conformance: added tests for invalid backend TLS configuration

[snorwin]

What type of PR is this?

/kind test
/area conformance-test

What this PR does / why we need it:
This PR follows up on #4195 and #4123 by implementing conformance tests that validate the behavior of an invalid ClientCertificateRef and the ResolvedRefs condition on the Gateway.

Which issue(s) this PR fixes:

Fixes #

Does this PR introduce a user-facing change?:

Added conformance tests for invalid backend TLS configurations and the Gateway ResolvedRefs condition

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: snorwin
Once this PR has been reviewed and has the lgtm label, please assign sunjaybhatia for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• conformance/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[snorwin]

@sjberman has NGINX already implemented the ResolvedRefs condition on the Gateway as specified in #4123? If so, I’d really appreciate it if you could run these new conformance tests against NGINX to help verify them as well.

[snorwin]

/cc @rikatz @kl52752

[kl52752]

one nit otherwise LGTM :)

[snorwin]

/test pull-gateway-api-verify

[sjberman]

@snorwin Will test after the holidays.

[sjberman]

@snorwin Looks like we have a couple issues on the NGINX side that we need to fix regarding these conditions.

[sjberman]

So even with an invalid configuration, the Gateway is still Accepted?

[snorwin]

This condition does not directly impact the Gateway's Accepted or Programmed conditions.

https://github.com/kubernetes-sigs/gateway-api/blob/main/apis/v1/gateway_types.go#L1265

Given the semantics we defined, yes this is the main reason we introduced a dedicated ResolvedRefs status condition.