Update nginx.org/ca secret type & crl field to IngressMTLS to support CRL

[shaun-nx]

Proposed changes

This change updates both the nginx.org/ca secret type and the ingressMTLS policy type to provide users a means to configure a Certificate Revocation List.

The CRL can be configured in one of two ways.

1. Using a Base64 encoded CRL with the nginx.org/ca secret type using the ca.crl

kind: Secret
metadata:
  name: ingress-mtls-secret
apiVersion: v1
type: nginx.org/ca
data:
  ca.crt: <base64encoded-certificate>
  ca.crl: <base64encoded-crl>

2. Using the crl field in the ingressMTLS policy spec providing the name of the CRL. This option assumes that the crl webapp.crl is provided by the users to /etc/nginx/secrets

apiVersion: k8s.nginx.org/v1
kind: Policy
metadata:
  name: ingress-mtls-policy
spec:
  ingressMTLS:
    clientCertSecret: ingress-mtls-secret
    crlFileName: webapp.crl
    verifyClient: "on"
    verifyDepth: 1

Checklist

Before creating a PR, run through this checklist and mark each as complete.

• I have read the CONTRIBUTING doc
• I have added tests that prove my fix is effective or that my feature works
• I have checked that all unit tests pass after adding my changes
• I have updated necessary documentation
• I have rebased my branch onto main
• I will ensure my PR is targeting the main branch and pulling from my branch from my own fork

[codecov-commenter]

Codecov Report

Merging #3632 (75ce8d8) into main (04fe202) will increase coverage by 0.01%.
The diff coverage is 67.56%.

@@            Coverage Diff             @@
##             main    #3632      +/-   ##
==========================================
+ Coverage   52.31%   52.33%   +0.01%     
==========================================
  Files          59       59              
  Lines       16853    16880      +27     
==========================================
+ Hits         8817     8834      +17     
- Misses       7741     7749       +8     
- Partials      295      297       +2     

Impacted Files	Coverage Δ
internal/configs/configurator.go	38.47% <0.00%> (-0.21%)	⬇️
internal/configs/version2/http.go	0.00% <ø> (ø)
internal/configs/virtualserver.go	95.13% <100.00%> (+0.05%)	⬆️

... and 1 file with indirect coverage changes

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[ciarams87]

LGTM!

[ADubhlaoich]

Looks good to me.