client certificate processing for dynamic modules

Author: michalskalski

internal/xds/translator/dynamicmodule.go

@@ -179,6 +179,9 @@ func (*dynamicModule) patchResources(tCtx *types.ResourceVersionTable, routes []
 				if err := createExtServiceXDSCluster(backend, nil, tCtx); err != nil {
 					errs = errors.Join(errs, err)
 				}
+				if err := processClientCertificates(tCtx, backend.Settings); err != nil {
+					errs = errors.Join(errs, err)
+				}
 			}
 			if dm.Remote == nil {
 				continue

internal/xds/translator/testdata/in/xds-ir/dynamicmodule.yaml

@@ -44,6 +44,10 @@ http:
               CACertificate:
                 name: system_ca_certificates
               useSystemTrustStore: true
+              clientCertificates:
+              - name: resolver-client
+                certificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+                privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
         doNotClose: true
         filterName: token-ratelimit
         loadGlobally: true

internal/xds/translator/testdata/out/xds-ir/dynamicmodule.clusters.yaml

@@ -137,6 +137,11 @@
               sdsConfig:
                 ads: {}
                 resourceApiVersion: V3
+          tlsCertificateSdsSecretConfigs:
+          - name: resolver-client
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
         sni: resolver.example.com
   type: EDS
   typedExtensionProtocolOptions:

internal/xds/translator/testdata/out/xds-ir/dynamicmodule.secrets.yaml

@@ -2,3 +2,9 @@
   validationContext:
     trustedCa:
       filename: /etc/ssl/certs/ca-certificates.crt
+- name: resolver-client
+  tlsCertificate:
+    certificateChain:
+      inlineBytes: Y2VydC1kYXRh
+    privateKey:
+      inlineBytes: a2V5LWRhdGE=