Use mTLS certs as a client cert when executing Envoy Admin actions from CP

[jakubdyszkiewicz]

Description

To avoid introducing another set of certs that user needs to learn, we are using DP server certs as client certs when CP is executing Envoy Admin actions. This can be a problem when user will provide their own DP server certs that cannot be used as client certs. It's visible as

2022-06-28T10:55:44.930+0200 ERROR Could not get config_dump {"error": "error response from Zone CP: unable to send GET to config_dump: Get \"https://<IP>:<PORT>/config_dump\": remote error: tls: unsupported certificate", "errorVerbose": "error response from Zone CP: unable to send GET to config_dump: Get \"https://<IP>:<PORT>/config_dump\": remote error: tls: unsupported certificate\ngithub.com/kumahq/kuma/pkg/envoy/admin.

When mTLS is enabled, we should generate a client cert for CP from the enabled backend for the given mesh.
This way we know that the client cert meets all the requirements because we are using it for service-to-service mTLS.

[tibuntu]

Hey @jakubdyszkiewicz,

just wanted to leave quick feedback here. We just upgraded our Kuma to 1.8.0 and with that, the issue is finally gone.
Thanks and kudos from us!