use sds to fetch the client certificate for envoy-ratelimit TLS connections

[zhaohuabing]

This PR uses SDS to fetch the envoy client certificate, and enables Global ratelimit test for gatewaynamepace mode.

[codecov]

Codecov Report

Attention: Patch coverage is 82.05128% with 28 lines in your changes missing coverage. Please review.

Project coverage is 70.47%. Comparing base (452651b) to head (0e27f32).
Report is 5 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/xds/translator/globalresources.go	80.00%	11 Missing and 5 partials ⚠️
internal/provider/kubernetes/controller.go	76.00%	6 Missing ⚠️
internal/provider/kubernetes/predicates.go	66.66%	2 Missing and 1 partial ⚠️
internal/xds/translator/translator.go	0.00%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5988      +/-   ##
==========================================
- Coverage   70.50%   70.47%   -0.04%     
==========================================
  Files         217      219       +2     
  Lines       36191    36315     +124     
==========================================
+ Hits        25517    25593      +76     
- Misses       9160     9199      +39     
- Partials     1514     1523       +9     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[zhaohuabing]

The serverCertificate IR Certificate struct yaml key should be renamed to certificate.

This rename also affects many existing test files. To make the review easier, I'll raise a follow-up PR to change this to limit the scope of this PR.

[arkodg]

hey @zhaohuabing can you help understand why default mode implementation doesn't work in gateway namespace mode

[zhaohuabing]

hey @zhaohuabing can you help understand why default mode implementation doesn't work in gateway namespace mode

EG mounts the "envoy" secret to the envoy container, which holds the client cert used by envoy to establish TLS connections with the rate limit service. But this secret is not available in the the namespaces except the envoy-gateway-system namespace.

This PR loads the "envoy" secret from the envoy -gateway-system and push it to envoy through xDS.

[arkodg]

Ah this is for communication b/w envoy and RL service, thanks for the clarification

[zirain]

we may need same thing for wasm cache service.

[zhaohuabing]

we may need same thing for wasm cache service.

Yeah will try to figure out why wasm test fails and address it in a follow up pr.

[arkodg]

LGTM thanks !