TLS Passthrough support

[chauhanshubham]

This commit adds a tlsroute controller which is further used to
configure tls passthrough in envoy.

Testing Done

1. Deployed the nginx application as mentioned here: https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-sni-passthrough/

2. Applied gateway configs as follows

apiVersion: gateway.networking.k8s.io/v1alpha2
kind: Gateway
metadata:
  name: eg
spec:
  gatewayClassName: eg
  listeners:
    - name: tls
      protocol: TLS
      tls:
        mode: Passthrough
      port: 8080

apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TLSRoute
metadata:
  name: tlsroute
spec:
  parentRefs:
    - name: eg
  hostnames:
    - "nginx.example.com"
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: my-nginx
          port: 443
          weight: 1

3. To test traffic

$ kubectl -n envoy-gateway-system port-forward service/envoy-default-eg 8888:8080

$ curl -v --resolve nginx.example.com:8888:127.0.0.1 https://nginx.example.com:8888 --cacert testing/tls-passthrough/example.com.crt
* Added nginx.example.com:8888:127.0.0.1 to DNS cache
* Hostname nginx.example.com was found in DNS cache
*   Trying 127.0.0.1:8888...
* Connected to nginx.example.com (127.0.0.1) port 8888 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*  CAfile: personal/tls-passthrough/example.com.crt
*  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* ... **collapsed for brevity**
* TLSv1.2 (IN), TLS handshake, Finished (20):
* Server certificate:
*  subject: CN=nginx.example.com; O=some organization
*  start date: Oct  8 05:48:33 2022 GMT
*  expire date: Oct  8 05:48:33 2023 GMT
*  common name: nginx.example.com (matched)
*  issuer: O=example Inc.; CN=example.com
*  SSL certificate verify ok.
> GET / HTTP/1.1
> Host: nginx.example.com:8888
> User-Agent: curl/7.77.0
> Accept: */*
>
... **collapsed for brevity**
<title>Welcome to nginx!</title>
... **collapsed for brevity**
* Connection #0 to host nginx.example.com left intact

Fixes #168
Signed-off-by: Shubham Chauhan shubham@tetrate.io

[codecov-commenter]

Codecov Report

Merging #402 (88d2df3) into main (b8f234b) will decrease coverage by 0.22%.
The diff coverage is 63.64%.

@@            Coverage Diff             @@
##             main     #402      +/-   ##
==========================================
- Coverage   62.72%   62.49%   -0.23%     
==========================================
  Files          42       45       +3     
  Lines        4496     5301     +805     
==========================================
+ Hits         2820     3313     +493     
- Misses       1532     1798     +266     
- Partials      144      190      +46     

Impacted Files	Coverage Δ
internal/cmd/server.go	7.75% <0.00%> (-0.14%)	⬇️
internal/ir/infra.go	67.41% <ø> (ø)
internal/ir/zz_generated.deepcopy.go	0.00% <0.00%> (ø)
internal/provider/kubernetes/kubernetes.go	53.48% <0.00%> (-4.02%)	⬇️
internal/status/status.go	0.00% <0.00%> (ø)
internal/gatewayapi/helpers_v1alpha2.go	28.88% <28.88%> (ø)
internal/gatewayapi/helpers.go	67.52% <40.00%> (+0.85%)	⬆️
internal/gatewayapi/runner/runner.go	53.77% <42.85%> (-0.78%)	⬇️
internal/xds/translator/translator.go	72.04% <60.00%> (-2.65%)	⬇️
internal/provider/kubernetes/tlsroute.go	60.56% <60.56%> (ø)
... and 13 more

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[chauhanshubham]

This requires two one more no thing

1. adding tlsroute status updates to be implemented, similar to httproutes in send resource statuses using watchable #395
2. update tlsroute controller to listen and validate gateway parent Adds Gateway Watch to HTTPRoute Controller #403
   I can take these up separately if this PR is getting too long

Above tasks were added as part of this PR
Minor pending action items include,

1. including tlsroute in demo profile
2. doc updates

[danehans]

@chauhanshubham the Kube provider RBAC needs to be updated for TLSRoutes.

[danehans]

One nit. Otherwise, can you create tlsroute integration test similar to this?

[chauhanshubham]

This attempts to delete a possibly non-existent Service, and not the relevant ones. It is introducing an issue in the tlsroute controller, which was present for httproute controller too. I have filed an issue for this here #536

[arkodg]

LGTM, thanks for spending the extra cycles to get TLS Passthrough support in for 0.2.0 !