Support TLSRoute with expression router

[randmonkey]

Is there an existing issue for this?

• I have searched the existing issues

Problem Statement

Split out of #4312
Kong 3.4 added support of expression router in L4 proxy. We could implement support of TLSRoute in gateway APIs.

Proposed Solution

• Translate TLSRoute into expression based Kong route when ExpressionRoutes feature gate is enabled, and Kong uses expression router

Additional information

No response

Acceptance Criteria

• KIC could translate TLSRoute to expression based Kong routes against Kong 3.4+ running with expression router
• TestTCPIngressTLSPassthrough works as well.

[randmonkey]

assigned to @rodman10. I could not assign to a contributor out of our organization, so @rodman10 if you are still willing to do this, please assign it to yourself.

[rainest]

Piggybacking the TCPIngress TLS passthrough on this. TCPIngress otherwise works in #4612 and the issue with passthrough not matching will presumably have the same fix for both TLSRoute and TCPIngress.

[rainest]

This requires a gateway change: Kong/kong#11538

Our implementation isn't expected to change. We add expression SNI criteria if the route object contains traditional SNI values already.

TLSRoute will require removing the not supported abort.

TCPIngress with TLS passthrough already creates routes that will match after the fix following #4612, and will only require enabling the tests.

Dunno how we want to handle this for 2.12, since I don't expect the gateway fix to be released by then. We could add the functionality anyway without enabling tests with the expectation that it will work on a fixed gateway release.

[mflendrich]

Blocked by Kong/kong#11538 as Travis mentioned (likely to come in Kong 3.4.1)