[SKIP-1076] AuthorizationSettings for circumventing default blocked actuator

[anderssonw]

Adds new AuthorizationSettings field in application spec for controlling actuator blocking.

It is possible to allow Actuator completely by passing spec.authorizationSettings.allowAll: true, and allow certain endpoints using spec.authorizationSettings.allowList: ["health", "etc"].

According to Istio documentation ALLOW rules are checked after DENY rules, making these trump the earlier DENY rules.

As of now, the tests are not able to spawn the default DENY rule after removing the allowAll: true flag. This is odd however, as this seems to be working just fine when applying the test resources to a local cluster. This seems to be a kuttl issue, see kudobuilder/kuttl#471.

[omaen]

Great work @anderssonw! I was just about to hit "Approve" when it hit me that adding a field to the skiperator spec that covers actuator endpoints might be a bit too specific 🤔 If we later find out that another framework also should have som sane defaults for blocked endpoints it would be easier to have a more generic approach to this.

I should have thought about this earlier, so I'm keen on hearing your opinion on this. Is it possible to rename the spec field to spec.authorizationSettings perhaps and use the full path in spec.authorizationSettings.allowList: ["actuator/health", "actuator/etc"]. Might have to rename the existing default deny rule to have a more generic name as well. That way we can use the same logic for blocking and allowing other paths.

[anderssonw]

Great input, generalising the specification should be a goal in general, IMO. I will peep this next week :)

[anderssonw]

Should be good now @omaen :)

[omaen]