Backport of [NET-8091] Add file-system-certificate config entry for API gateway into release/1.18.x

[hc-github-team-consul-core]

Backport

This PR is auto-generated from #20873 to be assessed for backporting due to the inclusion of the label backport/1.18.

🚨

Warning automatic cherry-pick of commits failed. If the first commit failed,
you will see a blank no-op commit below. If at least one commit succeeded, you
will see the cherry-picked commits up to, not including, the commit where
the merge conflict occurred.

The person who merged in the original PR is:
@missylbytes
This person should manually cherry-pick the original PR into a new backport PR,
and close this one when the manual backport PR is merged in.

merge conflict error: POST https://api.github.com/repos/hashicorp/consul/merges: 409 Merge conflict []

The below text is copied from the body of the original PR.

---

Description

Today, inline-certificate is the only supported way of specifying a TLS certificate + private key for an api-gateway. As the name suggests, the certificate + private key values are "inlined" in the configuration entry.

This PR adds a new file-system-certificate configuration entry that instead accepts file paths to a certificate + private key that are accessible in the local file system of the api-gateway at runtime. This functions in the same way that terminating-gateway does today (docs) but adds support for rotation by watching the file system for changes to the referenced certificate + private key.

Ideally, we will be able to add this same support for rotation in terminating-gateway in the future as rotating the certificate and private key today require a restart of the terminating-gateway, which is not ideal (docs).

Testing & Reproduction steps

Testing on VMs

Check out this repo from @nathancoleman

1. Follow the directions in the README.
2. You can check the secret at http://localhost:19000/config_dump under dynamic_active_secrets.

3. echo secret_val | base64 -d and you should see the value of cert.crt

4. Replace the value of cert.crt with this certificate:

-----BEGIN CERTIFICATE-----
MIICnTCCAkOgAwIBAgIRALTzFaRsW70V2hhpw6XdmKEwCgYIKoZIzj0EAwIwgbkx
CzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNj
bzEaMBgGA1UECRMRMTAxIFNlY29uZCBTdHJlZXQxDjAMBgNVBBETBTk0MTA1MRcw
FQYDVQQKEw5IYXNoaUNvcnAgSW5jLjFAMD4GA1UEAxM3Q29uc3VsIEFnZW50IENB
IDMwNzU0NzMzNjE5NTQ2OTU4MjIxMTI5MjE3NzM2MzUxMzM4MDc0NzAeFw0yNDA0
MDkxODIxNDNaFw0yNTA0MDkxODIxNDNaMBwxGjAYBgNVBAMTEXNlcnZlci5kYzEu
Y29uc3VsMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAESdiYfmA1LURAFLGt59hu
U3UgTMcSAIf3Hl+KYrDRWStjviB4ueemTI+8pXjd8gETXKxp+i5vxIBF9bW95zSb
2KOBxzCBxDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG
AQUFBwMCMAwGA1UdEwEB/wQCMAAwKQYDVR0OBCIEIJ32ryqpgyOlctlfqniwLBCt
HosjcftQwK1rjoI6LFnCMCsGA1UdIwQkMCKAICJ9E1X61c/+gkiHJmmiQkVx3g89
MkOYHfJlRoTQlpNpMC0GA1UdEQQmMCSCEXNlcnZlci5kYzEuY29uc3Vsgglsb2Nh
bGhvc3SHBH8AAAEwCgYIKoZIzj0EAwIDSAAwRQIhAKvSL4YDwQPMNgGMibtRTYRs
cHZzR4Vv1JN6D2FDmVYUAiBT+6ySH0bXK9/kFA+RkTbPUwDzfe+qlzs+frK5tqE+
Dw==
-----END CERTIFICATE--

5. Then check the value of the dynamic_active_secrets again, it should match the above cert.

Testing on K8S

You cannot do the same type of replacement for K8S, so if you would like to test K8S check out the K8S PR. You will mainly verify that the certificate is a file-system-certificate as opposed to an inline-certificate.

Links

PR Checklist

• updated test coverage
• external facing docs updated
• appropriate backport labels added
• not a security concern

---

Overview of commits

• 6955d46 - f3d8256 - 9d4dcb6 - cfd5591 - 8350b38 - 05d1581 - fa58f58 - 6eb7cfd - 8c2e147 - 27ade58 - 2287dda - 38c6dca - 5da0b48 - c4ab67b - f23a33d - 217bcbd - ef476b3 - 2a44afa - 76483f1 - b48c277 - f30c1cf

[github-team-consul-core-pr-approver]

Auto approved Consul Bot automated PR

[missylbytes]

This will not be backported to 1.18 at this time.