internal: Adds support for TLSRoute

Add support for TLSRoute to enable Passthrough TCP Proxying to pods via SNI.

Updates projectcontour#3440

Signed-off-by: Steve Sloka <slokas@vmware.com>

_integration/testsuite/fixtures/ingress-conformance-echo.yaml

@@ -95,6 +95,10 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
+        - name: INGRESS_NAME
+          value: *name
+        - name: SERVICE_NAME
+          value: *name
         - name: TLS_SERVER_CERT
           value: /run/secrets/certs/tls.crt
         - name: TLS_SERVER_PRIVKEY

_integration/testsuite/gatewayapi/008-tlsroute.yaml

@@ -0,0 +1,187 @@
+# Copyright Project Contour Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.  You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+
+  import data.contour.resources
+
+  # Ensure that cert-manager is installed.
+  # Version check the certificates resource.
+
+  Group := "cert-manager.io"
+  Version := "v1"
+
+  have_certmanager_version {
+  v := resources.versions["certificates"]
+  v[_].Group == Group
+  v[_].Version == Version
+}
+
+  skip[msg] {
+  not resources.is_supported("certificates")
+  msg := "cert-manager is not installed"
+}
+
+  skip[msg] {
+  not have_certmanager_version
+
+  avail := resources.versions["certificates"]
+
+  msg := concat("\n", [
+  sprintf("cert-manager version %s/%s is not installed", [Group, Version]),
+  "available versions:",
+  yaml.marshal(avail)
+  ])
+}
+
+---
+
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: selfsigned
+spec:
+  selfSigned: {}
+
+---
+
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: backend-server-cert
+spec:
+  dnsNames:
+    - tcp.projectcontour.io
+  secretName: backend-server-cert
+  issuerRef:
+    name: selfsigned
+    kind: ClusterIssuer
+
+---
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ingress-conformance-echo-tls
+$apply:
+  fixture:
+    as: echo-slash-blue
+
+---
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: ingress-conformance-echo-tls
+$apply:
+  fixture:
+    as: echo-slash-blue
+
+---
+
+apiVersion: networking.x-k8s.io/v1alpha1
+kind: GatewayClass
+metadata:
+  name: contour-class
+spec:
+  controller: projectcontour.io/ingress-controller
+
+---
+
+apiVersion: networking.x-k8s.io/v1alpha1
+kind: Gateway
+metadata:
+  name: contour
+  namespace: projectcontour
+spec:
+  gatewayClassName: contour-class
+  listeners:
+    - protocol: TLS
+      port: 443
+      routes:
+        kind: TLSRoute
+        namespaces:
+          from: "All"
+---
+
+apiVersion: networking.x-k8s.io/v1alpha1
+kind: TLSRoute
+metadata:
+  name: tlsroute1
+spec:
+  rules:
+  - matches:
+    - snis:
+      - tcp.projectcontour.io
+    forwardTo:
+    - serviceName: echo-slash-blue
+      port: 443
+---
+
+import data.contour.http.client
+import data.contour.http.client.url
+import data.contour.http.expect
+
+# Ensure / request returns 200 status code.
+Response := client.Get({
+  "url": url.https("/"),
+    "headers": {
+      "Host": "tcp.projectcontour.io",
+      "User-Agent": client.ua("tlsroute"),
+  },
+  "tls_insecure_skip_verify": true,
+})
+
+check_for_status_code [msg] {
+  msg := expect.response_status_is(Response, 200)
+}
+
+check_for_service_routing [msg] {
+  msg := expect.response_service_is(Response, "echo-slash-blue")
+}
+
+---
+
+apiVersion: networking.x-k8s.io/v1alpha1
+kind: TLSRoute
+metadata:
+  name: tlsroute1
+spec:
+  rules:
+    - forwardTo:
+        - serviceName: echo-slash-blue
+          port: 443
+
+---
+
+import data.contour.http.client
+import data.contour.http.client.url
+import data.contour.http.expect
+
+  # Ensure / request returns 200 status code.
+Response := client.Get({
+"url": url.https("/"),
+  "headers": {
+    "Host": "anything.should.work.now",
+    "User-Agent": client.ua("tlsroute"),
+  },
+"tls_insecure_skip_verify": true,
+})
+
+check_for_status_code [msg] {
+  msg := expect.response_status_is(Response, 200)
+}
+
+check_for_service_routing [msg] {
+  msg := expect.response_service_is(Response, "echo-slash-blue")
+}