Disallow empty AuthPolicies

[guicassolato]

Verification steps

make local-setup

kubectl -n kuadrant-system apply -f - <<EOF
apiVersion: kuadrant.io/v1beta1
kind: Kuadrant
metadata:
  name: kuadrant
spec: {}
EOF

Must all return: The AuthPolicy "gateway-auth" is invalid: spec: Invalid value: "object": At least one spec.rules must be defined

kubectl apply -n gateway-system -f -<<EOF
apiVersion: kuadrant.io/v1
kind: AuthPolicy
metadata:
  name: gateway-auth
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: kuadrant-ingressgateway
EOF

kubectl apply -n gateway-system -f -<<EOF
apiVersion: kuadrant.io/v1
kind: AuthPolicy
metadata:
  name: gateway-auth
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: kuadrant-ingressgateway
  rules: {}
EOF

kubectl apply -n gateway-system -f -<<EOF
apiVersion: kuadrant.io/v1
kind: AuthPolicy
metadata:
  name: gateway-auth
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: kuadrant-ingressgateway
  rules:
    authentication: {}
EOF

Must return: The AuthPolicy "gateway-auth" is invalid: spec: Invalid value: "object": At least one spec.defaults.rules must be defined

kubectl apply -n gateway-system -f -<<EOF
apiVersion: kuadrant.io/v1
kind: AuthPolicy
metadata:
  name: gateway-auth
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: kuadrant-ingressgateway
  defaults: {}
EOF

Must return: The AuthPolicy "gateway-auth" is invalid: spec: Invalid value: "object": At least one spec.overrides.rules must be defined

kubectl apply -n gateway-system -f -<<EOF
apiVersion: kuadrant.io/v1
kind: AuthPolicy
metadata:
  name: gateway-auth
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: kuadrant-ingressgateway
  overrides: {}
EOF

Must all succeed:

kubectl apply -n gateway-system -f -<<EOF
apiVersion: kuadrant.io/v1
kind: AuthPolicy
metadata:
  name: gateway-auth
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: kuadrant-ingressgateway
  rules:
    authentication:
      no-auth:
        anonymous: {}
EOF

kubectl apply -n gateway-system -f -<<EOF
apiVersion: kuadrant.io/v1
kind: AuthPolicy
metadata:
  name: gateway-auth
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: kuadrant-ingressgateway
  rules:
    authorization:
      denyAll:
        opa:
          rego: allow = false
EOF

kubectl apply -n gateway-system -f -<<EOF
apiVersion: kuadrant.io/v1
kind: AuthPolicy
metadata:
  name: gateway-auth
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: kuadrant-ingressgateway
  defaults:
    rules:
      authorization:
        denyAll:
          opa:
            rego: allow = false
EOF

kubectl apply -n gateway-system -f -<<EOF
apiVersion: kuadrant.io/v1
kind: AuthPolicy
metadata:
  name: gateway-auth
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: kuadrant-ingressgateway
  overrides:
    rules:
      authorization:
        denyAll:
          opa:
            rego: allow = false
EOF

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 83.77%. Comparing base (cc1b41f) to head (3c86f02).
Report is 55 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1034      +/-   ##
==========================================
+ Coverage   76.15%   83.77%   +7.62%     
==========================================
  Files         111       81      -30     
  Lines        8986     6694    -2292     
==========================================
- Hits         6843     5608    -1235     
+ Misses       1852      868     -984     
+ Partials      291      218      -73     

Flag	Coverage Δ
bare-k8s-integration	15.70% <ø> (+4.82%)	⬆️
controllers-integration	76.29% <ø> (+17.43%)	⬆️
envoygateway-integration	40.72% <ø> (+8.21%)	⬆️
gatewayapi-integration	16.08% <ø> (+2.64%)	⬆️
istio-integration	43.65% <ø> (+9.32%)	⬆️
unit	18.12% <ø> (-7.24%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
api/v1beta1 (u)	90.00% <100.00%> (-2.19%)	⬇️
api/v1beta2 (u)	∅ <ø> (∅)
pkg/common (u)	∅ <ø> (∅)
pkg/istio (u)	62.06% <ø> (+15.03%)	⬆️
pkg/log (u)	93.18% <ø> (ø)
pkg/reconcilers (u)	24.67% <ø> (∅)
pkg/rlptools (u)	∅ <ø> (∅)
controllers (i)	86.66% <90.18%> (+2.24%)	⬆️

Files with missing lines	Coverage Δ
api/v1/authpolicy_types.go	86.55% <ø> (ø)

... and 38 files with indirect coverage changes

[maleck13]

@guicassolato what is the priority of this in your mind? Is it a must for v1?

[guicassolato]

@guicassolato what is the priority of this in your mind? Is it a must for v1?

I think I replied about this on Slack, but for the record...

This is mainly for consistency with the RateLimitPolicy.

Until then, an AuthPolicy without any rules is reported as not in the path to any existing routes and indeed not enforced. This is not very helpful, especially in face of the defaults otherwise implemented by Authorino for the AuthConfig CRs, where an empty spec falls back to anonymous access.

For Kuadrant, we want policies to be more explicit and contain at least one rule.

[maleck13]

Verified. Changes look good. Shame the validation has to be so complex takes a while when reading it but it is what we have to work with.

/lgtm