Standardize Secrets and Certificates in the Platform Gateway with manifest-based YAML resource model

[nimsara66]

Overview

The current implementation of upstream certificate management in the Platform Gateway does not align with the manifest-based YAML structure that is already adopted for managing Rest APIs, LLMs, and MCPs.

For consistency and extensibility, should upstream certificates also follow the same declarative resource model used across the Platform Gateway?

apiVersion: gateway.api-platform.wso2.com/v1alpha1
kind: Certificate
metadata:
  name: my-custom-ca
spec:
  displayName: My Custom CA
  description: Custom root CA for backend TLS verification
  certificate:
    pem: |
      -----BEGIN CERTIFICATE-----
      MIIDXTCCAkWgAwIBAgIJAKL0UG+mRKtjMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
      ...
      -----END CERTIFICATE-----

As discussed in the Secure Secret Management proposal [1], the platform would benefit from supporting multiple secret providers in the future while maintaining a consistent manifest structure.

The proposed sqlite persistence remain as the default provider:

apiVersion: gateway.api-platform.wso2.com/v1alpha1
kind: Secret
metadata:
  name: wso2-openai-key
spec:
  displayName: WSO2 OpenAI Key
  description: WSO2 OpenAI provider API Key
  type: default
  key: wso2-openai-secret
  value: sk_xxx

To support HashiCorp Vault as a secret service provider in the future, the same manifest can be extended in a minimal and declarative manner:

apiVersion: gateway.api-platform.wso2.com/v1alpha1
kind: Secret
metadata:
  name: wso2-openai-key
spec:
  displayName: WSO2 OpenAI Key
  description: WSO2 OpenAI provider API Key
  type: hashicorp
  key: wso2-openai-key
  hashicorp:
    path: openai/api
    field: api-key

[1] - #654