[data-plane] Receiver: Reject unauthorized requests

[creydr]

We need to verify in the receiver (ingress), that an request is authorized. Therefor we should do the following in the receiver:

• Get the OIDC identity of the sender
• In case the resources (Broker/KafkaChannel/KafkaSink) .status.policies is set:
  • check, if the senders identity is subject of any of the linked EventPolicies (in their .status.from[]).
    • If it is present: continue with the request
    • If not: reject the request with a 403 status code
• In case the resources .status.policies is empty:
  • Check the default-authorization-mode and do the following depending on its value:
    • allow-all: Continue with the request
    • deny-all: reject the request with a 403 status code
    • allow-same-namespace: check, if the senders identity is from the same namespace, as the resource. If so, continue with the request, otherwise reject with a 403

We should also add an e2e test for the above scenarios.

Additional context:

• Feature track document
• #4042 should help by providing the "verify methods"

Additional hints for new contributors before starting with this issue:

1. When the issue has the Draft status, the issue is subject to change and thus should not be started to be worked on
2. Make sure you've read and understood the CONTRIBUTING.md guidelines
3. Make sure you're able to run Knative Eventing locally with Knative Eventing Kafka and run at least the unit tests.
4. Feel free to raise any questions you have either directly here in the issue, in the #knative-eventing Slack channel or join the Eventing Workgroup Meeting / Office Hours
5. When you feel comfortable with this issue, feel free to assign it to you (e.g. by commenting /assign). Please be aware that we might unassign you, if we don't see any progress from your side to give other contributors also a chance to work on this issue.

[creydr]

/help
/triage accepted

[knative-prow]

@creydr:
This request has been marked as needing help from a contributor.

Please ensure the request meets the requirements listed here.

If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-help command.

In response to this:

/help
/triage accepted

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[Cali0707]

/area data-plane

[creydr]

Putting back in "Draft" status, as this maybe could be included in #4042 already

[creydr]

Done in #4041 / #4061