Adds AuthenticationFilter Support to Kubernetes Provider

[danehans]

Adds AuthenticationFilter API support to the Kubernetes provider:

• api/v1alpha1/authenticationfilter_types.go: Adds missing Authentication -> AuthenticationFilter changes from Adds Request Authentication API #733.
• api/v1alpha1/zz_generated.deepcopy.go: Regenerates DeepCopy methods due to AuthenticationFilter API changes.
• internal/envoygateway/scheme.go: Adds the v1alpha1, e.g. AuthenticationFilter, group to the scheme.
• internal/gatewayapi/helpers.go: Adds ValidateAuthenticationFilterRef() helper function to validate AuthenticationFilter references from an HTTPRoute.
• internal/gatewayapi/helpers_test.go: Adds ValidateAuthenticationFilterRef() unit tests.
• internal/gatewayapi/translator.go: Adds AuthenticationFilter to the gatewayapi Resources type. Adds NewResources() helper function.
• internal/gatewayapi/zz_generated.deepcopy.go: Regenerates DeepCopy methods due to API changes.
• internal/provider/kubernetes/config/crd/kustomization.yaml: Adds AuthenticationFilter CRD to the list of installed CRDs.
• internal/provider/kubernetes/config/rbac/role.yaml: Generated by make manifests, updating EG RBAC for AuthenticationFilter.
• internal/provider/kubernetes/controller.go: Add a watch for instances of AuthenticationFilter. Updates the resourceMappings type to map HTTPRoutes<>AuthenticationFilters. Adds AuthenticationFilters referenced by managed HTTPRoutes to the resourceTree.
• internal/provider/kubernetes/rbac.go: Updates EG RBAC kubebuilder tags for managing instances of AuthenticationFilter.
• internal/provider/kubernetes/helpers.go: Removes namespace check from validateBackendRef(). Now that [provider] refactoring kubernetes provider to single reconciler #702 adds full ReferenceGrant support, an HTTPRoute backend should be allowed to reference a Service in a different namespace if the necessary ReferenceGrant exists (xref).
• internal/provider/kubernetes/kubernetes_test.go: Adds AuthenticationFilter test case to Kube provider integration tests.
• internal/provider/kubernetes/predicates.go Adds predicate to filter AuthenticationFilter instancess from the controller's watch.
• internal/provider/kubernetes/routes.go: Updates processHTTPRoutes() to process AuthenticationFilters referenced by managed HTTPRoutes.
• internal/provider/kubernetes/routes_test.go: Renamed from route_test.go to match routes.go. Adds a unit test for processHTTPRoutes()`.

xref:#790

Signed-off-by: danehans daneyonhansen@gmail.com

[danehans]

Marking as Draft while I resolve the conformance test failure.

[danehans]

Commit 2f01f4d removes the following changes from the initial commit:

`internal/provider/kubernetes/helpers.go`: Removes namespace check from `validateBackendRef()`. Now that #702 adds full ReferenceGrant support, an HTTPRoute backend should be allowed to reference a Service in a different namespace if the necessary ReferenceGrant exists ([xref](https://github.com/envoyproxy/gateway/blob/main/internal/provider/kubernetes/routes.go#L101-L111)).`

Due to failed conformance test:

...
helpers.go:301: Route gateway-conformance-infra/invalid-nonexistent-backend-ref expected 1 Parents got 0
    httproute-invalid-backendref-nonexistent.go:44: 
        	Error Trace:	/home/runner/work/gateway/gateway/test/conformance/helpers.go:303
        	            				/home/runner/work/gateway/gateway/test/conformance/helpers.go:174
        	            				/home/runner/work/gateway/gateway/test/conformance/httproute-invalid-backendref-nonexistent.go:44
        	            				/home/runner/work/gateway/gateway/test/conformance/suite.go:206
        	            				/home/runner/work/gateway/gateway/test/conformance/suite.go:170
        	Error:      	Received unexpected error:
        	            	timed out waiting for the condition
        	Test:       	TestGatewayAPIConformance/HTTPRouteInvalidNonExistentBackendRef
        	Messages:   	error waiting for HTTPRoute to have parents matching expectations

xref: #792

[arkodg]

can we combine these two into one ?

[danehans]

Shouldn't we keep them separate to simplify moving the Gateway API extensions, e.g. AuthenticationFilter, out of EG into a separate repo in the future? If we decide to remove the config API group, I think that should be done in a separate PR.

[arkodg]

trying to highlight the fact that current dir structure is confusing - either we have api/extensions/v1alpha1 or just api/v1alpha1 .

[danehans]

Agreed. Per your request, I removed the security group from the Request Authentication design. I'll add this to the community meeting agenda to get input from other maintainers.

[danehans]

xref #809 to make a decision on API type grouping. IMO a separate PR should be submitted to resolve this issue.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 54.78261% with 52 lines in your changes missing coverage. Please review.
✅ Project coverage is 62.95%. Comparing base (d56ea6a) to head (16b425d).
⚠️ Report is 4034 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/provider/kubernetes/controller.go	64.58%	14 Missing and 3 partials ⚠️
internal/gatewayapi/translator.go	0.00%	11 Missing ⚠️
internal/gatewayapi/zz_generated.deepcopy.go	0.00%	9 Missing ⚠️
internal/provider/kubernetes/predicates.go	46.66%	6 Missing and 2 partials ⚠️
internal/provider/kubernetes/routes.go	73.33%	3 Missing and 1 partial ⚠️
internal/gatewayapi/helpers.go	82.35%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #791      +/-   ##
==========================================
- Coverage   63.31%   62.95%   -0.36%     
==========================================
  Files          46       46              
  Lines        6157     6257     +100     
==========================================
+ Hits         3898     3939      +41     
- Misses       2019     2070      +51     
- Partials      240      248       +8     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[arkodg]

LGTM thanks !