[MVP] JWT Istio handler configuration - support for new APIRules

[strekm]

Description

Implement changes in jwt access strategy handler based on Istio CRs. jwt access strategy should support both methods of handling: by creating ORY oathkeeper rule and by creating Istio RA and AP CRs. This version should support only creation of APIRule, transition between handlers is not supported. First version should be implemented as follows:

apiVersion: gateway.kyma-project.io/v1beta1
kind: APIRule
metadata:
  name: service-secured
spec:
  gateway: kyma-system/kyma-gateway
  host: foo.bar
  service:
    name: foo-service
    port: 8080
  rules:
    - path: /headers
      methods: ["GET"]
      mutators: []
      accessStrategies:
        - handler: jwt
          config:
            authentications:
            - issuer: ISSUER
              jwksUri: JWKSURI
            - xxx

config object will contain:

• authentications - required array with at least one element

authentication object will contain:

• issuer - required field (this field is not required for oathkeeper jwt handler)
• jwksUri - required field (this field is required for oathkeeper jwt handler)

This configuration should create following resources:

apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: httpbin
  namespace: foo
spec:
  selector:
    matchLabels:
      app: httpbin
  jwtRules:
  - issuer: ISSUER
    jwksUri: JWKSURI

This configuration should create following AP:

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: httpbin
  namespace: foo
spec:
  selector:
    matchLabels:
      app: httpbin
  rules:
  - from:
    - source:
        requestPrincipals: ["*"]
    to:
    - operation:
        methods: ["GET"]
        paths: ["/headers"]

If FT is disabled oathkeeper handler schema should be valid. If FT is enabled jwt handler schema should be valid.

ACs:

• othkeeper implementation fully supported
• istio implementation supported for defined fields
• istio implementation only applied when feature toggle is enabled
• jwt Istio based handler only supported for new APIRules (transition not supported)
• jwt handler configuration is validated, errors are stored in Status

Reasons

Introducing JWT handler based on Istio.

Attachments

Depends on: #40
Part of: #30

DoD:

• provide documentation
• provide unit tests
• test on SKR
• verify Get started guides
• verify resource limits
• followup issue