Feat: upgrade gateway api to latest (#3160)

pkg/ingress/kube/gateway/istio/testdata/backend-tls-policy.yaml

@@ -1,4 +1,58 @@
-apiVersion: gateway.networking.k8s.io/v1alpha3
+# echo-https must be created by the kube-client, because it's used in a test
+# that verifies `sectionName`, which is internally read from krt,
+# so it could be just a `model.ServiceInstance`
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: GatewayClass
+metadata:
+  name: higress
+spec:
+  controllerName: higress.io/gateway-controller
+---
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: Gateway
+metadata:
+  name: gateway
+  namespace: higress-system
+spec:
+  addresses:
+    - value: higress-gateway
+      type: Hostname
+  gatewayClassName: higress
+  listeners:
+    - name: default
+      hostname: "*.domain.example"
+      port: 80
+      protocol: HTTP
+---
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: HTTPRoute
+metadata:
+  name: http
+  namespace: higress-system
+spec:
+  parentRefs:
+    - name: gateway
+  rules:
+    - backendRefs:
+        - name: echo-https
+          namespace: default
+          port: 80
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: echo-https
+  namespace: default
+spec:
+  ports:
+    - name: http
+      port: 80
+      protocol: TCP
+    - name: https
+      port: 443
+      protocol: TCP
+---
+apiVersion: gateway.networking.k8s.io/v1
 kind: BackendTLSPolicy
 metadata:
   name: tls-upstream-echo
@@ -15,7 +69,32 @@ spec:
         group: ""
     hostname: auth.example.com
 ---
-apiVersion: gateway.networking.k8s.io/v1alpha3
+apiVersion: gateway.networking.k8s.io/v1
+kind: BackendTLSPolicy
+metadata:
+  name: tls-upstream-echo-https-merged-rules
+  namespace: default
+spec:
+  targetRefs:
+    - kind: Service
+      name: echo-https
+      group: ""
+    - kind: Service
+      name: echo-https
+      group: ""
+      sectionName: https
+    - kind: Service
+      name: echo-https
+      group: ""
+      sectionName: non-existing-port-name
+  validation:
+    caCertificateRefs:
+      - kind: ConfigMap
+        name: auth-cert
+        group: ""
+    hostname: auth.example.com
+---
+apiVersion: gateway.networking.k8s.io/v1
 kind: BackendTLSPolicy
 metadata:
   name: existing-status
@@ -33,19 +112,19 @@ spec:
     hostname: auth.example.com
 status:
   ancestors:
-  - ancestorRef:
-      group: ""
-      kind: Service
-      name: httpbin
-    conditions:
-    - lastTransitionTime: 2000-01-01T01:01:01Z
-      message: hello
-      reason: Accepted
-      status: "True"
-      type: Accepted
-    controllerName: example.com/some-other-controller
+    - ancestorRef:
+        group: ""
+        kind: Service
+        name: httpbin
+      conditions:
+        - lastTransitionTime: 2000-01-01T01:01:01Z
+          message: hello
+          reason: Accepted
+          status: "True"
+          type: Accepted
+      controllerName: example.com/some-other-controller
 ---
-apiVersion: gateway.networking.k8s.io/v1alpha3
+apiVersion: gateway.networking.k8s.io/v1
 kind: BackendTLSPolicy
 metadata:
   name: bad-service
@@ -62,7 +141,7 @@ spec:
         group: ""
     hostname: auth.example.com
 ---
-apiVersion: gateway.networking.k8s.io/v1alpha3
+apiVersion: gateway.networking.k8s.io/v1
 kind: BackendTLSPolicy
 metadata:
   name: unknown-configmap
@@ -79,7 +158,7 @@ spec:
         group: ""
     hostname: auth.example.com
 ---
-apiVersion: gateway.networking.k8s.io/v1alpha3
+apiVersion: gateway.networking.k8s.io/v1
 kind: BackendTLSPolicy
 metadata:
   name: malformed-configmap
@@ -96,7 +175,7 @@ spec:
         group: ""
     hostname: auth.example.com
 ---
-apiVersion: gateway.networking.k8s.io/v1alpha3
+apiVersion: gateway.networking.k8s.io/v1
 kind: BackendTLSPolicy
 metadata:
   name: bad-configmap-type
@@ -112,3 +191,91 @@ spec:
         name: blah
         group: ""
     hostname: auth.example.com
+---
+# ServiceEntry with multiple hosts for testing multiple DestinationRules
+apiVersion: networking.istio.io/v1
+kind: ServiceEntry
+metadata:
+  name: multi-host-service
+  namespace: default
+spec:
+  hosts:
+    - api.example.com
+    - cdn.example.com
+  ports:
+    - number: 443
+      name: https
+      protocol: HTTPS
+    - number: 8443
+      name: tls
+      protocol: TLS
+  resolution: DNS
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: BackendTLSPolicy
+metadata:
+  name: multi-host-service-entry
+  namespace: default
+spec:
+  targetRefs:
+    - kind: ServiceEntry
+      name: multi-host-service
+      group: networking.istio.io
+  validation:
+    wellKnownCACertificates: System
+    hostname: cdn.example.com
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: BackendTLSPolicy
+metadata:
+  name: multi-host-service-entry-section-name
+  namespace: default
+spec:
+  targetRefs:
+    - kind: ServiceEntry
+      name: multi-host-service
+      group: networking.istio.io
+      sectionName: tls
+  validation:
+    caCertificateRefs:
+      - kind: ConfigMap
+        name: auth-cert
+        group: ""
+    hostname: api.example.com
+---
+# Simple ServiceEntry with 2 ports for testing sectionName
+apiVersion: networking.istio.io/v1
+kind: ServiceEntry
+metadata:
+  name: external-service
+  namespace: default
+spec:
+  hosts:
+    - external.example.com
+  ports:
+    - number: 80
+      name: http
+      protocol: HTTP
+    - number: 443
+      name: https
+      protocol: HTTPS
+  resolution: DNS
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: BackendTLSPolicy
+metadata:
+  name: tls-external-service-https
+  namespace: default
+spec:
+  targetRefs:
+    - kind: ServiceEntry
+      name: external-service
+      group: networking.istio.io
+      sectionName: https
+    - kind: ServiceEntry
+      name: external-service
+      group: networking.istio.io
+      sectionName: non-existing-port-name
+  validation:
+    wellKnownCACertificates: System
+    hostname: external.example.com