use shared system trust store sds secret

Signed-off-by: Guy Daich <guy.daich@sap.com>

Author: guydc

internal/gatewayapi/globalresources.go

@@ -47,16 +47,22 @@ func (t *Translator) ProcessGlobalResources(resources *resource.Resources, xdsIR
 	}
 
 	for _, xdsIR := range xdsIRs {
-		if containsGlobalRateLimit(xdsIR.HTTP) || containsWasm(xdsIR.HTTP) {
+		hasRateLimit, hasWasm, hasSystemTrustStore := scanXdsIR(xdsIR)
+		if hasRateLimit || hasWasm || hasSystemTrustStore {
 			if xdsIR.GlobalResources == nil {
 				xdsIR.GlobalResources = &ir.GlobalResources{}
 			}
+		}
+		if hasRateLimit || hasWasm {
 			xdsIR.GlobalResources.EnvoyClientCertificate = &ir.TLSCertificate{
 				Name:        irGlobalConfigName(envoyTLSSecret),
 				Certificate: envoyTLSSecret.Data[corev1.TLSCertKey],
 				PrivateKey:  envoyTLSSecret.Data[corev1.TLSPrivateKeyKey],
 			}
 		}
+		if hasSystemTrustStore {
+			xdsIR.GlobalResources.UseSystemTrustStore = true
+		}
 	}
 
 	return nil
@@ -101,27 +107,47 @@ func irGlobalConfigName(object metav1.Object) string {
 	return fmt.Sprintf("%s/%s", object.GetNamespace(), object.GetName())
 }
 
-func containsGlobalRateLimit(httpListeners []*ir.HTTPListener) bool {
-	for _, httpListener := range httpListeners {
-		for _, route := range httpListener.Routes {
-			if route.Traffic != nil &&
+// scanXdsIR scans the xDS IR in a single pass and returns flags for features
+// that require global resources to be created.
+func scanXdsIR(xdsIR *ir.Xds) (hasGlobalRateLimit, hasWasm, hasSystemTrustStore bool) {
+	for _, http := range xdsIR.HTTP {
+		for _, route := range http.Routes {
+			if !hasGlobalRateLimit && route.Traffic != nil &&
 				route.Traffic.RateLimit != nil &&
 				route.Traffic.RateLimit.Global != nil {
-				return true
+				hasGlobalRateLimit = true
+			}
+			if !hasWasm && route.EnvoyExtensions != nil &&
+				len(route.EnvoyExtensions.Wasms) > 0 {
+				hasWasm = true
+			}
+			if !hasSystemTrustStore && route.Destination != nil {
+				for _, ds := range route.Destination.Settings {
+					if ds.TLS != nil && ds.TLS.UseSystemTrustStore {
+						hasSystemTrustStore = true
+						break
+					}
+				}
+			}
+			if hasGlobalRateLimit && hasWasm && hasSystemTrustStore {
+				return hasGlobalRateLimit, hasWasm, hasSystemTrustStore
 			}
 		}
 	}
-	return false
-}
-
-func containsWasm(httpListeners []*ir.HTTPListener) bool {
-	for _, httpListener := range httpListeners {
-		for _, route := range httpListener.Routes {
-			if route.EnvoyExtensions != nil &&
-				len(route.EnvoyExtensions.Wasms) > 0 {
-				return true
+	if !hasSystemTrustStore {
+		for _, tcp := range xdsIR.TCP {
+			for _, route := range tcp.Routes {
+				if route.Destination == nil {
+					continue
+				}
+				for _, ds := range route.Destination.Settings {
+					if ds.TLS != nil && ds.TLS.UseSystemTrustStore {
+						hasSystemTrustStore = true
+						return hasGlobalRateLimit, hasWasm, hasSystemTrustStore
+					}
+				}
 			}
 		}
 	}
-	return false
+	return hasGlobalRateLimit, hasWasm, hasSystemTrustStore
 }

internal/gatewayapi/testdata/backend-tls-settings.out.yaml

@@ -1016,6 +1016,7 @@ xdsIR:
             sectionName: "8080"
           name: envoy-gateway/gateway-1
           protocol: TCP
+      useSystemTrustStore: true
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -1397,6 +1398,7 @@ xdsIR:
             sectionName: "8080"
           name: envoy-gateway/gateway-2-with-backend-tls
           protocol: TCP
+      useSystemTrustStore: true
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -1485,6 +1487,7 @@ xdsIR:
             sectionName: "8080"
           name: envoy-gateway/gateway-3-without-backend-tls
           protocol: TCP
+      useSystemTrustStore: true
     http:
     - address: 0.0.0.0
       externalPort: 80

internal/gatewayapi/testdata/backendtlspolicy-serviceimport-target.out.yaml

@@ -165,6 +165,7 @@ xdsIR:
             sectionName: "8080"
           name: envoy-gateway/gateway-btls
           protocol: TCP
+      useSystemTrustStore: true
     http:
     - address: 0.0.0.0
       externalPort: 80

internal/gatewayapi/testdata/backendtlspolicy-system-truststore.out.yaml

@@ -154,6 +154,7 @@ xdsIR:
             sectionName: "8080"
           name: envoy-gateway/gateway-btls
           protocol: TCP
+      useSystemTrustStore: true
     http:
     - address: 0.0.0.0
       externalPort: 80

internal/gatewayapi/testdata/envoyproxy-tls-settings.out.yaml

@@ -250,6 +250,7 @@ xdsIR:
             sectionName: "8080"
           name: envoy-gateway/gateway-tls
           protocol: TCP
+      useSystemTrustStore: true
     http:
     - address: 0.0.0.0
       externalPort: 443

internal/gatewayapi/testdata/gateway-tls-frontend-backend.out.yaml

@@ -1810,6 +1810,7 @@ xdsIR:
             sectionName: "8080"
           name: envoy-gateway/invalid-gateway-backend-client-cert-no-fallback
           protocol: TCP
+      useSystemTrustStore: true
     http:
     - address: 0.0.0.0
       externalPort: 8080

internal/gatewayapi/testdata/httproute-dynamic-resolver-host-rewriting.out.yaml

@@ -297,6 +297,7 @@ xdsIR:
             sectionName: "8080"
           name: envoy-gateway/gateway-1
           protocol: TCP
+      useSystemTrustStore: true
     http:
     - address: 0.0.0.0
       externalPort: 80

internal/gatewayapi/testdata/httproute-dynamic-resolver.out.yaml

@@ -192,6 +192,7 @@ xdsIR:
             sectionName: "8080"
           name: envoy-gateway/gateway-1
           protocol: TCP
+      useSystemTrustStore: true
     http:
     - address: 0.0.0.0
       externalPort: 80

internal/gatewayapi/testdata/httproute-rule-with-non-service-backends-and-websocket-app-protocols.out.yaml

@@ -247,6 +247,7 @@ xdsIR:
             sectionName: "8080"
           name: envoy-gateway/gateway-1
           protocol: TCP
+      useSystemTrustStore: true
     http:
     - address: 0.0.0.0
       externalPort: 80

internal/gatewayapi/testdata/httproute-with-tls-and-http.out.yaml

@@ -179,6 +179,7 @@ xdsIR:
             sectionName: "8080"
           name: envoy-gateway/gateway-1
           protocol: TCP
+      useSystemTrustStore: true
     http:
     - address: 0.0.0.0
       externalPort: 80