backendconfigpolicy: add ssl config

[puertomontt]

Description

Implement #10771.
Expose envoy SSL config options for clusters. Code is largely based on https://github.com/solo-io/gloo/blob/main/projects/gloo/pkg/utils/ssl.go.

• didn't expose ocspStaplePolicy since it only applies downstream. same with disableTlsSessionResumption
• transportSocketConnectTimeout is present in gloo ssl config but isn't actually used so I didn't port it.
• didn't port the sds config, tracked in Support File or SDS based cert type #11073

Change Type

/kind new_feature

Changelog

backendconfigpolicy: add ssl config

Additional Notes

[Copilot]

Pull Request Overview

This PR adds SSL origination support to the BackendConfigPolicy API and its implementation.

• Introduces a new SSLConfig field in the CRD, API types, and generated apply configurations.
• Implements translateSSLConfig to convert SSLConfig into an Envoy UpstreamTlsContext and integrates it into the plugin.
• Adds YAML test fixtures and comprehensive unit tests for SSL configuration translation.

Reviewed Changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
api/v1alpha1/backend_config_policy_types.go	Adds SSLConfig, SSLFiles, SSLParameters, and related fields.
internal/kgateway/extensions2/plugins/backendconfigpolicy/ssl.go	Implements translation of SSLConfig into Envoy TLS contexts.
internal/kgateway/extensions2/plugins/backendconfigpolicy/plugin.go	Integrates SSL transport socket into the plugin IR and processing.
internal/kgateway/extensions2/plugins/backendconfigpolicy/ssl_test.go	Adds unit tests for various SSLConfig scenarios.
install/helm/kgateway-crds/templates/gateway.kgateway.dev_backendconfigpolicies.yaml	Extends CRD template with SSLConfig schema and validations.

Comments suppressed due to low confidence (2)

internal/kgateway/extensions2/plugins/backendconfigpolicy/plugin.go:227

• Variable name 'ir' shadows the imported package 'ir'. Consider renaming the variable to 'policyIR' or similar for clarity.

ir := BackendConfigPolicyIR{

internal/kgateway/extensions2/plugins/backendconfigpolicy/ssl.go:217

• [nitpick] Function name 'cleanedSslKeyPair' uses mixed-case for 'Ssl'; consider renaming to 'cleanedSSLKeyPair' to follow Go initialism conventions.

func cleanedSslKeyPair(certChain, privateKey, rootCa string) (cleanedChain string, err error) {

[Copilot]

Pull Request Overview

This PR adds support for SSL/TLS origination in BackendConfigPolicy by exposing Envoy upstream TLS options and wiring them through the plugin and IR. It also updates test fixtures, CRD schemas, and generated code to include the new SSLConfig types and increases timeouts in setup tests.

• Introduce SSLConfig, SSLFiles, SSLParameters, and related deep-copy, apply-configuration, and CRD schema entries
• Implement translateSSLConfig and integrate UpstreamTlsContext into the plugin and IR
• Update test data and increase timeouts; add debug prints in secret lookup

Reviewed Changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
api/v1alpha1/backend_config_policy_types.go	Add SSLConfig, SSLFiles, SSLParameters to spec
internal/kgateway/extensions2/plugins/backendconfigpolicy/ssl.go	Implement translation of SSLConfig into Envoy UpstreamTlsContext
internal/kgateway/extensions2/plugins/backendconfigpolicy/plugin.go	Wire TransportSocket when SSLConfig is present
internal/kgateway/extensions2/pluginutils/secrets.go	Leftover debug fmt.Println calls in secret retrieval
internal/kgateway/setup/setup_test.go	Increased fixed Sleep and test timeout duration
internal/kgateway/setup/testdata/standard/backendconfigpolicy-ssl.yaml	Add SSL settings to example Gateway/BackendConfigPolicy
internal/kgateway/setup/testdata/standard/backendconfigpolicy-ssl-out.yaml	Updated expected XDS output including TLS config
install/helm/kgateway-crds/templates/gateway.kgateway.dev_backendconfigpolicies.yaml	Add CRD schema for sslConfig and validation rule
api/applyconfiguration/{utils.go, internal/internal.go, api/v1alpha1/*.go}	Extend apply-configuration for new SSLConfig types

[npolshakova]

Are we going to eventually support SDSConfig? https://github.com/solo-io/gloo/blob/32c9ffde5db865befcea872f60cac01384c8a703/projects/gloo/api/v1/ssl/ssl.proto#L16 Do we want to create a follow up issue for that?

[puertomontt]

#11073

[npolshakova]

Do we want to add this as a todo and mark it as a good first issue once this goes in with the base API?