fix(envoyconfig): use DNS SAN type for MatchTypedSubjectAltNames

Diego container identity certs use DNSNames (container GUID + internal routes),
not URI SANs. Hardcode SanType=DNS to match actual cert structure.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: ameowlia

src/code.cloudfoundry.org/executor/depot/containerstore/proxy_config_handler_test.go

@@ -625,7 +625,7 @@ var _ = Describe("ProxyConfigHandler", func() {
 				chainedCert := fmt.Sprintf("%s%s", cert, cert)
 				containerProxyTrustedCACerts = []string{cert, chainedCert}
 				inlinedCert = fmt.Sprintf("%s%s", cert, chainedCert)
-				containerProxyVerifySubjectAltName = []string{"spiffe://cf.internal/app", "gorouter.service.cf.internal"}
+				containerProxyVerifySubjectAltName = []string{"valid-alt-name-1", "valid-alt-name-2"}
 			})
 
 			It("creates appropriate sds-id-validation-context.yaml configuration file", func() {
@@ -651,8 +651,8 @@ var _ = Describe("ProxyConfigHandler", func() {
 							},
 						},
 						MatchTypedSubjectAltNames: []*envoy_tls.SubjectAltNameMatcher{
-							{SanType: envoy_tls.SubjectAltNameMatcher_URI, Matcher: &envoy_matcher.StringMatcher{MatchPattern: &envoy_matcher.StringMatcher_Exact{Exact: "spiffe://cf.internal/app"}}},
-							{SanType: envoy_tls.SubjectAltNameMatcher_DNS, Matcher: &envoy_matcher.StringMatcher{MatchPattern: &envoy_matcher.StringMatcher_Exact{Exact: "gorouter.service.cf.internal"}}},
+							{SanType: envoy_tls.SubjectAltNameMatcher_DNS, Matcher: &envoy_matcher.StringMatcher{MatchPattern: &envoy_matcher.StringMatcher_Exact{Exact: "valid-alt-name-1"}}},
+							{SanType: envoy_tls.SubjectAltNameMatcher_DNS, Matcher: &envoy_matcher.StringMatcher{MatchPattern: &envoy_matcher.StringMatcher_Exact{Exact: "valid-alt-name-2"}}},
 						},
 					},
 				}))

src/code.cloudfoundry.org/executor/envoyconfig/config.go

@@ -422,12 +422,8 @@ func generateSDSCAResourceSecret(container executor.Container, idCred Credential
 	}
 	var matchers []*envoy_tls.SubjectAltNameMatcher
 	for _, s := range subjectAltNames {
-		sanType := envoy_tls.SubjectAltNameMatcher_DNS
-		if strings.Contains(s, "://") {
-			sanType = envoy_tls.SubjectAltNameMatcher_URI
-		}
 		matchers = append(matchers, &envoy_tls.SubjectAltNameMatcher{
-			SanType: sanType,
+			SanType: envoy_tls.SubjectAltNameMatcher_DNS,
 			Matcher: &envoy_matcher.StringMatcher{MatchPattern: &envoy_matcher.StringMatcher_Exact{Exact: s}},
 		})
 	}

src/code.cloudfoundry.org/executor/envoyconfig/config_test.go

@@ -134,18 +134,18 @@ func TestGenerateSDSCAResource(t *testing.T) {
 	container := executor.Container{Guid: "meow-guid"}
 	idCred := Credential{}
 	trusted := []string{}
-	yaml, err := GenerateSDSCAResource(container, idCred, trusted, []string{"spiffe://meow", "gorouter.service.cf.internal"})
+	yaml, err := GenerateSDSCAResource(container, idCred, trusted, []string{"some-guid.cf.internal", "gorouter.service.cf.internal"})
 	if err != nil {
 		t.Fatal(err)
 	}
 	if !bytes.Contains(yaml, []byte("id-validation-context")) {
 		t.Error("YAML missing validation context name")
 	}
-	if !bytes.Contains(yaml, []byte("spiffe://meow")) {
-		t.Error("YAML missing URI SAN")
+	if !bytes.Contains(yaml, []byte("some-guid.cf.internal")) {
+		t.Error("YAML missing first DNS SAN")
 	}
 	if !bytes.Contains(yaml, []byte("gorouter.service.cf.internal")) {
-		t.Error("YAML missing DNS SAN")
+		t.Error("YAML missing second DNS SAN")
 	}
 }