fix: handle EC parameters before TLS private keys

[jvlxz]

What type of PR is this?

fix

What this PR does / why we need it:

This PR fixes TLS Secret parsing when an ECDSA private key contains an EC PARAMETERS PEM block before the actual private key block.

Some tools, including OpenSSL workflows, can produce tls.key data shaped like:

-----BEGIN EC PARAMETERS-----
...
-----END EC PARAMETERS-----
-----BEGIN EC PRIVATE KEY-----
...
-----END EC PRIVATE KEY-----

Envoy Gateway previously decoded only the first PEM block from tls.key. When that first block was EC PARAMETERS, the Secret was rejected because EC PARAMETERS is not a private key format. That caused the Gateway listener to report an invalid certificate reference even though the same Secret also contained a valid EC PRIVATE KEY block.

The fix changes TLS key parsing to scan through PEM blocks and use the first supported private key block: PRIVATE KEY, RSA PRIVATE KEY, or EC PRIVATE KEY. If no supported private key block exists, Envoy Gateway still returns the existing validation error path using the first decoded PEM block type, so invalid Secrets continue to fail clearly.

This keeps compatibility with existing PKCS1, PKCS8, and EC private keys while accepting EC keys that include leading EC parameters.

Tests:

• go test ./internal/gatewayapi
• Local Kind HTTPS smoke test with a Secret whose tls.key starts with EC PARAMETERS

Which issue(s) this PR fixes:

Fixes #

Release Notes: No

[netlify]

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	91f0d18
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6a6072a738d39a000840fdcc
😎 Deploy Preview	https://deploy-preview-9338--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 886f3e1be0

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.60%. Comparing base (1917fcb) to head (91f0d18).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9338      +/-   ##
==========================================
+ Coverage   75.55%   75.60%   +0.04%     
==========================================
  Files         252      252              
  Lines       41742    41755      +13     
==========================================
+ Hits        31539    31568      +29     
+ Misses       8072     8058      -14     
+ Partials     2131     2129       -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[zhaohuabing]

Overall, this looks good.

Hi @jvlxz could you please fix DCO check by signing off the commits and resolve the merge conflicts? Thanks!

[zhaohuabing]

Nit, for clarity:

Suggested change

	// firstSupportedPrivateKeyBlock returns the first private key PEM block supported by the parsers below:
	// PKCS1, PKCS8, or EC. If none is found, it returns the first block so the caller can report its unsupported format.
	func firstSupportedPrivateKeyBlock(data []byte) *pem.Block {
	// privateKeyBlock returns the private key PEM block from the given data, skipping
	// any preceding non-key blocks such as the "EC PARAMETERS" block that tools like
	// OpenSSL emit ahead of an "EC PRIVATE KEY".
	//
	// If no supported private key block is found, it falls back to returning the first
	// block of any type (or nil if the data contains no PEM blocks at all) so the caller
	// can report a meaningful error about the unexpected block type rather than a generic
	// decode failure.
	func privateKeyBlock(data []byte) *pem.Block {

[zhaohuabing]

It seems that commit 98af8a3 has been reverted. cc @jvlxz

[jvlxz]

It seems that commit 98af8a3 has been reverted. cc @jvlxz

Thanks for catching this! I checked again and the change is still there, it got folded into the merge-conflict resolution and the helper was renamed. Still skips EC_PARAMETERS, behavior is the same.