Interaction between the existing Service annotation for specifying backend protocol and BackendTLSPolicy

[christianang]

Please describe the problem you have

From #6119, The interaction between the existing Service annotation (as described in https://projectcontour.io/docs/main/config/upstream-tls/) and BackendTLSPolicy is ill-defined. We need to clearly define what happens if both these features are used at once, document it and ensure Contour conforms to this definition.

@sunjayBhatia did you have thoughts on what you'd like this behavior to be, when you were reviewing #6119?

[sunjayBhatia]

The annotation can specify a specific port to set the upstream protocol on, e.g. projectcontour.io/upstream-protocol.tls: "8443". This could also be a plaintext protocol, h2c

BackendTLSPolicy can do the same, though does not support setting the application protocol (i.e it corresponds to the annotation setting protocol to tls, not h2).

I'm thinking if you have both present, the BackendTLSPolicy wins out (e.g. with annotation projectcontour.io/upstream-protocol.h2c: "8443" and a BackendTLSPolicy targeting the Service and possibly port, the upstream connection should rather be over TLS)

This issue will likely result in some additional unit and/or featuretests to demonstrate precedence