Add trustDomains and notTrustDomains to AuthzPolicy source

[ymesika]

This PR introduces trustDomains and notTrustDomains fields to the AuthorizationPolicy Source rule.
This allows users to accurately and safely match against the identity's trust domain without resorting to potentially error-prone glob-style matching on the full principal URI.

This proposal is fully backward compatible. The addition of optional fields will not impact existing AuthorizationPolicy resources that do not use the new trustDomains fields.

Example:

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-some-trust-domains
  namespace: default
spec:
  action: ALLOW
  rules:
  - from:
    - source:
        trustDomains: ["cluster1.local", "cluster2.local"]

Or:

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-all-but-specific
  namespace: default
spec:
  action: ALLOW
  rules:
  - from:
    - source:
        notTrustDomains: ["not.trust.domain"]

[istio-policy-bot]

😊 Welcome @ymesika! This is either your first contribution to the Istio api repo, or it's been
a while since you've been here.

You can learn more about the Istio working groups, Code of Conduct, and contribution guidelines
by referring to Contributing to Istio.

Thanks for contributing!

Courtesy of your friendly welcome wagon.

[keithmattix]

What are the semantics of notTrustDomains is set but the connection doesn't have mTLS enabled?

[ymesika]

I think it's the same trap as notPrinicipals/notNamespaces.
For those, in positive values we have a comment that it requires mTLS and I also added it (https://github.com/ymesika/api/blob/a23a5bc7d3b28a0ca57056462867817b380479c7/security/v1beta1/authorization_policy.proto#L512) but we lack this comment on the negative ones.
I tried to be consistent with them.

[ymesika]

BTW, for all those negative forms when mTLS is absent, not_* will trivially pass (empty string doesn't match any specified value), potentially allowing unauthenticated traffic through.

[keithmattix]

Based on the example, it seems like it's more global based with * vs an envoy string matcher type of API. Does it only match whole components of a SPIFFE URI? Can you do, eg "fo*-bar"?

[ymesika]

The matching semantics are clearly documented above. The trustdomains field supports the same pattern matching as all other string fields in the rule (suffix, prefix, exact or presence).
So no, you cannot do fo*-bar. But that's something to keep in mind to validate in the impl.

[keithmattix]

Ack, thanks for the pointer