Support authorization policy config

[labuladong]

Master https://github.com/streamnative/eng-support-tickets/issues/3263

Example

# Enable necessary components
components:
  zookeeper: true
  bookkeeper: true
  broker: true
  autorecovery: true
  proxy: false
  toolset: false

# Enable Istio to trigger AuthorizationPolicy creation
istio:
  enabled: true

# Configure AuthorizationPolicy for ZooKeeper
zookeeper:
  authorizationPolicy:
    from:
      - source:
          principals:
            - "cluster.local/ns/pulsar/sa/pulsar-broker"
            - "cluster.local/ns/pulsar/sa/pulsar-bookie"
      - source:
          namespaces:
            - "pulsar"
            - "monitoring"
    to:
      - operation:
          ports:
            - "2181"
            - "9990"
            - "2888"
            - "3888"
            - "8000"
          methods:
            - "GET"
            - "POST"
          paths:
            - "/metrics"
            - "/health"
          hosts:
            - "zookeeper.pulsar.svc.cluster.local"
            - "*.zookeeper.pulsar.svc.cluster.local"

# Configure AuthorizationPolicy for BookKeeper
bookkeeper:
  authorizationPolicy:
    from:
      - source:
          principals:
            - "cluster.local/ns/pulsar/sa/pulsar-broker"
            - "cluster.local/ns/pulsar/sa/pulsar-proxy"
      - source:
          namespaces:
            - "pulsar"
    to:
      - operation:
          ports:
            - "3181"
            - "8000"
          methods:
            - "GET"
            - "POST"
            - "PUT"
          paths:
            - "/metrics"
            - "/api/v1/*"
          hosts:
            - "bookie.pulsar.svc.cluster.local"
            - "bookkeeper.pulsar.svc.cluster.local"

# Configure AuthorizationPolicy for AutoRecovery
autorecovery:
  authorizationPolicy:
    from:
      - source:
          principals:
            - "cluster.local/ns/pulsar/sa/pulsar-broker"
      - source:
          namespaces:
            - "pulsar"
            - "pulsar-system"
    to:
      - operation:
          ports:
            - "8000"
          methods:
            - "GET"
            - "POST"
          paths:
            - "/metrics"
            - "/recovery/*"
          hosts:
            - "recovery.pulsar.svc.cluster.local"

# Configure AuthorizationPolicy for Broker
broker:
  authorizationPolicy:
    from:
      - source:
          principals:
            - "cluster.local/ns/pulsar/sa/pulsar-proxy"
            - "cluster.local/ns/pulsar/sa/pulsar-broker"
      - source:
          namespaces:
            - "pulsar"
            - "default"
    to:
      - operation:
          ports:
            - "6650"
            - "8080"
            - "9092"
            - "5682"
          methods:
            - "GET"
            - "POST"
            - "PUT"
            - "DELETE"
          paths:
            - "/metrics"
            - "/admin/*"
            - "/lookup/*"
          hosts:
            - "broker.pulsar.svc.cluster.local"
            - "*.broker.pulsar.svc.cluster.local"

[github-actions]

@labuladong:Thanks for your contribution. For this PR, do we need to update docs?
(The PR template contains info about doc, which helps others know more about the changes. Can you provide doc-related info in this and future PR descriptions? Thanks)

[Copilot]

Pull Request Overview

Adds configurable Istio AuthorizationPolicy support for ZooKeeper, BookKeeper, AutoRecovery, and Broker via Helm values, enabling teams to restrict traffic by source and HTTP operation fields when istio.enabled is true.

• Introduces authorizationPolicy.from and authorizationPolicy.operation (methods/paths/hosts) values for each component
• Updates the corresponding AuthorizationPolicy templates to render optional from/methods/paths/hosts blocks
• Minor YAML/quoting cleanups

Reviewed Changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
charts/sn-platform/values.yaml	Adds authorizationPolicy configuration blocks for components; minor quoting changes; introduces a YAML issue in pulsar_coordinator.component.
charts/sn-platform/templates/zookeeper/zookeeper-authorizationpolicy.yaml	Renders optional from and operation (methods/paths/hosts) under the ZK AuthorizationPolicy.
charts/sn-platform/templates/broker/broker-authorizationpolicy.yaml	Renders optional from and operation (methods/paths/hosts) under the Broker AuthorizationPolicy.
charts/sn-platform/templates/bookkeeper/bookkeeper-authorizationpolicy.yaml	Renders optional from and operation for BookKeeper and AutoRecovery AuthorizationPolicies.
charts/sn-platform-slim/values.yaml	Mirrors authorizationPolicy configuration blocks and introduces the same pulsar_coordinator.component YAML issue.
charts/sn-platform-slim/templates/zookeeper/zookeeper-authorizationpolicy.yaml	Same optional from and operation rendering for ZK in slim chart.
charts/sn-platform-slim/templates/broker/broker-authorizationpolicy.yaml	Same optional from and operation rendering for Broker in slim chart.
charts/sn-platform-slim/templates/bookkeeper/bookkeeper-authorizationpolicy.yaml	Same optional from and operation rendering for BookKeeper and AutoRecovery in slim chart.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

Pull Request Overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 6 comments.

Comments suppressed due to low confidence (4)

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}