feat: add caCertCredentialName to ClientTLSSettings for Gateway API mTLS

[ericdbishop]

Mostly looking for initial feedback and discussion on this plan for implementing ClientAndServer TLS mode for XBackend, with this API change being a pre-requisite.

Will be accompanied by a PR for istio/istio#61403, and also relates to istio/istio#61515.

---

Proposing adding a caCertCredentialName field to ClientTLSSettings, like the existing caCertCredentialName under ServerTLSSettings #3544, for storing the CA trust bundle reference when using ClientAndServer TLS mode on XBackend, which frees up credentialName to store the XBackend clientCertificateRef.

The logic used for configuring the credentialName for XBackend ServerOnly mode (which is already implemented) is reused from BackendTLSPolicy; BackendTLSPolicy only uses SIMPLE TLS. Here is a scenario for establishing an mTLS connection which summarizes the current issue with implementing ClientAndServer TLS mode for XBackend:

1. Client (Gateway) connects to server (represented by XBackend).

2. Server presents it's cert.

3. Client verifies the cert is signed by using it's own CA trust bundle (delivered by istiod via SDS, held in a K8s ConfigMap for XBackend).

   • Here we face a problem; istiod always derives the client's trust bundle name as credentialName + "-cacert". In the case of XBackend, that means we ignore the ConfigMap declared on the XBackend custom resource under tls.validation.caCertificateRefs.

   • For the XBackend ServerOnly TLS mode (SIMPLE TLS), this is fine. We use ClientTLSSettings.credentialName to store the ConfigMap CA cert ref, since there is no client cert ref needed for ServerOnly mode with one-way TLS.

   • For ClientAndServer mode, however, there is no field in Istio's ClientTLSSettings to separately carry the client's CA certificate reference. The only relevant credential field in ClientTLSSettings is credentialName, which we must use to store the XBackend tls.clientCertificateRef (as it is a required field for ClientAndServer mode).

     • As an aside, istiod needs to authorize SDS requests using VerifiedCertificateReferences; this list includes the Gateway's server certificate refs as authorized resources, but not the XBackend clientCertificateRef.

   • Since there is no Secret at <cert name> + "-cacert", we can't verify the server's cert. We fail here.

4. The server requests the client's cert (mTLS part).

5. Client presents it's cert (which was configured under tls.clientCertificateRef)

6. The server verifies the cert against it's own CA, which is configured on the backend pod itself or otherwise not our concern.

[istio-policy-bot]

😊 Welcome @ericdbishop! This is either your first contribution to the Istio api repo, or it's been
a while since you've been here.

You can learn more about the Istio working groups, Code of Conduct, and contribution guidelines
by referring to Contributing to Istio.

Thanks for contributing!

Courtesy of your friendly welcome wagon.