feat: support GCP Private CA as TLS automation cert issuer

[clement0010]

Related Tickets

Issue: #423

Changes

• Support tls.automation.issuer.gcpPrivateCA config. When configured, Gateway issues downstream TLS certs through a Google Cloud CA Service pool, and verifies each issued cert the same way the Vault issuer does: exact requested DNS/IP SANs, TTL and public key.
• Credentials come from a service account key file, or from Application Default Credentials when none is configured.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

internal/config/config.go:153

• The YAML loading path is not covered for these new optional fields: the existing TestLoad_TLSAutomation only unmarshals a local issuer, while the added tests construct TLSGCPPrivateCAIssuerConfig directly. A regression in either tag would silently drop issuingCertificateAuthorityID or credentialsFile, causing issuance to use a different CA or ADC instead of the operator's configured credentials. Add a Load test that asserts both values are populated from YAML.

	IssuingCertificateAuthorityID string `yaml:"issuingCertificateAuthorityID,omitempty"`

	CredentialsFile string `yaml:"credentialsFile,omitempty"` // Defaults to Application Default Credentials

[Copilot]

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated no new comments.

Suppressed comments (3)

internal/config/config.go:131

• Please add a YAML load test for this new issuer. The current config tests only construct TLSGCPPrivateCAIssuerConfig values directly, so the user-facing gcpPrivateCA and nested tags (caPoolID, the optional issuing-CA ID, and credentials file) are not exercised; a YAML tag typo would pass the suite. Extend TestLoad_TLSAutomation with a GCP block and assert all fields.

	GCPPrivateCA *TLSGCPPrivateCAIssuerConfig `yaml:"gcpPrivateCA,omitempty"`

internal/connect/cert/issuer.go:304

• Please add coverage for the empty CredentialsFile branch. The new tests exercise a service-account file and a missing file, but none runs run without a credentials file, so a regression that disables the documented ADC/workload-identity fallback would go unnoticed. Use a controlled ADC fixture (for example GOOGLE_APPLICATION_CREDENTIALS) rather than relying on the test runner's ambient credentials.

	if g.credentialsFile != "" {
		opts = append(opts, option.WithAuthCredentialsFile(option.ServiceAccount, g.credentialsFile))
	}

internal/connect/cert/issuer.go:348

• pem_certificate_chain from Certificate Authority Service already contains the leaf certificate (the API documents it as the full chain, leaf first). Prepending PemCertificate here therefore returns the leaf twice; automation.issue will send that duplicate as an intermediate, which can make downstream TLS clients reject the chain. Parse the returned chain directly (and update the fake response in the test to include the leaf first).

	chain, err := parseCertificateChain(append([]string{issued.GetPemCertificate()}, issued.GetPemCertificateChain()...))