user-guide: authorization using k8s service account returning 403 instead of 200

[KevFan]

WHAT
Following the Rate-limiting and protecting an API with JSON Web Tokens (JWTs) and Kubernetes authnz using Kuadrant user guide, at Step 6, the following GET request using the K8s service account token should return a 200 status code:

curl -H "Authorization: Bearer $SA_TOKEN" -H 'Host: api.toystore.com' http://localhost:9080/toy -i
# HTTP/1.1 200 OK

However, it insteads return a 403 still:

curl -H "Authorization: Bearer $SA_TOKEN" -H 'Host: api.toystore.com' http://localhost:9080/toy -i
# HTTP/1.1 403 Forbidden
# x-ext-auth-reason: Not authorized: unknown reason
# date: Mon, 17 Jul 2023 12:58:04 GMT
# server: istio-envoy
# content-length: 0

Due to this error, in Step 7 of the user guide, it is not possible to validate the Rate limit using the service account also.

DONE

• The guide is working as expected

[guicassolato]

This is a regression cause by Kuadrant/authorino#394 and more specifically by Kuadrant/authorino#403.

Here's a PR that fixed the Authorino docs with an updated example that can be used to fix this user guide: Kuadrant/authorino#408.

Because the AuthPolicy includes 2 sources of identity (Keycloak realm and Kubernetes SAs), you may want to rely on Authorino's extendedProperties feature to ensure auth.identity.sub is set for the k8s-service-accounts identity objects was well.