feat: support envoy ratelimit TLS settings.

[qicz]

part support #1217

configuration refrence

• tlsCertificateRef the client certificate reference secret for TLS connections.
• env defines the extension env configuration for connecting to Redis database. reference https://github.com/envoyproxy/ratelimit/blob/main/src/settings/settings.go

apiVersion: config.gateway.envoyproxy.io/v1alpha1
kind: EnvoyGateway
gateway:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller
provider:
  type: Kubernetes
  kubernetes:
    rateLimitDeployment:
      replicas: 1
      container:
        env:
        - name: REDIS_POOL_SIZE
          value: 10
        - name: REDIS_PERSECOND
          value: true
        resources:
          requests:
            cpu: 100m
            memory: 512Mi
        securityContext:
          runAsUser: 2000
          allowPrivilegeEscalation: false
      pod:
        annotations:
          key1: val1
          key2: val2
        securityContext:
          runAsUser: 1000
          runAsGroup: 3000
          fsGroup: 2000
          fsGroupChangePolicy: "OnRootMismatch"
rateLimit:
  backend:
    type: Redis
    redis:
      url: localhost:6379
      tls
         certificateRef:
             name: secret_name

cc @arkodg

[codecov]

Codecov Report

Merging #1294 (6a66fc1) into main (5f222eb) will decrease coverage by 0.02%.
The diff coverage is 71.69%.

@@            Coverage Diff             @@
##             main    #1294      +/-   ##
==========================================
- Coverage   62.26%   62.25%   -0.02%     
==========================================
  Files          79       79              
  Lines       11184    11254      +70     
==========================================
+ Hits         6964     7006      +42     
- Misses       3764     3791      +27     
- Partials      456      457       +1     

Impacted Files	Coverage Δ
api/config/v1alpha1/envoygateway_types.go	100.00% <ø> (ø)
api/config/v1alpha1/zz_generated.deepcopy.go	0.00% <0.00%> (ø)
...ernal/infrastructure/kubernetes/ratelimit_infra.go	66.66% <0.00%> (-33.34%)	⬇️
...al/infrastructure/kubernetes/ratelimit/resource.go	94.73% <90.12%> (-5.27%)	⬇️
...tructure/kubernetes/ratelimit/resource_provider.go	98.24% <100.00%> (-0.18%)	⬇️

... and 2 files with indirect coverage changes

[qicz]

ptal @arkodg

[arkodg]

@qicz can this API PR be broken up into two parts

• one that exposes TLS config b/w RL Service and Redis global-ratelimiting: add ability to configure TLS from rate limit service to Redis backend #988
• other than allows user to configure environment variables for the container . Would prefer only exposing env now, and making each config a first class citizen based on user requests

[qicz]

@qicz can this API PR be broken up into two parts

• one that exposes TLS config b/w RL Service and Redis global-ratelimiting: add ability to configure TLS from rate limit service to Redis backend #988
• other than allows user to configure environment variables for the container . Would prefer only exposing env now, and making each config a first class citizen based on user requests

My plan is also to divide into two PRS to complete this feature when the api like PR description confirmed and merged.

IMO, like the password and certificateRef user can configure directly, and another env configurations can be overrided by eg initial settings.

So current api structure is ok or not?

[arkodg]

@qicz can this API PR be broken up into two parts

• one that exposes TLS config b/w RL Service and Redis global-ratelimiting: add ability to configure TLS from rate limit service to Redis backend #988
• other than allows user to configure environment variables for the container . Would prefer only exposing env now, and making each config a first class citizen based on user requests

My plan is also to divide into two PRS to complete this feature when the api like PR description confirmed and merged. So current api structure is ok or not?

would prefer if the 2 API pieces were added as separate PRs because they are different features
high level comments on existing API

• env should live inside rateLimitDeployment.container
• tls style looks mostly good
• I dont think we should introduce type so soon , and let the user configure that field using env

[qicz]

@qicz can this API PR be broken up into two parts

• one that exposes TLS config b/w RL Service and Redis global-ratelimiting: add ability to configure TLS from rate limit service to Redis backend #988
• other than allows user to configure environment variables for the container . Would prefer only exposing env now, and making each config a first class citizen based on user requests

My plan is also to divide into two PRS to complete this feature when the api like PR description confirmed and merged. So current api structure is ok or not?

would prefer if the 2 API pieces were added as separate PRs because they are different features high level comments on existing API

• env should live inside rateLimitDeployment.container
• tls style looks mostly good
• I dont think we should introduce type so soon , and let the user configure that field using env

I will do these after #1259 #1337

[qicz]

@arkodg i am testing the reivewers requests but looks missing some permission

[qicz]

ptal @arkodg all comments resolved