secretsync: avoid synced Secret name collisions

Synced Secret names were derived by concatenating namespace and name, which allows distinct source objects such as a/b-c and a-b/c to target the same synchronized Secret. Use a shared hashed name derivation for Secret and ConfigMap sync outputs and all SDS references.

Keep legacy-name cleanup for migration, but guard cleanup and updates with ownership-label validation so unrelated existing Secrets are not deleted or overwritten. Add regression coverage for Secret and ConfigMap collision cases.

Signed-off-by: Kateryna Nezdolii <kateryna.nezdolii@gmail.com>

Author: nezdolik

operator/pkg/gateway-api/testdata/gateway/gateway-cross-protocol-same-hostname/output/cec-cross-protocol-same-hostname.yaml

@@ -94,7 +94,7 @@ spec:
               "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
               commonTlsContext:
                 tlsCertificateSdsSecretConfigs:
-                  - name: cilium-secrets/gateway-conformance-infra-cross-protocol-tls
+                  - name: cilium-secrets/cilium-sync-secret-9e3240dd5d81ba618935c49937e7e7dbefac584583bbc8129c126827692366f5
       listenerFilters:
         - name: envoy.filters.listener.tls_inspector
           typedConfig:

operator/pkg/gateway-api/testdata/gateway/gateway-invalid-tls-configuration/output/cec-gateway-certificate-malformed-secret.yaml

@@ -79,7 +79,7 @@ spec:
           '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             tlsCertificateSdsSecretConfigs:
-            - name: cilium-secrets/gateway-conformance-infra-malformed-certificate
+            - name: cilium-secrets/cilium-sync-secret-f6a590ea119ae69b4e1296bcca9a7e17f98fe1ec740b68bf166967deab342dd5
     listenerFilters:
     - name: envoy.filters.listener.tls_inspector
       typedConfig:

operator/pkg/gateway-api/testdata/gateway/gateway-invalid-tls-configuration/output/cec-gateway-certificate-nonexistent-secret.yaml

@@ -79,7 +79,7 @@ spec:
           '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             tlsCertificateSdsSecretConfigs:
-            - name: cilium-secrets/gateway-conformance-infra-nonexistent-certificate
+            - name: cilium-secrets/cilium-sync-secret-f0a504d62c5263d63e5d3af48a6ddd004f022b8b54c0b23da6ff37987c66e17a
     listenerFilters:
     - name: envoy.filters.listener.tls_inspector
       typedConfig:

operator/pkg/gateway-api/testdata/gateway/gateway-invalid-tls-configuration/output/cec-gateway-certificate-unsupported-group.yaml

@@ -79,7 +79,7 @@ spec:
           '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             tlsCertificateSdsSecretConfigs:
-            - name: cilium-secrets/gateway-conformance-infra-tls-validity-checks-certificate
+            - name: cilium-secrets/cilium-sync-secret-261c3c0ed7182ef9200310151d846ebc492656fb3bcdf448223b3495dcc9016a
     listenerFilters:
     - name: envoy.filters.listener.tls_inspector
       typedConfig:

operator/pkg/gateway-api/testdata/gateway/gateway-invalid-tls-configuration/output/cec-gateway-certificate-unsupported-kind.yaml

@@ -79,7 +79,7 @@ spec:
           '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             tlsCertificateSdsSecretConfigs:
-            - name: cilium-secrets/gateway-conformance-infra-tls-validity-checks-certificate
+            - name: cilium-secrets/cilium-sync-secret-261c3c0ed7182ef9200310151d846ebc492656fb3bcdf448223b3495dcc9016a
     listenerFilters:
     - name: envoy.filters.listener.tls_inspector
       typedConfig:

operator/pkg/gateway-api/testdata/gateway/gateway-modify-listeners/output/cec-gateway-add-listener.yaml

@@ -86,7 +86,7 @@ spec:
           '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             tlsCertificateSdsSecretConfigs:
-            - name: cilium-secrets/gateway-conformance-infra-tls-validity-checks-certificate
+            - name: cilium-secrets/cilium-sync-secret-261c3c0ed7182ef9200310151d846ebc492656fb3bcdf448223b3495dcc9016a
     listenerFilters:
     - name: envoy.filters.listener.tls_inspector
       typedConfig:

operator/pkg/gateway-api/testdata/gateway/gateway-modify-listeners/output/cec-gateway-remove-listener.yaml

@@ -86,7 +86,7 @@ spec:
           '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
           commonTlsContext:
             tlsCertificateSdsSecretConfigs:
-            - name: cilium-secrets/gateway-conformance-infra-tls-validity-checks-certificate
+            - name: cilium-secrets/cilium-sync-secret-261c3c0ed7182ef9200310151d846ebc492656fb3bcdf448223b3495dcc9016a
     listenerFilters:
     - name: envoy.filters.listener.tls_inspector
       typedConfig:

operator/pkg/gateway-api/testdata/gateway/gateway-multi-port-https-with-multi-port-tls-passthrough/output/cec-multi-port-https-with-multi-port-tls-passthrough.yaml

@@ -64,7 +64,7 @@ spec:
               "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
               commonTlsContext:
                 tlsCertificateSdsSecretConfigs:
-                  - name: cilium-secrets/gateway-conformance-infra-multi-port-https-tls
+                  - name: cilium-secrets/cilium-sync-secret-62f4462c70564aa40ef22396762652f4b3bd572448747e332d134b0c028c0cfb
       listenerFilters:
         - name: envoy.filters.listener.tls_inspector
           typedConfig:
@@ -125,7 +125,7 @@ spec:
               "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
               commonTlsContext:
                 tlsCertificateSdsSecretConfigs:
-                  - name: cilium-secrets/gateway-conformance-infra-multi-port-https-tls
+                  - name: cilium-secrets/cilium-sync-secret-62f4462c70564aa40ef22396762652f4b3bd572448747e332d134b0c028c0cfb
       listenerFilters:
         - name: envoy.filters.listener.tls_inspector
           typedConfig:

operator/pkg/gateway-api/testdata/gateway/gateway-multi-port-https/output/cec-multi-port-https.yaml

@@ -61,7 +61,7 @@ spec:
               "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
               commonTlsContext:
                 tlsCertificateSdsSecretConfigs:
-                  - name: cilium-secrets/gateway-conformance-infra-multi-port-https-tls
+                  - name: cilium-secrets/cilium-sync-secret-62f4462c70564aa40ef22396762652f4b3bd572448747e332d134b0c028c0cfb
       listenerFilters:
         - name: envoy.filters.listener.tls_inspector
           typedConfig:
@@ -122,7 +122,7 @@ spec:
               "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
               commonTlsContext:
                 tlsCertificateSdsSecretConfigs:
-                  - name: cilium-secrets/gateway-conformance-infra-multi-port-https-tls
+                  - name: cilium-secrets/cilium-sync-secret-62f4462c70564aa40ef22396762652f4b3bd572448747e332d134b0c028c0cfb
       listenerFilters:
         - name: envoy.filters.listener.tls_inspector
           typedConfig:

operator/pkg/gateway-api/testdata/gateway/gateway-ns-restricted-same-hostname/output/cec-ns-restricted-same-hostname.yaml

@@ -56,7 +56,7 @@ spec:
               "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
               commonTlsContext:
                 tlsCertificateSdsSecretConfigs:
-                  - name: cilium-secrets/gateway-conformance-infra-ns-restricted-tls
+                  - name: cilium-secrets/cilium-sync-secret-81d5b0bc773836eb895d632bb828ae299373ed522137978b10722821a7522210
       listenerFilters:
         - name: envoy.filters.listener.tls_inspector
           typedConfig:
@@ -117,7 +117,7 @@ spec:
               "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
               commonTlsContext:
                 tlsCertificateSdsSecretConfigs:
-                  - name: cilium-secrets/gateway-conformance-infra-ns-restricted-tls
+                  - name: cilium-secrets/cilium-sync-secret-81d5b0bc773836eb895d632bb828ae299373ed522137978b10722821a7522210
       listenerFilters:
         - name: envoy.filters.listener.tls_inspector
           typedConfig: