certificates: Envoy xDS Certs should have a ServiceIdentity in the CN; not ServiceAccount

[draychev]

From a comment/proposal @shashankram made on #3170 (review):

*Directly retrieve the ServiceIdentity from the proxy XDS cert.

This issue is to treat the Envoi xDS certificate's CN as a ServiceIdentity, not specifically Kubernetes Service Account. In reality the xDS Cert CN would still be derived from a Kubernetes Service Account, but this is merely an implementation detail.

[draychev]

Another thought - we may need to create EndpointIdentity and have that be different that ServiceIdentity

So xDS certificate --> EndpointIdentity (or ProxyIdentity)
Service certificate --> ServiceIdentity

[shashankram]

Another thought - we may need to create EndpointIdentity and have that be different that ServiceIdentity

So xDS certificate --> EndpointIdentity (or ProxyIdentity)
Service certificate --> ServiceIdentity

As it stands today, both XDS cert and workload certs are based on service-account.namespace. The only additional info in the XDS cert is the proxy metadata (Proxy UUID, Kind).

I am inclined to keep this simple:

• XDS cert: proxy-uuid.kind.svc-account.namespace.cluster.local
• Client/Service certs: svc-account.namespace.cluster.local

This will allow the controller to correctly assign service identities that could be derived from the XDS cert.

[shashankram]

Resolved by #3657