chore: auto-add istio ingress gateway namespace to AuthorizationPolicy

[schahal]

Ref: #342

Motivation

We have an AuthorizationPolicy where users can set allowedNamespaces. However, it's easy to miss the namespace of the ingress gateway that users may want their VirtualService tied to.

What This Does

This parses the namespace of the istio gateways that users provide and creates a new list by appending it to the allowedNamespaces-provided list adds a separate rule for it

This is a safe assumption due to our checks of its format:

k8s-charts/charts/simple-app/templates/istio/virtualservice.yaml

Line 19 in ca85ca6

{{ fail ".Values.virtualService.gateways entries must be in the form of: namespace/gateway-name" }}

Test

Updated set network.allowAll and virtualService.enabled in values.local.yaml to `true...

Resulting relevant diff of make template:

First Commit

--- /tmp/simple-app-orig.yaml	2024-10-29 19:55:03
+++ /tmp/simple-app-new.yaml	2024-10-29 19:57:33
...
@@ -424,7 +424,7 @@
 metadata:
   name: simple-app
   labels:
-    helm.sh/chart: simple-app-1.12.1
+    helm.sh/chart: simple-app-1.12.2
     app.kubernetes.io/version: "latest"
     app.kubernetes.io/managed-by: Helm
     tags.datadoghq.com/service: "simple-app"
@@ -466,6 +466,7 @@
         namespaces:
         - foo
         - bar
+        - istio-gateways
     to:
     - operation:
         ports:
...

Updated Commit

...
@@ -471,6 +471,15 @@
         ports:
         - "80"
         - "8443"
+  - from:
+    - source:
+        namespaces:
+        - "istio-gateways"
+    to:
+    - operation:
+        ports:
+        - "80"
+        - "8443"
 ---
...