[feat] GWAPI: introduce insecure_skip_verify to ServerTLSSettings

networking/v1alpha3/gateway.proto

@@ -193,6 +193,7 @@ syntax = "proto3";
 package istio.networking.v1alpha3;
 
 import "google/api/field_behavior.proto";
+import "google/protobuf/wrappers.proto";
 
 option go_package = "istio.io/api/networking/v1alpha3";
 
@@ -577,4 +578,13 @@ message ServerTLSSettings {
   // * `AES256-SHA`
   // * `DES-CBC3-SHA`
   repeated string cipher_suites = 9;
+
+  // Optional: If set to true, the proxy will try to validate the certificate, but even if the
+  // validation fails, it will allow the connection through.
+  //
+  // It's needed to implement Gateway API AllowInsecureFallback feature. The different between
+  // AllowInsecureFallback and not verifying client certificate at all is that Gateway is able
+  // to pass the client certificate to the backend in the x-forwarded-client-cert HTTP header and
+  // backend can verify the certificate.
+  google.protobuf.BoolValue insecure_skip_verify = 17;
 }

releasenotes/notes/3727.yaml

@@ -0,0 +1,8 @@
+apiVersion: release-notes/v2
+kind: feature
+area: security
+releaseNotes:
+- |
+  **Added** `insecure_skip_verify` field to `ServerTLSSettings`. When set to `true`, this will tell the gateway to allow the
+  incoming connection even if the client certificate does not pass the checks. It will be used to implement Gateway API
+  `AllowInsecureFallback` feature in Istio.