Target ref

[dlaw4608]

Using PolicyTargetReference instead of Selector for authpolicy_controller

closes issue : #302

Verification Steps

• Set up an instance of kuadrant and the toystore.

make local-setup
kubectl apply -f examples/toystore/kuadrant.yaml
kubectl apply -f examples/toystore/toystore.yaml

• Create and Apply AuthPolicies

echo "
apiVersion: kuadrant.io/v1beta2
kind: AuthPolicy
metadata:
  name: gw-1
  namespace: istio-system
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: gw-1
  rules:
    authentication:
      api-key-users:
        apiKey:
          selector:
            matchLabels:
              app: toystore
          allNamespaces: true
        credentials:
          authorizationHeader:
            prefix: APIKEY
    response:
      success:
        dynamicMetadata:
          identity:
            json:
              properties:
                userid:
                  selector: auth.identity.metadata.annotations.secret\\.kuadrant\\.io/user-id
---
apiVersion: kuadrant.io/v1beta2
kind: AuthPolicy
metadata:
  name: toystore
  namespace: default
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: toystore
  rules:
    authentication:
      api-key-users:
        apiKey:
          selector:
            matchLabels:
              app: toystore
          allNamespaces: true
        credentials:
          authorizationHeader:
            prefix: TOYSTORE
    response:
      success:
        dynamicMetadata:
          identity:
            json:
              properties:
                userid:
                  selector: auth.identity.metadata.annotations.secret\\.kuadrant\\.io/user-id
" | kubectl apply -f -

• Deploy the Gateway:

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: gw-1
  namespace: istio-system
  annotations:
    kuadrant.io/namespace: kuadrant-system
    networking.istio.io/service-type: ClusterIP
spec:
  gatewayClassName: istio
  listeners:
    - name: apis
      port: 80
      protocol: HTTP
      hostname: '*.io'
      allowedRoutes:
        namespaces:
          from: All
" | kubectl apply -f -

• Create and Apply the Route:

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: toystore
  namespace: default
spec:
  parentRefs:
  - name: gw-1
    namespace: istio-system
  hostnames:
  - api.toystore.io
  rules:
  - matches:
    - path:
        type: Exact
        value: /toy
      method: GET
    backendRefs:
    - name: toystore
      port: 80
" | kubectl apply -f -

• Check the Status of 'AuthPolicy' resources:
  kubectl get authpolicy -A

• Detailed status Verification:
  kubectl get authpolicy -n istio-system gw-1 -o yaml
kubectl get authpolicy -n default toystore -o yaml

• Check events for AuthPolicies:
  kubectl describe authpolicy -n istio-system gw-1
kubectl describe authpolicy -n default toystore

• Should output both of these for each auth-policy

    Target Ref:
    Group:  gateway.networking.k8s.io
    Kind:   Gateway
    Name:   gw-1

    Target Ref:
    Group:  gateway.networking.k8s.io
    Kind:   HTTPRoute
    Name:   toystore

[KevFan]

Followed user guide https://github.com/Kuadrant/kuadrant-operator/blob/main/doc/user-guides/auth-for-app-devs-and-platform-engineers.md and was working as expected 👍

Also checked the target ref of the AuthorizationPolicies

[eguzki]

You need to rebase on top of latest main. That should fix the integration test failing issue