[X.509] Happy Path — Tier 2 (EnvoyFilter)

[averevki]

Summary

Test X.509 client certificate authentication via AuthPolicy using an Istio EnvoyFilter to configure TLS client certificate validation on the gateway listener.

No EnvoyFilter class exists in the testsuite currently. A new KubernetesObject subclass is needed.

Setup

• Gateway without frontendValidation
• Istio EnvoyFilter configuring TLS client certificate validation on the gateway listener
• CA certificate Secret(s) with labels for Authorino validation
• AuthPolicy with x509.source.header: "X-Forwarded-Client-Cert"
• HTTPRoute bound to AuthPolicy

Tests

• Client with valid certificate → 200 OK
• Client without certificate → 401 Unauthorized (rejected at TLS layer)
• Client with certificate signed by wrong CA → 401 Unauthorized (rejected at gateway or Authorino)

References

• Parent issue: E2E tests for X.509 Client Certificate Authentication in AuthPolicy (XFCC header) #885
• RFC 0015