AuthorizationPolicy serviceAccount: allow same namespace

[howardjohn]

This allows applying a policy like

apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
 name: allow-waypoint
spec:
  selector:
    matchLabels:
      app: echo
  action: ALLOW
  rules:
  - from:
    - source:
        serviceAccounts: ["waypoint"]

To get the semantics of "allow the waypoint in the same namespace".

It is common in k8s to allow configurations to be written without a namespace specified and have the namespace of references implied by the namespace it is eventually written to. This allows taking the same policy and applying it to many places without the need for modification/templating. As far as I know, this is allowed with virtually every k8s core type and Istio type today.

Note this just changes docs to match the implementation in istio/istio#54745 (which has a "hold" until this is approved)

Note: a release note is skipped since we have not shipped this feature

[keithmattix]

LGTM, but I'm curious why I don't see any v1 changes generated?

[howardjohn]

LGTM, but I'm curious why I don't see any v1 changes generated?

v1 is just type aliases. These are done struct level. This is changing a field within a struct, so there is no change