JWT Authentication with service intentions: xds package update

[roncodingenthusiast]

Description

This PR enables envoy config updates when we write jwt providers/intentions. Porting these changes from the enterprise PR

Testing & Reproduction steps

• Startup a consul server with grpc enabled: eg. ./bin/consul agent -dev
• register a service and a proxy: eg. consul services register your-service.hcl your-proxy.hcl
• startup envoy process consul connect envoy -sidecar-for your-service -grpc-addr 127.0.0.1:8502
• Write a jwt provider and intention consul config write provider.hcl intention.hcl
• get an envoy dump: curl "localhost:19000/config_dump?format=json" > test.json
• Look for the jwt_authn config in the http_filters. Should be similar to the *.golden in this PR

# sample provider 

Kind = "jwt-provider"
Name = "okta"


// Issuer is the entity that must have issued the JWT.
Issuer = "auth0"

JSONWebKeySet = {
    Local = {
        JWKS = "eyJrZXlzIjogW3sKICAiY3J2IjogIlAtMjU2IiwKICAia2V5X29wcyI6IFsKICAgICJ2ZXJpZnkiCiAgXSwKICAia3R5IjogIkVDIiwKICAieCI6ICJXYzl1WnVQYUI3S2gyRk1jOXd0SmpSZThYRDR5VDJBWU5BQWtyWWJWanV3IiwKICAieSI6ICI2OGhSVEppSk5Pd3RyaDRFb1BYZVZuUnVIN2hpU0RKX2xtYmJqZkRmV3EwIiwKICAiYWxnIjogIkVTMjU2IiwKICAidXNlIjogInNpZyIsCiAgImtpZCI6ICJhYzFlOGY5MGVkZGY2MWM0MjljNjFjYTA1YjRmMmUwNyIKfV19"
    }
}

sample intention

# Copyright (c) HashiCorp, Inc.

Kind = "service-intentions"
Name = "redis"

JWT = {
  Providers = [
    {
      // Provider must contain the name of an existing jwt-provider.
      Name = "okta"
    }
  ]
}

Sources = [
  {
    Name = "*"
    Action = "allow"
  }
]

proxy-default to enable http mode

Kind = "proxy-defaults"
name = "global"
config {
  protocol = "http"
}

Links

todo

• Follow up with this PR with verifyClaim PR

[kisunji]

Great work! Working in xds is not easy but this looks good.
I had a few blocking comments and general questions

[kisunji]

This should be moved before the for-loop over intentions for the early return

[pglass]

We need to check for len(providers) == 0 following the loop as well, right? For the common case where there are intentions but no intentions contain any JWT requirements.

[kisunji]

Ah yes, thanks for the correction. Maybe this can stay here and simplify to if len(providers) == 0

[roncodingenthusiast]

ah true, i will update it! thank you both

[kisunji]

One more minor comment but LGTM! 👍