fix(permissions): API permissions model using client token

[andrewazores]

Fixes #554
Fixes #575

[andrewazores]

@ebaron ready for review

[ebaron]

Looks good! I still have some reservations about tying the permissions model to the operator's Kubernetes client. For example, create flightrecorders isn't currently a valid action for a user to take. This also ends up creating a hard dependency on the operator. I think we can revisit and fine-tune the permissions later on though.

[andrewazores]

I've added a tokenreviews query to check the user's supplied token, using the service account token to perform the check, if there are no specific Kubernetes resource permissions required for a given authenticated API request. This means the operator clusterrole (or whatever serviceaccount Cryostat runs as) needs create on tokenreviews in group authentication.k8s.io.

[ebaron]

Looks good. I tested it locally with the corresponding changes in the operator. I attempted to log in with a fake token to see what would happen and there was no visual indicator in the UI, but there was a 401 Unauthorized in the log. I'm not sure if this differs at all from the current behaviour.

The operator changes are pretty much done, just need to add some more tests. I think these PRs should be merged at the same time to prevent breakage.

[andrewazores]

I attempted to log in with a fake token to see what would happen and there was no visual indicator in the UI, but there was a 401 Unauthorized in the log. I'm not sure if this differs at all from the current behaviour.

I believe that's normal, although now that you mention it, there probably should be some indication that the request was made and rejected.