Remove mentions of VERIFY_CERTIFICATE_AT_CLIENT and ENABLE_AUTO_SNI

[leosarra]

Starting with Istio 1.21 VERIFY_CERTIFICATE_AT_CLIENT and ENABLE_AUTO_SNI are true by default.
Some comments had to be updated

[hzxuzhonghu]

the relationship with VERIFY_CERTIFICATE_AT_CLIENT looks very confusing, would cause usage trouble

[leosarra]

Yes I agree. Overall the VERIFY_CERTIFICATE_AT_CLIENT makes the doc a bit more confusing for the user.
On the other end we can look forward to the removal of VERIFY_CERTIFICATE_AT_CLIENT once the deprecation process is completed (given that it is already in the compatibility values starting with Istio 1.21, it is planned for removal in 1.24).

Perhaps this field can be simplified as follows:

// The `insecureSkipVerify` flag determines whether the proxy should skip verifying the
// CA signature and SAN for the server certificate associated
// with a specific host. This field is ignored if the environment variable
// `VERIFY_CERTIFICATE_AT_CLIENT` is set to `false` (default value is `true`),
// as the verification of the CA signature and SAN will be bypassed regardless.

Do you think it is better now?

[hzxuzhonghu]

From the code, it only collaborate with VERIFY_CERTIFICATE_AT_CLIENT when deciding whether to enable AutoSanValidation.

func (cb *ClusterBuilder) setAutoSniAndAutoSanValidation(mc *clusterWrapper, tls *networking.ClientTLSSettings) {
	if mc == nil || !features.EnableAutoSni {
		return
	}

	setAutoSni := false
	setAutoSanValidation := false
	if len(tls.Sni) == 0 {
		setAutoSni = true
	}
	if features.VerifyCertAtClient && setAutoSni && len(tls.SubjectAltNames) == 0 && !tls.GetInsecureSkipVerify().GetValue() {
		setAutoSanValidation = true
	}

So the saying is not right

[leosarra]

Good point, insecure skip is not always ignored since it is used also for enabling/disabling auto san validation.
I will update the message.

[howardjohn]

IMO we can just remove any mention of VERIFY_CERTIFICATE_AT_CLIENT. It was a temporary feature flag that is now default-enabled and will eventually be removed.

[hzxuzhonghu]

SGTM without mentioning VERIFY_CERTIFICATE_AT_CLIENT

[leosarra]

I removed mentions of both VERIFY_CERTIFICATE_AT_CLIENT and ENABLE_AUTO_SNI.
I think it is fine to remove the mentions of ENABLE_AUTO_SNI since it is going through the same deprecation process as VERIFY_CERTIFICATE_AT_CLIENT.

[istio-testing]

In response to a cherrypick label: new pull request created: #3132