feat: added --policy flag to pass policy path and implemented kyverno-json engine

[Sanskarzz]

Added --policy flag to pass the path to the policy
./kyverno-envoy-plugin serve --policy /path/to/policy1.yaml --policy /path/to/policy2.yaml

Also used Load function of this "github.com/kyverno/kyverno-json/pkg/policy" package to load the v1alpha1.ValidatingPolicy type of policies
I also tested ext-authz server with istio , here are the logs of the ext-authz server it seems like policy is successfully loaded in Check function .

Here is policy.yaml i used to check the incoming request

apiVersion: json.kyverno.io/v1alpha1
kind: ValidatingPolicy
metadata:
  name: test-policy
spec:
  rules:
    - name: deny-external-calls
      assert:
        all:
        - message: "The GET method is restricted to the /foo path."
          check:
            request:
                http:
                    method: 'GET'
                    path: '/foo'  
                        

Calling the sample application at /foo

sanskar@sanskar-HP-Laptop-15s-du1xxx:~/kyverno-envoy-plugin$ kubectl run test -it --rm --restart=Never --image=busybox -- wget -q --header="x-ext-authz: allow" --output-document - echo.demo.svc.cluster.local:8080/foo
{
  "path": "/foo",
  "headers": {
    "host": "echo.demo.svc.cluster.local:8080",
    "user-agent": "Wget",
    "x-ext-authz": "allow",
    "x-forwarded-proto": "http",
    "x-request-id": "a260ace6-c612-455b-954b-b7d46c1f3139",
    "x-b3-traceid": "88910ca85982e843e696ba2077efddb3",
    "x-b3-spanid": "e696ba2077efddb3",
    "x-b3-sampled": "0"
  },
  "method": "GET",
  "body": "",
  "fresh": false,
  "hostname": "echo.demo.svc.cluster.local",
  "ip": "::ffff:127.0.0.6",
  "ips": [],
  "protocol": "http",
  "query": {},
  "subdomains": [
    "svc",
    "demo",
    "echo"
  ],
  "xhr": false,
  "os": {
    "hostname": "echo-6847f9f85-zt8nf"
  },
  "connection": {}
}pod "test" deleted

Here are the logs of ext-auth server after calling sample application at /foo

sanskar@sanskar-HP-Laptop-15s-du1xxx:~$ kubectl logs "$(kubectl get pod -l app=ext-authz -n demo -o jsonpath={.items..metadata.name})" -n demo -c ext-authz -f
Starting HTTP server on Port 8000
Starting GRPC server on Port 9000
Request is initialized in kyvernojson engine .
Request passed the policies.

Now calling sample application at /bar

sanskar@sanskar-HP-Laptop-15s-du1xxx:~/kyverno-envoy-plugin$ kubectl run test -it --rm --restart=Never --image=busybox -- wget -q --header="x-ext-authz: allow" --output-document - echo.demo.svc.cluster.local:8080/bar

wget: server returned error: HTTP/1.1 403 Forbidden
pod "test" deleted
pod default/test terminated (Error)

The Request Failed , policy denied the request
Here are the logs of ext-auth after both above requests

sanskar@sanskar-HP-Laptop-15s-du1xxx:~$ kubectl logs "$(kubectl get pod -l app=ext-authz -n demo -o jsonpath={.items..metadata.name})" -n demo -c ext-authz -f
Starting HTTP server on Port 8000
Starting GRPC server on Port 9000
Request is initialized in kyvernojson engine .
Request passed the policies.
Request is initialized in kyvernojson engine .
Request denied with reason: -> The GET method is restricted to the /foo path.
 -> all[0].check.request.http.path: Invalid value: "/bar": Expected value: "/foo"

[anushkamittal2001]

Can you check the linter errors.

[Sanskarzz]

Can you check the linter errors.

The CI is green , Lint error is fixed