Backport of Net 12039 terminating gateway acl policy fix into release/1.6.x

[hc-github-team-consul-core]

Backport

This PR is auto-generated from #4468 to be assessed for backporting due to the inclusion of the label backport/1.6.x.

🚨

Warning automatic cherry-pick of commits failed. If the first commit failed,
you will see a blank no-op commit below. If at least one commit succeeded, you
will see the cherry-picked commits up to, not including, the commit where
the merge conflict occurred.

The person who merged in the original PR is:
@natemollica-nm
This person should manually cherry-pick the original PR into a new backport PR,
and close this one when the manual backport PR is merged in.

merge conflict error: POST https://api.github.com/repos/hashicorp/consul-k8s/merges: 409 Merge conflict []

The below text is copied from the body of the original PR.

---

Changes proposed in this PR

• Introduce handling of Consul AdminPartition ACL policy rules when global.adminPartitions.enabled: true

Current workflow requires end users to manually update the Terminating Gateway policies applied by the TerminatingGateway resource controller when AdminPartitions are enabled from:

namespace "default" {
  service_prefix "" {
    policy = "write"
  }
}

to

partition "default" {
  namespace "default" {
    service_prefix "" {
      policy    = "write"
      intention = "read"
    }
  }
}

How I've tested this PR

• Clone consul-k8s repository to $HOME/HashiCorp/consul-k8s
• Apply this branch's commits to locally cloned repo.
• Using https://github.com/hashicorp-support/consul-k3d-multicluster
  • From this repo, run make install-dev to deploy dev image with changes
• Verify the desired results of Consul ACL TerminatingGateway generated policies:

Test Matrix for ACL Policies and Admin Partitions with Terminating Gateway

Test Case	Admin Partitions Enabled	Partition Name	Service Type	Expected ACL Policy
Default Partition, Wildcard	Yes	default	Wildcard (*)	partition "default" { namespace "default" { service_prefix "" { policy = "write"; intention = "read"; } } }
Default Partition, Specific	Yes	default	Specific (static-server)	partition "default" { namespace "default" { service "static-server" { policy = "write"; intention = "read"; } } }
Non-Default Partition, Wildcard	Yes	dev	Wildcard (*)	partition "dev" { namespace "default" { service_prefix "" { policy = "write"; intention = "read"; } } }
Non-Default Partition, Specific	Yes	dev	Specific (static-server)	partition "dev" { namespace "default" { service "static-server" { policy = "write"; intention = "read"; } } }
No Partition, Wildcard	No	N/A	Wildcard (*)	namespace "default" { service_prefix "" { policy = "write"; intention = "read"; } }
No Partition, Specific	No	N/A	Specific (static-server)	namespace "default" { service "static-server" { policy = "write"; intention = "read"; } }

How I expect reviewers to test this PR

👀

Checklist

• [] Tests added
• CHANGELOG entry added

---

Overview of commits

• c84c99b - 1926837 - 52406f7 - f9f703f - eed7e7a - bb5556b - 25104aa - fd7b5ab - 25a5c00 - fb4b063 - 24f0141 - a92e607 - 9675207

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

---

17 out of 18 committers have signed the CLA.

• nathancoleman
• NiniOak
• sarahalsmiller
• natemollica-nm
• nitin-sachdev-29
• anandmukul93
• mrgupta7
• sujay-hashicorp
• sreeram77
• pajay-rao
• jukie
• xwa153
• Ranjandas
• missylbytes
• jm96441n
• ndhanushkodi
• zalimeni
• compliance-pr-automation-bot[bot]

_{Have you signed the CLA already but the status is still pending? Recheck it.}

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

---

17 out of 18 committers have signed the CLA.

• sujay-hashicorp
• NiniOak
• zalimeni
• jm96441n
• Ranjandas
• mrgupta7
• xwa153
• anandmukul93
• pajay-rao
• nitin-sachdev-29
• ndhanushkodi
• sreeram77
• missylbytes
• sarahalsmiller
• natemollica-nm
• nathancoleman
• jukie
• compliance-pr-automation-bot[bot]

_{Have you signed the CLA already but the status is still pending? Recheck it.}