caCertificateRefs ca.crt key can be customized

[megian]

The current specification is very opinionated on the naming and doesn't allow to override the key name of "ca.crt" in secrets and config maps.

Se the reference "ConfigMap does not contain a key named ca.crt"

What would you like to be added:
An additional field with an custom name for ca.crt.

Why this is needed:
OpenShift service serving certificate does generate secrets with the key service-ca.crt.

apiVersion: v1
data:
  service-ca.crt: |
    -----BEGIN CERTIFICATE-----
...

[snorwin]

It looks like this could be an issue affecting quite a few OpenShift users.

/cc @rikatz @candita

[candita]

Use of anything other than a ConfigMap is implementation-dependent because we decided it was up to implementations to determine the format of certs.

I'm not familiar with a "service serving certificate", but we have an internal request for this functionality and I'll look into it.

[Miciah]

A "service serving certificate" is just a certificate issued by OpenShift's Service CA Operator's serving cert signer.

[Miciah]

Ideally, the service CA should be incorporated into the gateway controller's trust bundle so that the BackendTLSPolicy needn't specify it.