Bug-fix: Clear stale listener SSL configuration when an Ingress is updated

[jlamillan]

Summary

Fixes #144 issue of stale OCI Load Balancer listener SSL configuration when an Ingress is updated to TCP passthrough.

For TCP ingresses, listener TLS config is ignored by design, but existing OCI listener SslConfiguration can be left during an update, which can cause corresponding OCI listeners on the load-balancer remain use-ssl=true with a cipher suite even though the desired listener protocol was TCP passthrough e.g.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    oci-native-ingress.oraclecloud.com/http-listener-port: "10901"
    oci-native-ingress.oraclecloud.com/protocol: TCP
  name: sauron-dev-test-thanos-grpc
  namespace: dev-test
spec:
  ingressClassName: dev-test-oci-native
  rules:
  - http:
      paths:
      - backend:
          service:
            name: dev-test1-thanos-query
            port:
              number: 10901
        pathType: ImplementationSpecific

Changes

• Detect listener drift when desired listener TLS config is empty but the actual OCI listener still has SslConfiguration.
• Update the listener with SSL preservation disabled in that reconciliation path so OCI receives sslConfiguration: null.
• Keep existing default behavior for routing-only listener updates where SSL config should be preserved.
• Add regression coverage for clearing stale SSL config on TCP listeners.

Manual verification

First, I create an HTTP2 Ingress resource with spc.tls and verified use-ssl=true on the OCI load-balancer listener. Then I subsequently updated the protocol Ingress to be TCP via oci-native-ingress.oraclecloud.com/protocol: TCP and removed spc.tls and then re-verified protocol and use-ssl=false on the OCI load-balancer. OCI load-balancer was reconciled appropriately.

I’ve also repeatedly run our product's integration tests in OCI Native mode with this change which creates multiple OCI load balancers with DNS names and certificates across different Ingress configurations, then validates the endpoints end to end. I also reviewed the OCI Load Balancer work requests and OCI Native ingress controller logs during the CI tests.

[oracle-contributor-agreement]

Thank you for your pull request and welcome to our community! To contribute, please sign the Oracle Contributor Agreement (OCA).
The following contributors of this PR have not signed the OCA:

• akarsh.es@gmail.com (@AkarshES)

To sign the OCA, please create an Oracle account and sign the OCA in Oracle's Contributor Agreement Application.

When signing the OCA, please provide your GitHub username. After signing the OCA and getting an OCA approval from Oracle, this PR will be automatically updated.

If you are an Oracle employee, please make sure that you are a member of the main Oracle GitHub organization, and your membership in this organization is public.