epic: Authorization as an optional module

[yevklym]

Description

RFC 008 makes authorization a module: "Authorization itself is never absent — only the ReBAC engine is
optional." The Kubernetes authorization webhook (SubjectAccessReview) is the interface, OpenFGA
is the swappable engine behind it, and managed Kubernetes RBAC is the fallback when the engine is
not deployed.

OpenFGA is a hard dependency across the stack:

Component	Coupling
apis	AccountInfoSpec.FGAInfo is a required field
security-operator	Dials OpenFGA gRPC unconditionally in all four commands; Store and AuthorizationModel reconcilers and the FGA subroutines are always registered
iam-service	GraphQL backend for the IAM UI
rebac-authz-webhook	Registered on the kcp API server's authorization webhook chain
search-service	Dials OpenFGA at startup; both the pre-filter and the per-hit filter go through it
golang-commons/fga	Shared library pulled in by components that must also run without the module
Observability	OpenFGA dashboards/alerts assume the workload exists
Install / bootstrap	Flux and Argo manifests deploy OpenFGA + its Postgres unconditionally
Backup service	Backs up the OpenFGA store unconditionally

The epic intends to remove that coupling so that a deployment can run with no OpenFGA at all and create an abstract interface for the interaction with OpenFGA to make the authorization engine swappable.

Objectives

The epic is done when all of these hold:

• AccountInfoSpec.FGAInfo is optional or replaced with a generic type
• security-operator starts, reconciles and passes its test suite with FGA disabled - no gRPC dial, no Store/AuthorizationModel reconcilers, no FGA subroutines
• iam-service role projection sits behind an engine-neutral interface
• rebac-authz-webhook is not deployed and not registered on the kcp API server, which falls back to its in-process RBAC authorizer
• search-service starts and serves search with no OpenFGA connection, behind an engine-neutral authorizer interface
• golang-commons/fga is not on the import path of any component that must run without the module
• OpenFGA dashboards, alerts and scrape configs are deployed only when the module is enabled
• Install and bootstrap manifests deploy OpenFGA and its Postgres only when the module is enabled
• The backup service backs up the OpenFGA store only when it exists
• Store and AuthorizationModel CRDs remain installed in every composition; only their controllers are conditional
• The PlatformMesh CR exposes a single authorization toggle that the pm-operator translates into every component-level flag
• E2E test are successfull
• Documentation per component

Demo Required

Yes

Demo Steps

1. Deploy Platform Mesh with the authorization module disabled (composition S2). Show kubectl get pods: no OpenFGA, no OpenFGA Postgres, no rebac-authz-webhook. Show the kcp API server has no
   --authorization-webhook-config-file.
2. Create an organization and an account with kubectl. Show account-operator and
   security-operator reconciling cleanly, and the resulting AccountInfo with no fga block.
3. Show a second user's access being governed by the RBAC RoleBindings the security-operator
   creates as its baseline: they can get what they are bound to and are denied the rest.
4. Switch to a portal deployment (L1+L2+L4). Log in, browse, run a search - show results and the
   documented visibility semantics for the no-ReBAC case. Open the IAM UI: user directory and role
   catalog still work (iam-service is deployed), role-assignment controls behave as decided rather
   than erroring.
5. Show a green backup run and an observability dashboard with no OpenFGA panels and no firing
   alerts.
6. Show the S4 E2E suite still green: the full default stack is unchanged.