio-ingressgateway-not-found was not found
    reason: TargetNotFound
    status: "False"
    type: Accepted
observedGeneration: 1
conditions:
  - lastTransitionTime: "2023-12-14T17:25:00Z"
    message: 'AuthPolicy target is invalid: invalid targetRef.Namespace istio-system. Currently only supporting references to the same namespace'
    reason: Invalid
    status: "False"
    type: Accepted
observedGeneration: 2

RateLimitPolicy

• Create RateLimitPolicies

kubectl apply -f - <<EOF
---
# Accepted
apiVersion: kuadrant.io/v1beta2                                                                                                                          
kind: RateLimitPolicy
metadata:                
  name: rlp0
spec:   
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: toystore
  limits:   
    "create-toy":
      rates:
      - limit: 5
        duration: 10
        unit: second
---
# Conflict
apiVersion: kuadrant.io/v1beta2                                                                                                                          
kind: RateLimitPolicy
metadata:                
  name: rlp1
spec:   
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: toystore
  limits:   
    "create-toy":
      rates:
      - limit: 5
        duration: 10
        unit: second
---
# Target not found
apiVersion: kuadrant.io/v1beta2                                                                                                                          
kind: RateLimitPolicy
metadata:                
  name: rlp2
spec:   
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: istio-ingressgateway-not-found
  limits:   
    "create-toy":
      rates:
      - limit: 5
        duration: 10
        unit: second
---
# invalid
apiVersion: kuadrant.io/v1beta2                                                                                                                          
kind: RateLimitPolicy
metadata:                
  name: rlp3
spec:   
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: istio-ingressgateway
    namespace: istio-system
  limits:   
    "create-toy":
      rates:
      - limit: 5
        duration: 10
        unit: second
EOF

• Verifiy RateLimitPolicy accepted condition is as expected

 kubectl get ratelimitpolicies -n default -o yaml | yq '.items[].status'

Sample Output

conditions:
  - lastTransitionTime: "2023-12-14T17:38:13Z"
    message: RateLimitPolicy has been accepted
    reason: Accepted
    status: "True"
    type: Accepted
observedGeneration: 1
conditions:
  - lastTransitionTime: "2023-12-14T17:38:13Z"
    message: 'RateLimitPolicy is conflicted by default/rlp0: the gateway.networking.k8s.io/v1, Kind=HTTPRoute target default/toystore is already referenced by policy default/rlp0'
    reason: Conflicted
    status: "False"
    type: Accepted
observedGeneration: 4
conditions:
  - lastTransitionTime: "2023-12-14T17:38:39Z"
    message: RateLimitPolicy target istio-ingressgateway-not-found was not found
    reason: TargetNotFound
    status: "False"
    type: Accepted
observedGeneration: 1
conditions:
  - lastTransitionTime: "2023-12-14T17:38:39Z"
    message: 'RateLimitPolicy target is invalid: invalid targetRef.Namespace istio-system. Currently only supporting references to the same namespace'
    reason: Invalid
    status: "False"
    type: Accepted

[codecov]

Codecov Report

Merging #347 (6874ca6) into main (94683a2) will increase coverage by 0.47%.
The diff coverage is 89.36%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #347      +/-   ##
==========================================
+ Coverage   65.01%   65.48%   +0.47%     
==========================================
  Files          35       37       +2     
  Lines        3796     3842      +46     
==========================================
+ Hits         2468     2516      +48     
- Misses       1132     1135       +3     
+ Partials      196      191       -5     

Flag	Coverage Δ
integration	70.36% <81.48%> (+0.01%)	⬆️
unit	60.14% <92.53%> (+1.23%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
api/v1beta1 (u)	∅ <ø> (∅)
pkg/common (u)	78.59% <100.00%> (+1.67%)	⬆️
pkg/istio (u)	37.11% <ø> (ø)
pkg/log (u)	31.81% <ø> (ø)
pkg/reconcilers (u)	33.44% <66.66%> (+0.22%)	⬆️
pkg/rlptools (u)	56.46% <ø> (ø)
controllers (i)	70.36% <81.48%> (+0.01%)	⬆️

Files	Coverage Δ
controllers/authpolicy_status.go	93.44% <100.00%> (-1.01%)	⬇️
controllers/ratelimitpolicy_status.go	97.43% <100.00%> (-0.68%)	⬇️
pkg/common/apimachinery_status_conditions.go	100.00% <100.00%> (ø)
pkg/common/common.go	88.39% <ø> (ø)
pkg/common/errors.go	100.00% <100.00%> (ø)
pkg/common/test_utils.go	100.00% <100.00%> (ø)
pkg/reconcilers/targetref_reconciler.go	31.05% <66.66%> (+0.36%)	⬆️
api/v1beta2/authpolicy_types.go	70.83% <0.00%> (-2.03%)	⬇️
api/v1beta2/ratelimitpolicy_types.go	17.24% <0.00%> (-0.62%)	⬇️
controllers/authpolicy_controller.go	76.66% <80.00%> (+2.69%)	⬆️
... and 1 more

... and 3 files with indirect coverage changes

[maleck13]

@sergioifg94 FYI

[KevFan]

Some integration tests based on istioctl is currently broken due to #371

This has been merged to main

[sergioifg94]

Code changes look good, haven't verified yet, just had one tiny optional suggestion for the AuthPolicy controller test

[guicassolato]

Tested with make local-setup ISTIO_INSTALL_SAIL=false while #380 is not merged.

❯ kubectl get authpolicies -n default -o wide
NAME    STATUS           TARGETREFKIND   TARGETREFNAME                    AGE
auth0   Accepted         HTTPRoute       toystore                         3m31s
auth1   Conflicted       HTTPRoute       toystore                         3m31s
auth2   TargetNotFound   Gateway         istio-ingressgateway-not-found   3m31s
auth3   Invalid          Gateway         istio-ingressgateway             3m31s

❯  kubectl get ratelimitpolicies -n default -o wide
NAME   STATUS           TARGETREFKIND   TARGETREFNAME                    AGE
rlp0   Accepted         HTTPRoute       toystore                         36s
rlp1   Conflicted       HTTPRoute       toystore                         36s
rlp2   TargetNotFound   Gateway         istio-ingressgateway-not-found   36s
rlp3   Invalid          Gateway         istio-ingressgateway             36s

---

Good job!

[KevFan]

Just rebased with latest changes from main

[didierofrivia]

Most of the current failed tests are failing because of checking the ConfigMap holding the istioctl config, but I don't see any changes here affecting that directly... let me know and I could inspect the tests a bit more thoroughly.

[KevFan]

Rebased with main containing #391