feat(gateway): support extra trusted CAs via additionalTrustedCAs (3.9)

[jarvis9443]

Problem

The gateway's outbound trust store (apisix.ssl.ssl_trusted_certificate) is exposed through a single CA-file slot: gateway.tls.existingCASecret + gateway.tls.certCAFilename, which render to ssl_trusted_certificate: "system,/usr/local/apisix/conf/ssl/<certCAFilename>".

In a Control Plane-managed deployment that slot is already taken: the CP sets existingCASecret=<release>-tls / certCAFilename=ca.crt (the CP/DP-Manager CA), and the gateway verifies the CP over this same trust store because etcd.auth.tls.verify=true. With only one slot, users who need the gateway to trust an additional private/enterprise CA — e.g. an openid-connect identity provider reached over TLS — had no clean way to add one.

Change

Add gateway.tls.additionalTrustedCAs, a list of { secretName, filename } entries. For each entry the chart mounts filename from Secret secretName into the gateway at /usr/local/apisix/conf/ssl/additional-ca-<i>/ and appends that path to ssl_trusted_certificate. The rendered value becomes system,<existingCA>,<additional...>, so the system CA bundle and the existing CP CA are both preserved. The ssl_trusted_certificate value is refactored into a gateway.sslTrustedCertificate helper.

gateway:
  tls:
    additionalTrustedCAs:
      - secretName: keycloak-ca
        filename: keycloak-ca.crt

Behavior / compatibility

• When additionalTrustedCAs is empty (default), rendering is byte-identical to before — no change for existing deployments.
• Takes effect after a gateway Pod restart, because APISIX merges the trust store into a combined file at startup.

3.9 chart line of #317. Chart version bumped 3.9.5 → 3.9.6; README.md regenerated via helm-docs.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 19a62cd0-a6e9-4e30-97d9-d084bcec892f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/gateway-additional-trusted-cas-3.9

---

_{Comment @coderabbitai help to get the list of available commands.}