Restrict source namespaces in flagger-loadtester

[connesc]

In a multi-tenant cluster, isolating namespaces using network policies quickly becomes a requirement.
In this context, mutualizing a Flagger instance (in a dedicated namespace) is challenging, because flagger-loadtester generates cross-namespace traffic.

A simple approach is to let each tenant deploy its custom flagger-loadtester in the same namespace as its target canaries. This way, the only cross-namespace traffic is between flagger and flagger-loadtester and can be easily whitelisted by network policies.

                    ┌──────────────────────────────────┐
                    │                                  │
                    │                           ┌────┐ │
┌───────────┐       │                    ┌─────►│app1│ │
│           │       │                    │      └────┘ │
│ ┌───────┐ │       │  ┌─────────────────┴┐            │
│ │flagger├─┼───────┼─►│flagger-loadtester│            │
│ └───────┘ │       │  └─────────────────┬┘            │
│           │       │                    │      ┌────┐ │
└───────────┘       │                    └─────►│app2│ │
 flagger ns         │                           └────┘ │
                    │                                  │
                    └──────────────────────────────────┘
                                tenant1 ns

However, nothing can prevent a Canary from tenant2 namespace to declare flagger-loadtester.tenant1 as a webhook, and thus to execute arbitrary commands in tenant1 namespace.
This creates a serious isolation issue.

This PR allows flagger-loadtester to whitelist namespaces from which canaries are allowed.
The proposed -namespace-regex flag looks like a simple way to address the problem, but feel free to challenge it 😉.

[stefanprodan]

@connesc can you please add this flag to the loadtester Helm chart and document there what it does?

[codecov-commenter]

Codecov Report

Merging #1119 (96fd359) into main (65e3bcb) will decrease coverage by 0.22%.
The diff coverage is 9.37%.

@@            Coverage Diff             @@
##             main    #1119      +/-   ##
==========================================
- Coverage   57.21%   56.99%   -0.23%     
==========================================
  Files          78       79       +1     
  Lines        6344     6376      +32     
==========================================
+ Hits         3630     3634       +4     
- Misses       2172     2199      +27     
- Partials      542      543       +1     

Impacted Files	Coverage Δ
pkg/loadtester/server.go	11.66% <0.00%> (-1.29%)	⬇️
pkg/loadtester/authorizer.go	100.00% <100.00%> (ø)
pkg/controller/finalizer.go	37.66% <0.00%> (+0.82%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 65e3bcb...96fd359. Read the comment docs.

[stefanprodan]

LGTM

Thanks @connesc 🏅

[connesc]

Thanks for the review & merge @stefanprodan! 👍