Authpolicy status should not report error when authconfig resource is not required.

[eguzki]

Given the following topology:

Gateway prod-web

HTTPRoute petstore-route   ->  gateway prod-web

AuthPolicy gw-auth -> Gateway prod-web

Authpolicy petstore-route -> HTTPRoute petstore-route

The status field of the gw-auth policy reports as "Not Available"

 status:                                           
  conditions:                                     
  - lastTransitionTime: "2023-11-30T15:40:34Z"    
    message: AuthScheme is not ready yet          
    reason: AuthSchemeNotReady                    
    status: "False"                               
    type: Available                               
  observedGeneration: 2                           

This is wrong because the gw-auth policy does not need an AuthConfig resource as there is no "free" HTTPRoutes. It should report as "Available" instead.

[KevFan]

@eguzki @guicassolato Given the RFC on https://github.com/Kuadrant/architecture/blob/main/rfcs/0004-policy-status.md, I'm interested on how this scenario would work for the Enforced condition for the Gateway AuthPolicy gw-auth in the example.

To me, there is 2 options from https://github.com/Kuadrant/architecture/blob/main/rfcs/0004-policy-status.md#conditions:

1. This could be Enforced: True: Enforced - that this policy has been successfully enforced even though all httproutes from this Gateway has their own AuthPolicy

or alternatively:

2. This could be Enforced: False: Overridden - This policy has been overridden as all httproutes from this Gateway has their own AuthPolicy

I think currently in my head no 2) makes more sense, the gateway AuthPolicy is not enforced on any underlying HTTPRoute and has been overridden by the AuthPolicy on the HTTPRoute attached to the Gateway. If a free httproute using this gateway becomes available with no authpolicy, it should then go back to no 1) as its successfully enforcing it's AuthPolicy on a httproute

Interested in your thoughts on this on if you agree or not 🤔

[guicassolato]

@eguzki @guicassolato Given the RFC on https://github.com/Kuadrant/architecture/blob/main/rfcs/0004-policy-status.md, I'm interested on how this scenario would work for the Enforced condition for the Gateway AuthPolicy gw-auth in the example.

To me, there is 2 options from https://github.com/Kuadrant/architecture/blob/main/rfcs/0004-policy-status.md#conditions:

1. This could be `Enforced: True: Enforced` - that this policy has been successfully enforced even though all httproutes from this Gateway has their own AuthPolicy

or alternatively:

2. This could be `Enforced: False: Overridden` - This policy has been overridden as all httproutes from this Gateway has their own AuthPolicy

I think currently in my head no 2) makes more sense, the gateway AuthPolicy is not enforced on any underlying HTTPRoute and has been overridden by the AuthPolicy on the HTTPRoute attached to the Gateway. If a free httproute using this gateway becomes available with no authpolicy, it should then go back to no 1) as its successfully enforcing it's AuthPolicy on a httproute

Interested in your thoughts on this on if you agree or not 🤔

Good question, @KevFan!

IMO, I'd say Enforced: False: Overridden, but interested to hear other opinions.

cc @R-Lawton @didierofrivia

[didierofrivia]

@KevFan @guicassolato I share your view point on this, following the states conditions listed in https://github.com/Kuadrant/architecture/blob/main/rfcs/0004-policy-status.md#conditions, the use case should reflect Enforced: False: Overridden

[eguzki]

Sorry for being late to the party. I just wanted to tell that I agree with the decision taken here. "Enforced" and "Overriden" at the same time represents better the actual configuration applied.