feat: add certificate conflict detection to admission webhooks

[ronething]

Type of change:

• Bugfix
• New feature provided
• Improve performance
• Backport patches
• Documentation
• Refactor
• Chore
• CI/CD or Tests

What this PR does / why we need it:

When the TLS configuration of the Gateway/Ingress/ApisixTls resources has the same host but uses different certificates, we should intercept.

• add reusable SSL helpers for extracting certificates, keys, and SAN hosts
• introduce an admission conflict detector that blocks mismatched TLS material across Gateway, Ingress, and ApisixTls resources
• cover the detector with unit tests and e2e scenarios for cross-resource and self-conflicts

Pre-submission checklist:

• Did you explain what problem does this PR solve? Or what new features have been added?
• Have you added corresponding test cases?
• Have you modified the corresponding document?
• Is this PR backward compatible? If it is not backward compatible, please discuss on the mailing list first

[Copilot]

Pull Request Overview

This PR introduces certificate conflict detection to admission webhooks to prevent SSL/TLS configuration mismatches across Gateway, Ingress, and ApisixTls resources that share the same GatewayProxy. The feature ensures that when multiple resources configure TLS for the same hostname, they must use identical certificates to avoid conflicting SSL configurations in APISIX.

• Adds reusable SSL utility functions for certificate extraction and validation
• Implements a comprehensive conflict detector that validates SSL configurations across resource types
• Integrates conflict detection into admission webhooks for all three resource types

Reviewed Changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
test/e2e/webhook/ssl_conflict.go	Comprehensive e2e tests covering conflict scenarios between resources
internal/webhook/v1/ssl/conflict_detector_test.go	Unit tests for the conflict detection logic
internal/webhook/v1/ssl/conflict_detector.go	Core conflict detection implementation
internal/webhook/v1/ingress_webhook.go	Integration of SSL conflict detection into Ingress webhook
internal/webhook/v1/gateway_webhook.go	Integration of SSL conflict detection into Gateway webhook
internal/webhook/v1/apisixtls_webhook.go	Integration of SSL conflict detection into ApisixTls webhook
internal/ssl/util.go	Reusable SSL utility functions for certificate handling
internal/adc/translator/ingress.go	Updated to use new SSL utilities
internal/adc/translator/gateway.go	Refactored to use new SSL utilities, removing duplicate code
internal/adc/translator/apisixupstream.go	Updated to use new SSL utilities
internal/adc/translator/apisixtls.go	Updated to use new SSL utilities

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[github-actions]

license-eye has totally checked 349 files.

Valid	Invalid	Ignored	Fixed
252	1	96	0

Click to see the invalid file list

• internal/controller/indexer/ssl_host.go

[AlinsRan]

I suggest adding this check:

if len(newMappings) == 0 { return }

[AlinsRan]

error unused.

[ronething]

updated.

[AlinsRan]

conflicts > 0 ?

[ronething]

updated.