Queue multi-level trust

[davidhadas]

Fixes #13979

Proposed Changes

• Moved Queue from InternalEncryption flag to Trust levels
• Support Queue mTLS
• Support Queue reloading updates in the certificate and CA from the secret

Release Note

We added alpha support for dataplane-trust network options of Queue including TLS or mTLS and an appropriate set of certificates to implement trust between Activator and Queue.

[knative-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: davidhadas
Once this PR has been reviewed and has the lgtm label, please assign pierdipi for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

Patch coverage: 3.33% and project coverage change: -0.49 ⚠️

Comparison is base (349b2d6) 86.21% compared to head (d8ec34f) 85.72%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #14063      +/-   ##
==========================================
- Coverage   86.21%   85.72%   -0.49%     
==========================================
  Files         199      200       +1     
  Lines       14767    14854      +87     
==========================================
+ Hits        12731    12734       +3     
- Misses       1734     1818      +84     
  Partials      302      302              

Impacted Files	Coverage Δ
pkg/queue/sharedmain/cache.go	0.00% <0.00%> (ø)
pkg/queue/sharedmain/main.go	0.85% <0.00%> (-0.02%)	⬇️
pkg/reconciler/revision/resources/deploy.go	90.13% <0.00%> (ø)
pkg/reconciler/revision/revision.go	92.13% <0.00%> (ø)
pkg/reconciler/revision/resources/queue.go	98.25% <100.00%> (+0.01%)	⬆️

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

[davidhadas]

/retest

istio-latest-no-mesh-tls_serving_main — Job failed.                     BaseSHA:349b2d61b0e82efda4f713e5d6f2c31f3fa9ff1c
Required
Details
@knative-prow
istio-latest-no-mesh_serving_main — Job failed.                     BaseSHA:349b2d61b0e82efda4f713e5d6f2c31f3fa9ff1c
Required
Details
@knative-prow
upgrade-tests_serving_main — Jo

[davidhadas]

Ready for review

/hold
merge after #13969

[davidhadas]

/retest

[knative-prow-robot]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[davidhadas]

See #13968