Repository: envoyproxy/gateway

Issue:
e2e: test System Cert for dynamic resolver backends
Originally commented by @arkodg https://github.com/envoyproxy/gateway/pull/5867#discussion_r2071847214

Hints from issue comments:

Solution patch:
diff --git a/internal/gatewayapi/backendtlspolicy.go b/internal/gatewayapi/backendtlspolicy.go
index c6bc0b8bb..143bc749f 100644
--- a/internal/gatewayapi/backendtlspolicy.go
+++ b/internal/gatewayapi/backendtlspolicy.go
@@ -44,19 +44,12 @@ func (t *Translator) applyBackendTLSSetting(
 		return t.applyEnvoyProxyBackendTLSSetting(tlsBundle, resources, envoyProxy)
 	}
 
-	upstreamConfig, policy, err := t.processBackendTLSPolicy(backendRef, backendNamespace, parent, resources)
+	upstreamConfig, err := t.processBackendTLSPolicy(backendRef, backendNamespace, parent, resources)
 	if err != nil {
 		return nil, err
 	}
-	// TODO: zhaohuabing is it correct to surface the EnvoyProxy TLS error to the policy?
-	// We probably should just remove this, the TLS error is already reported in the route status as "InvalidBackendTLS",
-	// and the BackendTLSPolicy is configured correctly.
+
 	if tlsBundle, err = t.applyEnvoyProxyBackendTLSSetting(upstreamConfig, resources, envoyProxy); err != nil {
-		status.SetTranslationErrorForPolicyAncestors(&policy.Status,
-			[]gwapiv1a2.ParentReference{parent},
-			t.GatewayControllerName,
-			policy.Generation,
-			status.Error2ConditionMsg(err))
 		return nil, err
 	}
 	return tlsBundle, nil
@@ -101,10 +94,10 @@ func (t *Translator) processBackendTLSPolicy(
 	backendNamespace string,
 	parent gwapiv1a2.ParentReference,
 	resources *resource.Resources,
-) (*ir.TLSUpstreamConfig, *gwapiv1a3.BackendTLSPolicy, error) {
+) (*ir.TLSUpstreamConfig, error) {
 	policy := getBackendTLSPolicy(resources.BackendTLSPolicies, backendRef, backendNamespace, resources)
 	if policy == nil {
-		return nil, nil, nil
+		return nil, nil
 	}
 
 	tlsBundle, err := getBackendTLSBundle(policy, resources)
@@ -118,11 +111,11 @@ func (t *Translator) processBackendTLSPolicy(
 			policy.Generation,
 			status.Error2ConditionMsg(err),
 		)
-		return nil, nil, err
+		return nil, err
 	}
 
 	status.SetAcceptedForPolicyAncestors(&policy.Status, ancestorRefs, t.GatewayControllerName)
-	return tlsBundle, policy, nil
+	return tlsBundle, nil
 }
 
 func (t *Translator) applyEnvoyProxyBackendTLSSetting(tlsConfig *ir.TLSUpstreamConfig, resources *resource.Resources, ep *egv1a1.EnvoyProxy) (*ir.TLSUpstreamConfig, error) {



Test patch:
diff --git a/internal/gatewayapi/testdata/envoyproxy-tls-settings-invalid-ns.out.yaml b/internal/gatewayapi/testdata/envoyproxy-tls-settings-invalid-ns.out.yaml
index 7c872f644..98a08206a 100644
--- a/internal/gatewayapi/testdata/envoyproxy-tls-settings-invalid-ns.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-tls-settings-invalid-ns.out.yaml
@@ -20,11 +20,9 @@ backendTLSPolicies:
         namespace: envoy-gateway
       conditions:
       - lastTransitionTime: null
-        message: 'ClientCertificateRef Secret is not located in the same namespace
-          as Envoyproxy. Secret namespace: envoy-gateway-user-ns does not match Envoyproxy
-          namespace: envoy-gateway-system.'
-        reason: Invalid
-        status: "False"
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
         type: Accepted
       controllerName: gateway.envoyproxy.io/gatewayclass-controller
 gateways:
diff --git a/internal/gatewayapi/testdata/envoyproxy-tls-settings-invalid.out.yaml b/internal/gatewayapi/testdata/envoyproxy-tls-settings-invalid.out.yaml
index d4224abd7..775ff2586 100644
--- a/internal/gatewayapi/testdata/envoyproxy-tls-settings-invalid.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-tls-settings-invalid.out.yaml
@@ -20,10 +20,9 @@ backendTLSPolicies:
         namespace: envoy-gateway
       conditions:
       - lastTransitionTime: null
-        message: 'Failed to locate TLS secret for client auth: envoy-gateway-system/client-auth-not-found
-          specified in EnvoyProxy envoy-gateway-system/test.'
-        reason: Invalid
-        status: "False"
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
         type: Accepted
       controllerName: gateway.envoyproxy.io/gatewayclass-controller
 gateways:
diff --git a/test/e2e/testdata/httproute-with-dynamic-resolver-backend-with-tls-system-ca.yaml b/test/e2e/testdata/httproute-with-dynamic-resolver-backend-with-tls-system-ca.yaml
new file mode 100644
index 000000000..45ce6a40d
--- /dev/null
+++ b/test/e2e/testdata/httproute-with-dynamic-resolver-backend-with-tls-system-ca.yaml
@@ -0,0 +1,33 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: httproute-with-dynamic-resolver-backend-tls-system-trust-store
+  namespace: gateway-conformance-infra
+spec:
+  parentRefs:
+  - name: same-namespace
+  rules:
+  - backendRefs:
+    - group: gateway.envoyproxy.io
+      kind: Backend
+      name: backend-dynamic-resolver-tls-system-trust-store
+    matches:
+    - path:
+        type: PathPrefix
+        value: /with-tls-system-trust-store
+    filters:
+    - type: URLRewrite  # rewrite the path to /, as we use gateway.envoyproxy.io to test the dynamic resolver, and this path is not available
+      urlRewrite:
+        path:
+          type: ReplaceFullPath
+          replaceFullPath: /
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: Backend
+metadata:
+  name: backend-dynamic-resolver-tls-system-trust-store
+  namespace: gateway-conformance-infra
+spec:
+  type: DynamicResolver
+  tls:
+    wellKnownCACertificates: System
diff --git a/test/e2e/tests/httproute_with_dynamic_resolver_backend.go b/test/e2e/tests/httproute_with_dynamic_resolver_backend.go
index d7509b077..9168431c4 100644
--- a/test/e2e/tests/httproute_with_dynamic_resolver_backend.go
+++ b/test/e2e/tests/httproute_with_dynamic_resolver_backend.go
@@ -26,6 +26,7 @@ var DynamicResolverBackendTest = suite.ConformanceTest{
 	Manifests: []string{
 		"testdata/httproute-with-dynamic-resolver-backend.yaml",
 		"testdata/httproute-with-dynamic-resolver-backend-with-tls.yaml",
+		"testdata/httproute-with-dynamic-resolver-backend-with-tls-system-ca.yaml",
 	},
 	Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
 		ns := "gateway-conformance-infra"
@@ -80,5 +81,26 @@ var DynamicResolverBackendTest = suite.ConformanceTest{
 
 			http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, expectedResponse)
 		})
+		t.Run("route to service with TLS using system CA", func(t *testing.T) {
+			routeNN := types.NamespacedName{Name: "httproute-with-dynamic-resolver-backend-tls-system-trust-store", Namespace: ns}
+			gwAddr := kubernetes.GatewayAndHTTPRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
+			BackendMustBeAccepted(t, suite.Client, types.NamespacedName{Name: "backend-dynamic-resolver-tls-system-trust-store", Namespace: ns})
+
+			expectedResponse := http.ExpectedResponse{
+				Request: http.Request{
+					Host: "gateway.envoyproxy.io:443",
+					Path: "/with-tls-system-trust-store",
+				},
+				ExpectedRequest: &http.ExpectedRequest{
+					Request: http.Request{
+						Host: "",
+					},
+				},
+				Response: http.Response{
+					StatusCode: 200,
+				},
+			}
+			http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, expectedResponse)
+		})
 	},
 }