Do/auth policy status

[Boomatang]

Closes: #466

Verification

• Set up local cluster.

make local-setup

• Install kuadrant, toystore and route authPolicy

echo "  
apiVersion: kuadrant.io/v1beta1
kind: Kuadrant
metadata:
  name: kuadrant
  namespace: kuadrant-system
spec: {}
" | kubectl apply -f -
kubectl apply -f examples/toystore/toystore.yaml
echo "
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: toystore
spec:
  parentRefs:
  - name: istio-ingressgateway
    namespace: istio-system
  hostnames:
  - api.toystore.com
  rules:
  - matches:
    - path:
        type: Exact
        value: "/toy"
      method: GET
    backendRefs:
    - name: toystore
      port: 80
" | kubectl apply -f -
echo "
apiVersion: kuadrant.io/v1beta2
kind: AuthPolicy
metadata:
  name: toystore
  namespace: default
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: toystore
  rules:
    authentication:
      "api-key-users":
        apiKey:
          selector:
            matchLabels:
              app: toystore
          allNamespaces: true
        credentials:
          authorizationHeader:
            prefix: TOYSTORE
    response:
      success:
        dynamicMetadata:
          "identity":
            json:
              properties:
                "userid":
                  selector: auth.identity.metadata.annotations.secret\.kuadrant\.io/user-id
" | kubectl apply -f - 

• Check the Enforced status of the authPolicy. Expected status True.

kubectl get authpolicy toystore -n default -o=jsonpath='{.status.conditions[?(@.type=="Enforced")]}{"\\n"}' | jq

• Apply gateway Authpolicy with override.

echo "
apiVersion: kuadrant.io/v1beta2
kind: AuthPolicy
metadata:
  name: gateway
  namespace: istio-system
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: istio-ingressgateway
  overrides:
    rules:
      authentication:
        "api-key-users":
          apiKey:
            selector:
              matchLabels:
                app: toystore
            allNamespaces: true
          credentials:
            authorizationHeader:
              prefix: APIKEY
      response:
        success:
          dynamicMetadata:
            "identity":
              json:
                properties:
                  "userid":
                    selector: auth.identity.metadata.annotations.secret\.kuadrant\.io/user-id
" | kubectl apply -f -

• Check the Enforced status of the authPolicy. Expected status Fasle, reason of Overridden and gateway authPolicy to be listed in the massage.

kubectl get authpolicy toystore -n default -o=jsonpath='{.status.conditions[?(@.type=="Enforced")]}{"\\n"}' | jq

[KevFan]

Verified, code looks good to me. An addition that would be nice would be to update the override integration tests to test for the override message in the status