fully support backend tls policy

[yuval-k]

Description

Finish the impl for backend tls policy

Change Type

/kind bug_fix

Changelog

NONE

No need for changelog as the original pr wasn't in a released version.

Additional Notes

still needs cleanup & tests

[Copilot]

Pull Request Overview

This PR completes the implementation of the Backend TLS policy by wiring up CRD handling, translation logic, and tests.

• Exposed BackendTLSPolicyGVR in the well-known API registry and included it in the translator’s test harness
• Added translation code in the BackendTLSPolicy plugin to build Envoy TLS contexts (including both inline and SDS-backed CAs, plus SAN support)
• Introduced new input/output fixtures (tls.yaml and tls-san.yaml) and expanded the gateway translator test suite

Reviewed Changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
test/translator/test.go	Include BackendTLSPolicyGVR in the CRD creation loop
internal/kgateway/wellknown/gwapi.go	Define BackendTLSPolicyGVR for the new policy
internal/kgateway/translator/gateway/testutils/inputs/backendtlspolicy/*.yaml	Add sample BackendTLSPolicy inputs (tls.yaml and tls-san.yaml)
internal/kgateway/translator/gateway/testutils/outputs/backendtlspolicy/*.yaml	Add expected Envoy cluster/listener outputs for both scenarios
internal/kgateway/translator/gateway/gateway_translator_test.go	Register translator entries for Backend TLS policy tests
internal/kgateway/extensions2/plugins/backendtlspolicy/ssl.go	Update SSL helper to accept a validation context parameter
internal/kgateway/extensions2/plugins/backendtlspolicy/ssl_test.go	Adjust tests for the updated ResolveUpstreamSslConfig signature
internal/kgateway/extensions2/plugins/backendtlspolicy/plugin.go	Implement TLS policy translation (inline CA, SDS CA, SAN, error handling)

Comments suppressed due to low confidence (2)

internal/kgateway/extensions2/plugins/backendtlspolicy/plugin.go:187

• The code uses fmt.Errorf but fmt is not imported, which will cause a compile error. Add import "fmt" to the top of the file.

perr := fmt.Errorf("%w: %v", ErrCreatingTLSConfig, err)

internal/kgateway/extensions2/plugins/backendtlspolicy/plugin.go:192

• The default branch for invalid validation specs (ErrInvalidValidationSpec) isn't covered by any existing tests. Add a unit test to verify this error path when both WellKnownCACertificates and CACertificateRefs are absent or mutually exclusive.

return &policyIr, ErrInvalidValidationSpec

[puertomontt]

is there a conformance test for this?

[yuval-k]

is there a conformance test for this?

good question. i just looked and i'm not seeing one

[lgadban]

LGTM!
Approved with a very minor nit and some questions

[lgadban]

nit: weird newline here and on line 85

[yuval-k]

ok added e2e test. it passed locally