Applying v2alpha1 APIRule blocks in-cluster communication to the target

[barchw]

Description

Applying v2alpha1 APIRule blocks in-cluster communication to the target, as an AP (AuthorizationPolicy) (action type: ALLOW) is applied in all cases. As logic behind AP blocks all traffic except for a match to the ALLOW AuthorizationPolicy, the internal traffic is blocked unless it is allowed explicitly by a different AP of type ALLOW.

Expected result
Application of v2alpha1 APIRule to a workload should not block in-cluster traffic targeting the workload.

Actual result
Any traffic other than incoming from istio-ingressgateway and matching the APIRule restrictions is blocked.

Steps to reproduce

1. APIGateway module installed

kubectl apply -f https://github.com/kyma-project/istio/releases/latest/download/istio-manager.yaml
kubectl apply -f https://github.com/kyma-project/istio/releases/latest/download/istio-default-cr.yaml

kubectl apply -f https://github.com/kyma-project/api-gateway/releases/latest/download/api-gateway-manager.yaml
kubectl apply -f https://github.com/kyma-project/api-gateway/releases/latest/download/apigateway-default-cr.yaml

2. A target workload present (and Istio injected)

export NAMESPACE_NAME=sidecar-enabled
kubectl create ns ${NAMESPACE_NAME}
kubectl label namespace $NAMESPACE_NAME istio-injection=enabled --overwrite
kubectl -n ${NAMESPACE_NAME} apply -f https://raw.githubusercontent.com/istio/istio/master/samples/httpbin/httpbin.yaml

3. An APIRule created, targeting the workload, handler is irrelevant (can be e.g. noAuth)

apiVersion: gateway.kyma-project.io/v2alpha1
kind: APIRule
metadata:
  name: "httpbin"
  namespace: sidecar-enabled
spec:
  gateway: "kyma-system/kyma-gateway"
  hosts:
    - "httpbin"
  service:
    name: httpbin
    port: 8000
  rules:
    - path: /anything/{**}
      methods: ["GET"]
      noAuth: true

4. Internal traffic to the httpbin pod will be blocked

DoD [Developer & Reviewer]

• Provide unit and integration tests.
• Provide documentation.
• Verify if the solution works for both open-source Kyma and SAP BTP, Kyma runtime.
• If you changed the resource limits, explain why it was needed.
• Verify that your contributions don't decrease code coverage. If they do, explain why this is the case.
• Add release notes.

[mluk-sap]

We discussed it during the refinement:

• let's add AP that allows internal traffic except Ingress controller, like:

apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: allow-internal
  namespace: sidecar-enabled
spec:
  selector:
    matchLabels:
      app: httpbin
  action: ALLOW
  rules:
  - from:
    - source:
        notPrincipals: ["cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account"]