APIProduct controller: Discovered authscheme

[eguzki]

What

Requirement for Kuadrant/kuadrant-backstage-plugin#150

The AuthPolicyDiscovered condition is ok when there is an auth policy either targeting the targeted route or targeting any gateway parent of the targeted route.

Note: missing implementation for default&override semantics

Verification steps

dev setup

make kind-create-cluster
make install
make gateway-api-install
make kuadrant-core-install

Deploy apiproduct controller

make local-deploy

Create gateway and httproute

kubectl create ns gateway-system

kubectl apply -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: my-gateway
  namespace: gateway-system
spec:
  gatewayClassName: istio
  listeners:
  - name: http
    protocol: HTTP
    port: 80
    hostname: "example.com"
    allowedRoutes:
      namespaces:
        from: All
EOF

kubectl create ns toystore

kubectl apply -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: my-route
  namespace: toystore
spec:
  hostnames:
    - example.com
  parentRefs:
    - name: my-gateway
      namespace: gateway-system
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: "/"
      backendRefs:
        - name: toystore
          port: 80
EOF

cat <<EOF >route-status-patch.yaml
status:
  parents:
    - controllerName: istio.io/gateway-controller
      conditions:
        - lastTransitionTime: "2025-09-03T19:16:16Z"
          message: Route was valid
          observedGeneration: 1
          reason: Accepted
          status: "True"
          type: Accepted
      parentRef:
        group: gateway.networking.k8s.io
        kind: Gateway
        name: my-gateway
        namespace: gateway-system
EOF

kubectl patch httproute my-route --type=merge --patch "$(cat route-status-patch.yaml)" --subresource status -n toystore
rm route-status-patch.yaml

Create authPolicy targeting the route

kubectl apply -f - <<EOF
apiVersion: kuadrant.io/v1
kind: AuthPolicy
metadata:
  name: toystore-auth
  namespace: toystore
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: my-route
  rules:
    authentication:
      "api-key-users":
        apiKey:
          selector:
            matchLabels:
              app: toystore
        credentials:
          authorizationHeader:
            prefix: APIKEY
EOF

Create apiproduct

kubectl apply -f - <<EOF
apiVersion: devportal.kuadrant.io/v1alpha1
kind: APIProduct
metadata:
  name: toystore-api
  namespace: toystore
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: my-route
  displayName: Toystore API
  description: Manage toy inventory
  approvalMode: manual
  publishStatus: Published
EOF

Verify discovered authpolicy scheme in the status of the APIProduct object

kubectl get apiproduct toystore-api -o jsonpath='{.status}' -n toystore| yq e -P

The expected result is

conditions:
  - lastTransitionTime: "2025-12-09T14:39:46Z"
    message: PlanPolicy not found
    reason: NotFound
    status: "False"
    type: PlanPolicyDiscovered
  - lastTransitionTime: "2025-12-09T14:39:46Z"
    message: Discovered AuthPolicy toystore-auth targeting HTTPRoute my-route
    reason: Found
    status: "True"
    type: AuthPolicyDiscovered
  - lastTransitionTime: "2025-12-09T14:39:46Z"
    message: HTTPRoute toystore/my-route accepted
    reason: HTTPRouteAccepted
    status: "True"
    type: Ready
discoveredAuthScheme:
  authentication:
    api-key-users:
      apiKey:
        allNamespaces: false
        selector:
          matchLabels:
            app: toystore
      credentials:
        authorizationHeader:
          prefix: APIKEY
      metrics: false
      priority: 0
observedGeneration: 1