mt-broker-reconciler: Create EventPolicies for mt-broker

[creydr]

As the mt-broker implementation uses Channels under the hood, we need to make sure we have the correct EventPolicies in place to not block requests to the underlying channel. Therefor the mt-broker reconciler should behave as described:

• In case the authentication-oidc feature flag is set to enabled:
  • create an EventPolicy for the event flow from mt-broker-ingress to the underlying Channel, with the following properties:
    • .spec.ref: pointing to the channel
    • .spec.from: sub from the mt-broker-ingress (system:serviceaccount:knative-eventing:mt-broker-ingress-oidc as defined in ingress_handler.go#L324)
    • owner reference of EventPolicy points to the Broker, so that we have a lifecycle binding
• In case the authentication-oidc feature flag is set to disabled:
  • clean up eventually existing EventPolicies which were created when authentication-oidc was enabled (e.g. by filtering on EventPolicies which have an owner reference to an mt-broker)

Prerequisites:

• Add EventPolicy type #7971
• List applying policies in mt-brokers .status.policies #7976

Additional context:

• Feature track document

Additional hints for new contributors before starting with this issue:

1. When the issue has the Draft status, the issue is subject to change and thus should not be started to be worked on
2. Make sure you've read and understood the CONTRIBUTING.md guidelines
3. Make sure you're able to run Knative Eventing locally and run at least the unit tests.
4. Feel free to raise any questions you have either directly here in the issue, in the #knative-eventing Slack channel or join the Eventing Workgroup Meeting
5. When you feel comfortable with this issue, feel free to assign it to you (e.g. by commenting /assign). Please be aware that we might unassign you, if we don't see any progress from your side to give other contributors also a chance to work on this issue.

[rahulii]

/assign

[Leo6Leo]

Hey @rahulii , anything I can help you with on this?