test(opa): Improve subject DN check

Author: siegfriedweber

tests/templates/kuttl/opa/20-install-opa.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - script: >
+      envsubst '$NAMESPACE' < 20_opa.yaml |
+      kubectl apply -n $NAMESPACE -f -

tests/templates/kuttl/opa/20-install-opa.yaml.j2

@@ -0,0 +1,101 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test-rego-kafka
+  labels:
+    opa.stackable.tech/bundle: "true"
+data:
+  kafka.rego: |
+    package authz
+
+    # FQDNs of the brokers as regular expressions
+    brokers_fqdn := [
+      `local`,
+      `cluster`,
+      `svc`,
+      `$NAMESPACE`,
+      `test-kafka-broker-default-headless`,
+      `test-kafka-broker-default-[0-9]+`,
+    ]
+
+    domain_components = [concat("", [`DC=`, dc]) | some dc in brokers_fqdn]
+    common_name = `CN=generated certificate for pod`
+    subject_dn_fields = array.concat(domain_components, [common_name])
+    brokers_subject_dn_pattern := concat(",", subject_dn_fields)
+
+    default allow := false
+
+    allow if {
+      is_internal_request
+
+      regex.match(
+        brokers_subject_dn_pattern,
+        input.requestContext.principal.name,
+      )
+    }
+
+    allow if {
+      is_external_request
+      input.requestContext.principal.name == "kafka"
+    }
+
+    allow if {
+      is_external_request
+      input.requestContext.principal.name == "developer"
+      resource_is_allowed
+    }
+
+    is_internal_request if input.requestContext.listenerName == "INTERNAL"
+    is_external_request if not is_internal_request
+
+    # only allow access to a specific topic
+    resource_is_allowed if {
+      input.action.resourcePattern.resourceType == "TOPIC"
+      input.action.resourcePattern.name == "test-topic"
+      action_is_allowed
+    }
+
+    resource_is_allowed if {
+      input.action.resourcePattern.resourceType == "GROUP"
+      input.action.operation in ["DESCRIBE", "READ"]
+    }
+
+    action_is_allowed if {
+      input.action.operation in ["CREATE", "DESCRIBE", "READ", "WRITE"]
+    }
+---
+apiVersion: opa.stackable.tech/v1alpha1
+kind: OpaCluster
+metadata:
+  name: test-opa
+spec:
+  image:
+{% if test_scenario['values']['opa-latest'].find(",") > 0 %}
+    custom: "{{ test_scenario['values']['opa-latest'].split(',')[1] }}"
+    productVersion: "{{ test_scenario['values']['opa-latest'].split(',')[0] }}"
+{% else %}
+    productVersion: "{{ test_scenario['values']['opa-latest'] }}"
+{% endif %}
+    pullPolicy: IfNotPresent
+  clusterConfig:
+{% if test_scenario['values']['use-opa-tls'] == "true" %}
+    tls:
+      serverSecretClass: opa-tls-$NAMESPACE
+{% endif %}
+    vectorAggregatorConfigMapName: vector-aggregator-discovery
+  servers:
+    config:
+      logging:
+        enableVectorAgent: true
+        containers:
+          opa:
+            console:
+              level: INFO
+            file:
+              level: INFO
+            loggers:
+              decision:
+                level: INFO
+    roleGroups:
+      default: {}

tests/templates/kuttl/opa/20_opa.yaml.j2

@@ -45,3 +45,4 @@ commands:
           roleGroups:
             default:
               replicas: 3
+      EOF