waypoint bypass detection and authz skip

[stevenctl]

An alternative to istio/istio#50475.

if has_waypoint && !from_waypoint {
  deny();
else if !has_waypoint {
  check_rbac();
}

We had a similar check in the past. One key difference in this version is that has_waypoint and from_waypoint checks both the destination workload and all it's services for waypoint attachment.

[stevenctl]

Copying this to Endpoint saves us a lot of Workload lookups.

[louiscryan]

I think we want the following

if is_mesh_traffic {
  if has_waypoint { 
     if from_waypoint {
       allow();
     } else if src_can_skip_waypoint {  #skip waypoint API TBD
       check_rbac();
     } else {
       deny("must go through waypoint")
     }
  } else {
    check_rbac();
  }
} else {
  check_permissive();
} 

I've included a hypothetical future 'skip-waypoint' API which I think will be useful, particularly to enable something like ingress which may systematically skip waypoints but for which we have not done design work.

I think the above (or the original) make it clear that authz is delegated to the waypoint when one is used by a workload. This lines up conceptually with how the APIs and compositional patterns are defined so I think this is overall good and better than the 'defaultAllow' alternatives. Its also pretty similar to the code that was there before so its not that disruptive.

[istio-testing]

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[howardjohn]

@stevenctl this is obsolete now, right?