kubectl-ate: add get and create egress-policy

[Yuan Gao (ygao-g)]

Part of #1550

This PR adds kubectl ate get and kubectl ate create support for egress-policy.

• get prints a table by default, or a bare JSON/YAML document with -o.
• create consumes that same document. -f - reads stdin.
• Omitted metadata is filled from --atespace and the fixed name default; a manifest naming another atespace is rejected before any RPC.
• get accepts exactly one actor for now; a follow-up adds several actors and a list document.

Recommend reviewing the four commits one at a time:

• printer and manifest decoder with a round-trip test,

• get command,

• create command,

• then the README updates on their own.

• Tests pass:

  • unit tests and make verify
  • hack: verify-egress-policy-cli.sh, kind smoke test for the egress-policy verbs ygao-g/substrate#33 against this head on a local kind cluster;
  • Also tested the new test-egress.sh step on a local kind cluster;

• Appropriate changes to documentation are included in the PR.

🤖 This PR was developed with AI assistance. I have reviewed and tested all changes.

[Bowei Du (bowei)]

Check that the help text makes sense and is relevant to the command. The help text should not talk about what Egress policy does, constraints etc.

[Julian Gutierrez Oschmann (juli4n)]

The ability to pass a manifest and provide (atespace, name) to override it lhis looks handy for the flow where you want to copy the policy of an actor to another (otherwise you will need to store in a file, edit, call kubectl ate create). It's not consistent with ActorTemplates though, which have a similar feature. Maybe add a TODO in create_actor_template.go to add support for this as well?

[Yuan Gao (ygao-g)]

Small correction to the reading: the flags do not override the manifest. The store looks up an egress policy by ActorRef, the table's primary key is (atespace, actor_name), and the server requires metadata.name to be 'default'. On the client, --atespace and 'default' are filled in only when the manifest omits metadata, and a manifest that names a different atespace is rejected before dialing.

That means a same-atespace copy already works as a pipe: get egress-policy src -o yaml | create egress-policy dst -f -. Only a cross-atespace copy needs the manifest edited first.

I opened issue #1680 for the retarget flow, since it needs more deiscussion and design calls (silent override vs. an explicit flag, and how create actor-template should take a name).

WDYT?

[Bowei Du (bowei)]

Looks ok, can you look at the suggestions?

Resolved