adding validate_upstream_certs

Signed-off-by: Adam Buran <aburan28@gmail.com>

Author: aburan28

pkg/api/getambassador.io/v2/crd_tlscontext.go

@@ -44,6 +44,7 @@ type TLSContextSpec struct {
 	SecretNamespacing     *bool    `json:"secret_namespacing,omitempty"`
 	RedirectCleartextFrom *int     `json:"redirect_cleartext_from,omitempty"`
 	SNI                   string   `json:"sni,omitempty"`
+	VerifyUpstreamCerts   *bool    `json:"verify_upstream_certs,omitempty"`
 
 	// +k8s:conversion-gen:rename=CRLSecret
 	V3CRLSecret string `json:"v3CRLSecret,omitempty"`

python/ambassador/envoy/v3/v3tls.py

@@ -115,8 +115,15 @@ def update_validation(self, key: str, value: str) -> None:
             EnvoyValidationContext,
             self.get_common().setdefault("validation_context", empty_context),
         )
-
         src: EnvoyCoreSource = {"filename": value}
+
+        # Create the 'match_subject_alt_names' dictionary if it doesn't exist
+        match_san = validation.setdefault("match_subject_alt_names", {})
+
+        # Create the SAN type (e.g., DNS) dictionary if it doesn't exist
+        san_type_dict = match_san.setdefault(san_type, [])
+        san_type_dict.append(src)
+
         validation[key] = src
 
     def add_context(self, ctx: IRTLSContext) -> None:
@@ -142,6 +149,7 @@ def add_context(self, ctx: IRTLSContext) -> None:
             ("min_tls_version", self.update_tls_version, "tls_minimum_protocol_version"),
             ("max_tls_version", self.update_tls_version, "tls_maximum_protocol_version"),
             ("sni", self.__setitem__, "sni"),
+            ("verify_upstream_certs", self.__setitem__, "verify_upstream_certs")
         ]:
             value = ctx.get(ctxkey, None)
 

python/ambassador/ir/irtlscontext.py

@@ -35,6 +35,7 @@ class IRTLSContext(IRResource):
         "redirect_cleartext_from",
         "secret_namespacing",
         "sni",
+        "verify_upstream_certs",
     }
 
     AllowedTLSVersions = ["v1.0", "v1.1", "v1.2", "v1.3"]
@@ -105,6 +106,9 @@ def setup(self, ir: "IR", aconf: Config) -> bool:
         if not self.get("_ambassador_enabled", False):
             spec_count = 0
             errors = 0
+            if self.get("verify_upstream_certs", False):
+                spec_count += 1
+                
 
             if self.get("secret", None):
                 spec_count += 1