[X.509] Backward Compatibility

[averevki]

Summary

Verify that existing AuthConfig mTLS behavior is not broken by the new x509.source field changes.

Priority: High — Should be implemented early.

The existing tests use TLSEnvoy gateway with hostname.client(verify=envoy_authority, cert=valid_cert) pattern. The new tests use KuadrantGateway with XFCC-based cert extraction. These are fundamentally different gateway setups, so new tests will likely be needed rather than adapting existing ones.

Setup

• AuthPolicy without source field (legacy behavior — expects cert in attributes.source.certificate)

Tests

• Verify existing behavior is not broken

References

• Parent issue: E2E tests for X.509 Client Certificate Authentication in AuthPolicy (XFCC header) #885
• RFC 0015
• Existing mTLS tests