operator: Disable client certificate authentication on gateway (#6594)

operator/CHANGELOG.md

@@ -1,5 +1,6 @@
 ## Main
 
+- [6594](https://github.com/grafana/loki/pull/6594) **xperimental**: Disable client certificate authentication on gateway
 - [6551](https://github.com/grafana/loki/pull/6561) **periklis**: Add operator docs for object storage
 - [6549](https://github.com/grafana/loki/pull/6549) **periklis**: Refactor feature gates to use custom resource definition
 - [6514](https://github.com/grafana/loki/pull/6514) **Red-GV** Update all pods and containers to be compliant with restricted Pod Security Standard

operator/internal/manifests/gateway_tenants_test.go

@@ -258,6 +258,7 @@ func TestConfigureDeploymentForMode(t *testing.T) {
 										"--logs.tail.endpoint=http://example.com",
 										"--logs.write.endpoint=http://example.com",
 										fmt.Sprintf("--web.healthchecks.url=https://localhost:%d", gatewayHTTPPort),
+										"--tls.client-auth-type=NoClientCert",
 										"--tls.server.cert-file=/var/run/tls/http/tls.crt",
 										"--tls.server.key-file=/var/run/tls/http/tls.key",
 										"--tls.healthchecks.server-ca-file=/var/run/ca/service-ca.crt",
@@ -429,6 +430,7 @@ func TestConfigureDeploymentForMode(t *testing.T) {
 										"--logs.tail.endpoint=http://example.com",
 										"--logs.write.endpoint=http://example.com",
 										fmt.Sprintf("--web.healthchecks.url=https://localhost:%d", gatewayHTTPPort),
+										"--tls.client-auth-type=NoClientCert",
 										"--tls.server.cert-file=/var/run/tls/http/tls.crt",
 										"--tls.server.key-file=/var/run/tls/http/tls.key",
 										"--tls.healthchecks.server-ca-file=/var/run/ca/service-ca.crt",
@@ -613,6 +615,7 @@ func TestConfigureDeploymentForMode(t *testing.T) {
 										"--logs.write.endpoint=https://example.com",
 										fmt.Sprintf("--web.healthchecks.url=https://localhost:%d", gatewayHTTPPort),
 										"--logs.tls.ca-file=/var/run/ca/service-ca.crt",
+										"--tls.client-auth-type=NoClientCert",
 										"--tls.server.cert-file=/var/run/tls/http/tls.crt",
 										"--tls.server.key-file=/var/run/tls/http/tls.key",
 										"--tls.healthchecks.server-ca-file=/var/run/ca/service-ca.crt",

operator/internal/manifests/openshift/configure.go

@@ -98,6 +98,7 @@ func ConfigureGatewayDeployment(
 	keyFilePath := path.Join(tlsDir, keyFile)
 	caFilePath := path.Join(caDir, caFile)
 	gwArgs = append(gwArgs,
+		"--tls.client-auth-type=NoClientCert",
 		fmt.Sprintf("--tls.server.cert-file=%s", certFilePath),
 		fmt.Sprintf("--tls.server.key-file=%s", keyFilePath),
 		fmt.Sprintf("--tls.healthchecks.server-ca-file=%s", caFilePath),