feat(kuma-cp): allow sectionName and labels in targetRef

[Neyaz]

Motivation

According to #11572 there's no real reason to have such validation.
However, I didn't get if this part from the issue If one of the matching meshService doesn't have such a sectionName it should simply not match just like it's already the case for labels. already works in this way or it needs to be implemented.

Implementation information

The change is pretty simple.

Supporting documentation

None

[jakubdyszkiewicz]

Hey, thanks for the contribution.

However, I didn't get if this part from the issue If one of the matching meshService doesn't have such a sectionName it should simply not match just like it's already the case for labels. already works in this way or it needs to be implemented.

I believe it already works that way. @lobkovilya to confirm

[lobkovilya]

Unfortunately, even though it looks like it's supported, method resolveTargetRef doesn't take SectionName into account.

I added the following input file to pkg/plugins/policies/core/rules/testdata/resourcerules:

# MeshTimeout with targetRef to the real MeshService resource
type: MeshTimeout
name: matched-for-rules-mt-1
mesh: mesh-1
spec:
  targetRef:
    kind: Mesh
  to:
    - targetRef:
        kind: MeshService
        labels:
          env: dev
        sectionName: httpport
      default:
        idleTimeout: 10s
        connectionTimeout: 11s
        http:
          requestTimeout: 12s
---
type: MeshService
name: backend-1
mesh: mesh-1
labels:
  env: dev
spec:
  selector:
    dataplaneTags:
      app: backend
  ports:
    - port: 80
      name: httpport
      targetPort: 80
      appProtocol: http
---
type: MeshService
name: backend-2
mesh: mesh-1
labels:
  env: dev
spec:
  selector:
    dataplaneTags:
      app: backend
  ports:
    - port: 80
      targetPort: 80
      appProtocol: http
---
type: MeshService
name: backend-3
mesh: mesh-1
labels:
  env: prod
spec:
  selector:
    dataplaneTags:
      app: backend
  ports:
    - port: 80
      targetPort: 80
      appProtocol: http

and the golden file is not correct.

[Neyaz]

@jakubdyszkiewicz @lobkovilya Thank you for a review!

Unfortunately, even though it looks like it's supported, method resolveTargetRef doesn't take SectionName into account.

@lobkovilya I believe it should be handled by sectionName method. As I understand it, it should return refSectionName for every resolvedPolicyItem if sectionName is set.

[lobkovilya]

TBH I think the problem is in resolveTargetRef, it never calls sectionName() method and operates only with implicitSectionName (should also take into account the explicit one)