refactor: address review feedback on frontendValidation mTLS

- ssl: validate that the CA ConfigMap contains a PEM CERTIFICATE block,
  rejecting empty/whitespace-only/malformed data before it reaches the
  downstream mTLS trust anchor.
- translator: reject caCertificateRefs with a non-core API group, matching
  the listener-status validation.
- status: scope frontendValidation checks to Terminate listeners.
- test: fix unknown-plugin error matching for api7ee (Dashboard wraps the
  message across lines); add group/malformed-CA translator test cases.

Author: AlinsRan

internal/adc/translator/gateway.go

@@ -23,6 +23,7 @@ import (
 	"strings"
 
 	"github.com/pkg/errors"
+	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
 	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
 
@@ -153,7 +154,10 @@ func (t *Translator) translateFrontendValidation(tctx *provider.TranslateContext
 
 	cas := make([]string, 0, len(listener.TLS.FrontendValidation.CACertificateRefs))
 	for _, ref := range listener.TLS.FrontendValidation.CACertificateRefs {
-		// Core support is limited to ConfigMap references.
+		// Core support is limited to ConfigMap references in the core API group.
+		if ref.Group != "" && string(ref.Group) != corev1.GroupName {
+			return nil, fmt.Errorf("unsupported frontendValidation caCertificateRef group %q in listener %s, only the core group is supported", ref.Group, listener.Name)
+		}
 		if ref.Kind != "" && string(ref.Kind) != internaltypes.KindConfigMap {
 			return nil, fmt.Errorf("unsupported frontendValidation caCertificateRef kind %q in listener %s, only ConfigMap is supported", ref.Kind, listener.Name)
 		}

internal/adc/translator/gateway_test.go

@@ -33,7 +33,15 @@ import (
 	"github.com/apache/apisix-ingress-controller/internal/provider"
 )
 
-const testCACert = "-----BEGIN CERTIFICATE-----\nMIIBCA-test-ca\n-----END CERTIFICATE-----"
+const testCACert = `-----BEGIN CERTIFICATE-----
+MIIBQzCB6qADAgECAgEBMAoGCCqGSM49BAMCMBIxEDAOBgNVBAMTB3Rlc3QtY2Ew
+HhcNNzAwMTAxMDAwMDAwWhcNMzgwMTE5MDMxNDA4WjASMRAwDgYDVQQDEwd0ZXN0
+LWNhMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJo4AsM30ZHN+mYeHjqwceGBz
+V2bMz1+OyNXuaPYVrSF7HShZhanOYNHb6QLNhjGxMsBDQHVLolPjyTQJp9R5GqMx
+MC8wDgYDVR0PAQH/BAQDAgIEMB0GA1UdDgQWBBRzjh0YVmnpN/cFJziO0aYySuti
+4DAKBggqhkjOPQQDAgNIADBFAiEA7fEGiQA7wX0LrrkRH4KplAPOgVV5Kvm/1dv1
+3TLq9ssCIHKkv2dhydRvv36KC1WsRDcrl7W+7YmEnCS9PZfb8agM
+-----END CERTIFICATE-----`
 
 func newTLSGateway(frontendValidation *gatewayv1.FrontendTLSValidation) *gatewayv1.Gateway {
 	return &gatewayv1.Gateway{
@@ -136,4 +144,33 @@ func TestTranslateSecret_FrontendValidation(t *testing.T) {
 		_, err := tr.translateSecret(tctx, gateway.Spec.Listeners[0], gateway)
 		require.Error(t, err)
 	})
+
+	t.Run("unsupported CA ref group returns error", func(t *testing.T) {
+		tr := &Translator{Log: logr.Discard()}
+		gateway := newTLSGateway(&gatewayv1.FrontendTLSValidation{
+			CACertificateRefs: []gatewayv1.ObjectReference{
+				{Group: "example.com", Kind: "ConfigMap", Name: "ca-cm"},
+			},
+		})
+		tctx := newTranslateContextWithTLS()
+
+		_, err := tr.translateSecret(tctx, gateway.Spec.Listeners[0], gateway)
+		require.Error(t, err)
+	})
+
+	t.Run("malformed CA data returns error", func(t *testing.T) {
+		tr := &Translator{Log: logr.Discard()}
+		gateway := newTLSGateway(&gatewayv1.FrontendTLSValidation{
+			CACertificateRefs: []gatewayv1.ObjectReference{
+				{Kind: "ConfigMap", Name: "ca-cm"},
+			},
+		})
+		tctx := newTranslateContextWithTLS()
+		tctx.ConfigMaps[types.NamespacedName{Namespace: "default", Name: "ca-cm"}] = &corev1.ConfigMap{
+			Data: map[string]string{corev1.ServiceAccountRootCAKey: "   not a pem cert   "},
+		}
+
+		_, err := tr.translateSecret(tctx, gateway.Spec.Listeners[0], gateway)
+		require.Error(t, err)
+	})
 }

internal/controller/utils.go

@@ -941,7 +941,9 @@ func getListenerStatus(
 				}
 			}
 
-			if listener.TLS.FrontendValidation != nil {
+			// frontendValidation (downstream mTLS) only applies to Terminate listeners.
+			if listener.TLS.FrontendValidation != nil &&
+				(listener.TLS.Mode == nil || *listener.TLS.Mode == gatewayv1.TLSModeTerminate) {
 				validateListenerFrontendValidation(ctx, mrgc, gateway, listener.TLS.FrontendValidation, &conditionResolvedRefs, &conditionProgrammed)
 			}
 		}

internal/ssl/util.go

@@ -91,13 +91,36 @@ func ExtractCAFromConfigMap(cm *corev1.ConfigMap) ([]byte, error) {
 	if cm == nil {
 		return nil, ErrMissingCert
 	}
-	if ca, ok := cm.Data[corev1.ServiceAccountRootCAKey]; ok && ca != "" {
-		return []byte(ca), nil
+	var ca []byte
+	if v, ok := cm.Data[corev1.ServiceAccountRootCAKey]; ok && v != "" {
+		ca = []byte(v)
+	} else if v, ok := cm.BinaryData[corev1.ServiceAccountRootCAKey]; ok && len(v) > 0 {
+		ca = v
 	}
-	if ca, ok := cm.BinaryData[corev1.ServiceAccountRootCAKey]; ok && len(ca) > 0 {
-		return ca, nil
+	if len(ca) == 0 {
+		return nil, ErrMissingCert
+	}
+	// Reject whitespace-only or otherwise malformed data so an invalid trust
+	// anchor never reaches the downstream mTLS configuration.
+	if !hasCertificatePEMBlock(ca) {
+		return nil, ErrInvalidPEM
+	}
+	return ca, nil
+}
+
+// hasCertificatePEMBlock reports whether data contains at least one PEM-encoded
+// CERTIFICATE block.
+func hasCertificatePEMBlock(data []byte) bool {
+	for {
+		var block *pem.Block
+		block, data = pem.Decode(data)
+		if block == nil {
+			return false
+		}
+		if block.Type == "CERTIFICATE" {
+			return true
+		}
 	}
-	return nil, ErrMissingCert
 }
 
 // ExtractHostsFromCertificate parses the certificate PEM block and returns the DNS names.

test/e2e/crds/v2/status.go

@@ -145,7 +145,7 @@ spec:
 					And(
 						ContainSubstring(`status: "False"`),
 						ContainSubstring(`reason: SyncFailed`),
-						ContainSubstring(`(non-existent-plugin) not found`),
+						MatchRegexp(`(?s)\(non-existent-plugin\)\s+not found`),
 					),
 				)
 			}