gateway-controller: envoy xDS and policy xDS mutual TLS support

[tharindu1st]

Summary

• Extracted from support PQC supported ciphers and ECDH curves from envoy #3222: the envoy/policy xDS-related changes only.
• Adds mutual TLS to the main Envoy-facing xDS server (server.xds_tls) and the policy-engine-facing policy xDS server (policy_server.tls), both configured via the shared XDSServerTLSConfig shape (PQC-capable cipher/curve config, off by default).
• Adds pkg/tlsauth for verifying the mTLS peer identity against an allowlist.
• Adds policy-engine's xdsclient-side TLS support so it can connect to the now-mTLS-capable policy xDS server.
• Also brings in pkg/config/server_tls.go and gateway-runtime/policy-engine/internal/config/admin_tls.go as prerequisites — these are pure TLS-parsing utility functions (cipher/curve/version parsing) shared with the REST-API-TLS work in support PQC supported ciphers and ECDH curves from envoy #3222, not REST-API-specific themselves.
• Deliberately excluded: the REST management API TLS listener itself (server.tls, cmd/controller/server_tls.go) and gateway/configs/config-template.toml documentation — those belong to the REST API TLS PR being extracted separately, and the template doc for xds_tls/policy_server.tls is interleaved with that REST TLS doc in a way that isn't cleanly splittable without hand-editing docs.

Merge-order note

• This PR renames policyxds.WithTLS to policyxds.WithMTLS. event-gateway/gateway-controller (on main today) still calls policyxds.WithTLS and will fail to build if this PR merges before the sibling "event-gateway related changes" PR (event-gateway: shared httpclient, PQC cipher/curve config, and xDS mTLS support #3327), which already updates that call site. Recommend merging event-gateway: shared httpclient, PQC cipher/curve config, and xDS mTLS support #3327 first, or coordinate the merge order.

Test plan

• go build ./..., go vet ./..., go test ./... pass for gateway/gateway-controller
• go build ./..., go vet ./..., go test ./... pass for gateway/gateway-runtime/policy-engine

[coderabbitai]

Warning

Review limit reached

Next included review available in 47 minutes.

View limit details

Limit details: You’ve used the included review currently available.

This review ran on the open-source allowance, not this organization's plan, because the pull request author doesn't have an assigned seat. Waiting won't change this — ask an organization admin to assign them a seat, or add seats in Billing if every seat is already assigned, then retry.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d7b27b1b-6644-426a-a507-defbc5634f76

📥 Commits

Reviewing files that changed from the base of the PR and between 0134cd7 and c8c9354.

📒 Files selected for processing (18)

• gateway/gateway-controller/cmd/controller/main.go
• gateway/gateway-controller/pkg/config/config.go
• gateway/gateway-controller/pkg/config/server_tls.go
• gateway/gateway-controller/pkg/config/xds_tls.go
• gateway/gateway-controller/pkg/config/xds_tls_test.go
• gateway/gateway-controller/pkg/policyxds/server.go
• gateway/gateway-controller/pkg/policyxds/server_test.go
• gateway/gateway-controller/pkg/tlsauth/peer_identity.go
• gateway/gateway-controller/pkg/tlsauth/peer_identity_test.go
• gateway/gateway-controller/pkg/xds/server.go
• gateway/gateway-controller/pkg/xds/snapshot.go
• gateway/gateway-controller/pkg/xds/translator.go
• gateway/gateway-controller/pkg/xds/translator_test.go
• gateway/gateway-runtime/policy-engine/internal/config/admin_tls.go
• gateway/gateway-runtime/policy-engine/internal/xdsclient/client.go
• gateway/gateway-runtime/policy-engine/internal/xdsclient/client_test.go
• gateway/gateway-runtime/policy-engine/internal/xdsclient/config.go
• gateway/gateway-runtime/policy-engine/internal/xdsclient/config_test.go

---

_{Comment @coderabbitai help to get the list of available commands.}