gateway api v1.1.0 experimental

BackendTLSPolicy.spec.validation.caCertificateRefs

CACertificateRefs contains one or more references to Kubernetes objects that contain a PEM-encoded TLS CA certificate bundle, which is used to validate a TLS handshake between the Gateway and backend Pod. If CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified, not both. If CACertifcateRefs is empty or unspecified, the configuration for WellKnownCACertificates MUST be honored instead if supported by the implementation. References to a resource in a different namespace are invalid for the moment, although we will revisit this in the future. A single CACertificateRef to a Kubernetes ConfigMap kind has "Core" support. Implementations MAY choose to support attaching multiple certificates to a backend, but this behavior is implementation-specific. Support: Core - An optional single reference to a Kubernetes ConfigMap, with the CA certificate in a key named `ca.crt`. Support: Implementation-specific (More than one reference, or other kinds of resources).

BackendTLSPolicy.spec.validation.caCertificateRefs fields and descriptions
Field / Type	Description
group `string` required	Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred. `maxLength: 253` `pattern: ^$\|^[a-z0-9]([-a-z0-9][a-z0-9])?(\.[a-z0-9]([-a-z0-9][a-z0-9])?)*$`
kind `string` required	Kind is kind of the referent. For example "HTTPRoute" or "Service". `minLength: 1` `maxLength: 63` `pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$`
name `string` required	Name is the name of the referent. `minLength: 1` `maxLength: 253`