EXP: Support E/W authorization (GEP-3779)

[LiorLieberman]

Sponsors:
None yet

What would you like to be added:
A new API to support E/W Authorization.

Why this is needed:

East/West (E/W) authorization is a critical part of any service mesh. To ensure GAMMA can be used as a standalone solution by a broad user base, it must include some form of E/W authorization.

Most (if not all) meshes today provide this functionality, some examples:

• Istio - https://istio.io/latest/docs/reference/config/security/authorization-policy/
• Linkerd - https://linkerd.io/2-edge/reference/authorization-policy/
• Kuma - https://docs.konghq.com/mesh/latest/policies/meshtrafficpermission/

[youngnick]

I think the most difficult problem here is going to be defining the principals in Gateway API terms. You can't have a standard GAMMA policy referring to principals that aren't also defined in GAMMA. So the most important part here is going to be defining what these authorization policies are actually acting on.

[robscott]

I think the most difficult problem here is going to be defining the principals in Gateway API terms. You can't have a standard GAMMA policy referring to principals that aren't also defined in GAMMA. So the most important part here is going to be defining what these authorization policies are actually acting on.

Agreed. In the past we've talked about tying these to Kubernetes Service Accounts, would that make sense to you?

[youngnick]

Oh, right, of course. That would be okay.

[shaneutt]

This feature has been accepted for the v1.4.0 release. Please see this announcement for more details, and for the timing expectations for transitions. Note that if the timeline can not be met, there is a risk that this feature may unfortunately need to be dropped from the release. If you have any questions, concerns, or are in need of support please reach out to the maintainers so we can assist you!

Note: This feature only currently has one reviewer assigned (@robscott) to help ensure things move along smoothly, we recommend you reach out and get a commitment from at least one more reviewer to support the iterations on this feature.