feat: add tls.caCertCredentialName (#16732)

Signed-off-by: Sergei Nikolaev <[email protected]>

Author: kinolaev

content/en/docs/tasks/traffic-management/ingress/secure-ingress/index.md

@@ -627,6 +627,7 @@ Istio supports reading a few different Secret formats, to support integration wi
 * A TLS Secret with keys `tls.key` and `tls.crt`, as described above. For mutual TLS, a separate generic Secret named `<secret>-cacert`, with a `cacert` key. For example, `httpbin-credential` has `tls.key` and `tls.crt`, and `httpbin-credential-cacert` has `cacert`.
 * A generic Secret with keys `key` and `cert`. For mutual TLS, a `cacert` key can be used.
 * A generic Secret with keys `key` and `cert`. For mutual TLS, a separate generic Secret named `<secret>-cacert`, with a `cacert` key. For example, `httpbin-credential` has `key` and `cert`, and `httpbin-credential-cacert` has `cacert`.
+* For mutual TLS, a separate generic Secret with a `cacert` or `ca.crt` key can be referenced with `caCertCredentialName`. It takes precedence over CA certificates in the Secret referenced with `credentialName(s)`.
 * The `cacert` key value can be a CA bundle consisting of concatenated individual CA certificates.
 
 ### SNI Routing