Backport of NET-11798: Set APIGateway TLSConfig if unset or empty into release/1.20.x

[hc-github-team-consul-core]

Backport

This PR is auto-generated from #21984 to be assessed for backporting due to the inclusion of the label backport/1.20.

🚨

Warning automatic cherry-pick of commits failed. If the first commit failed,
you will see a blank no-op commit below. If at least one commit succeeded, you
will see the cherry-picked commits up to, not including, the commit where
the merge conflict occurred.

The person who merged in the original PR is:
@NiniOak
This person should manually cherry-pick the original PR into a new backport PR,
and close this one when the manual backport PR is merged in.

merge conflict error: unable to process merge commit: "2815c7ebdbaa5ff7fde66d734e50d5342a309f81", automatic backport requires rebase workflow

The below text is copied from the body of the original PR.

---

Description

The API Gateway TLS.{Min,Max}Versions and TLS.CipherSuites settings are not applied to API Gateway Listeners. To fix this:

• Create a dedicated function setAPIGatewayTLSConfig that handles the logic for setting TLS configuration for APIGateway
• Check if those values are empty and sets them accordingly

Testing & Reproduction steps

Tested manually, as follows:

Using this config file config.hcl

  bootstrap = [
    {
      Kind = "proxy-defaults"
      Name = "global"
      Config = {
        protocol = "http"
      }
    },
    {
      Kind      = "api-gateway"
      Name      = "my-gateway"
      Namespace = "default"
      Partition = "default"
      Listeners = [
        {
          Port     = 8443
          Name     = "my-http-listener"
          Protocol = "HTTP"
          TLS = {
            Certificates = [
              {
                Kind      = "inline-certificate"
                Name      = "my-certificate"
                Namespace = "default"
                Partition = "default"
              }
            ]
            MinVersion = "TLSv1_3"
          }
        }
      ]
    },
    {
      Kind      = "http-route"
      Name      = "my-http-route"
      Namespace = "default"
      Partition = "default"
      Rules = [
        {
          Matches = [
            {
              Path = {
                Match = "prefix"
                Value = "/api"
              }
            }
          ]
          Services = [
            {
              Name = "api"
            }
          ]
        }
      ]
      Parents = [
        {
          Kind        = "api-gateway"
          Name        = "my-gateway"
          Namespace   = "default"
          Partition   = "default"
          SectionName = "my-http-listener"
        }
      ]
    },
    {
      Kind      = "inline-certificate"
      Name      = "my-certificate"
      Namespace = "default"
      Partition = "default"
      Certificate = ""
      PrivateKey  = ""
    }
  ]
}

1. Build Consul binary locally
   make dev-build
2. Run dev agent with attached config file
   consul agent -dev -config-file consul.hcl
3. Start API Gateway
   consul connect envoy -gateway api -service my-gateway -register
4. Check the config_dump for "tls_minimum_protocol_version": "TLSv1_3"
   curl -s 0:19000/config_dump | grep tls_minimum
5. Should return
   "tls_minimum_protocol_version": "TLSv1_3"

Links

PR Checklist

• updated test coverage
• external facing docs updated
• appropriate backport labels added
• not a security concern

---

Overview of commits

• 30bc9b5 - 02efb33 - 7045225 - 2815c7e - e49c150 - 7633f1b - 0518e46 - 845e7e9

[github-team-consul-core-pr-approver]

Auto approved Consul Bot automated PR