Description:
Currently, extension manager loads the CA certificate when establishing GRPC connections:

Connections are then cached and reused:

At this time, golang doesn't provide a convenient way to reload CA certificates: golang/go#64796. However, grpc-go's advancedtls library does support working with CA cert providers/callbacks: https://pkg.go.dev/google.golang.org/grpc/security/advancedtls#RootCertificateOptions.

Envoy Gateway can implement dynamic reload of the extension manager CA certificate by:

• Using grpc-go's advancedtls
• Implementing a provider/callback that:
  • reads the CA cert from controller-runtime cache of k8s secret
  • reads the CA cert from a cache watching a mount of the K8s secret in Envoy Gateway's pod

[optional Relevant Links:]

Any extra documentation required to understand the issue.