Adding GEP-3567: Gateway TLS Updates for HTTP/2 Connection Coalescing

[robscott]

What type of PR is this?
/kind gep

What this PR does / why we need it:
This is a relatively small GEP that may not need to be a GEP, but creating one for the purpose of record keeping. Hoping to get at least A and B in v1.3. This is tracked by #3567.

Does this PR introduce a user-facing change?:

NONE

[howardjohn]

How is this expected to interact with gateway merging/ListenerSets?

[robscott]

That's a good question. While I think it's reasonable/natural to have SNI determine the cert you're served, I'm less clear on if there's a safe way to have per-SNI client cert validation. This will have to be a follow up in GEP-91, but I'd suggest leaving this concept entirely out of ListenerSet.

[robscott]

For the record, I have verified that the current ListenerSet GEP excludes client cert validation.

[mlavacca]

/cc

[mlavacca]

Thanks for this GEP, @robscott!

[mlavacca]

Looks good to me, I've left a minor not blocking nit in a comment (feel free to address or discard it).
Once we fix yaml linting, I'm good with merging it.

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mlavacca, robscott

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• geps/OWNERS [mlavacca,robscott]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[kflynn]

/lgtm

even though the whole situation is awful, as previously discussed. 🙂

[robscott]

even though the whole situation is awful

Haha thanks @kflynn, completely agree.

/hold cancel