attestation-service: implement *_policy() methods for EAR token broker

[mythi]

without the changes, kbs-client "set-attestation-policy" gets "not supported" errors.

the changes are taken from 'simple' token broker. Both token brokers have a policy_engine instance created.

[mkulke]

I assume this is setting the policy in memory for the process? so, the policy would be volatile and also potentially split-brained for multiple replicas?

it might make sense to do implement for consistency's sake. but IMO we should really re/consider how we want to handle state in KBS/AS and not expose stateful methods unless we know how we want to address with it.

If it's required for tests in the mean time, I could imagine that the policy storage is backed by a k8s configmap, a docker-compose mount or something.

[mythi]

OPA policy engine seems to writes these to the disk and at least the docker-compose backed mount stores it persistently (on the AS side, not KBS).

it might make sense to do implement for consistency's sake. but IMO we should really re/consider how we want to handle state in KBS/AS and not expose stateful methods unless we know how we want to address with it.

yeah makes sense. right now this is just to be able to experiment with EAR policies uploaded using kbs-client config set-attestation-policy the same way as with simple broker.

[fitzthum]

LGTM

We can discuss how to handle the policy state, but for now let's just keep this the same as the simple token.

[fitzthum]

maybe we should make an issue for tracking the statefulness stuff