NET-11798: Set APIGateway TLSConfig if unset or empty

[NiniOak]

Description

The API Gateway TLS.{Min,Max}Versions and TLS.CipherSuites settings are not applied to API Gateway Listeners. To fix this:

• Create a dedicated function setAPIGatewayTLSConfig that handles the logic for setting TLS configuration for APIGateway
• Check if those values are empty and sets them accordingly

Testing & Reproduction steps

Tested manually, as follows:

Using this config file config.hcl

  bootstrap = [
    {
      Kind = "proxy-defaults"
      Name = "global"
      Config = {
        protocol = "http"
      }
    },
    {
      Kind      = "api-gateway"
      Name      = "my-gateway"
      Namespace = "default"
      Partition = "default"
      Listeners = [
        {
          Port     = 8443
          Name     = "my-http-listener"
          Protocol = "HTTP"
          TLS = {
            Certificates = [
              {
                Kind      = "inline-certificate"
                Name      = "my-certificate"
                Namespace = "default"
                Partition = "default"
              }
            ]
            MinVersion = "TLSv1_3"
          }
        }
      ]
    },
    {
      Kind      = "http-route"
      Name      = "my-http-route"
      Namespace = "default"
      Partition = "default"
      Rules = [
        {
          Matches = [
            {
              Path = {
                Match = "prefix"
                Value = "/api"
              }
            }
          ]
          Services = [
            {
              Name = "api"
            }
          ]
        }
      ]
      Parents = [
        {
          Kind        = "api-gateway"
          Name        = "my-gateway"
          Namespace   = "default"
          Partition   = "default"
          SectionName = "my-http-listener"
        }
      ]
    },
    {
      Kind      = "inline-certificate"
      Name      = "my-certificate"
      Namespace = "default"
      Partition = "default"
      Certificate = ""
      PrivateKey  = ""
    }
  ]
}

1. Build Consul binary locally
   make dev-build
2. Run dev agent with attached config file
   consul agent -dev -config-file consul.hcl
3. Start API Gateway
   consul connect envoy -gateway api -service my-gateway -register
4. Check the config_dump for "tls_minimum_protocol_version": "TLSv1_3"
   curl -s 0:19000/config_dump | grep tls_minimum
5. Should return
   "tls_minimum_protocol_version": "TLSv1_3"

Links

PR Checklist

• updated test coverage
• external facing docs updated
• appropriate backport labels added
• not a security concern

[nathancoleman]

Nice! Just a couple of questions

[hc-github-team-consul-core]

📣 Hi @NiniOak! a backport is missing for this PR [21984] for versions [1.15,1.18,1.19,1.20] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

[hc-github-team-consul-core]

📣 Hi @NiniOak! a backport is missing for this PR [21984] for versions [1.15,1.18,1.19] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

[hc-github-team-consul-core]

📣 Hi @NiniOak! a backport is missing for this PR [21984] for versions [1.15,1.19] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>