Feature/custom certs

[rustyjux]

Description

Fixes:

• Allow custom certificates to be used for routes #125

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Documentation (non-breaking change with enhancements to documentation)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist

• I have checked that unit tests pass locally with my changes
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)

Further comments

[rustyjux]

Currently deployed in dev (Silver, Gold/DR) at 5ba7708

Can see example route in Gold - https://console.apps.gold.devops.gov.bc.ca/k8s/ns/b8840c-dev/routes/wild-ns-gw-41c0c-webapps.gov.bc.ca from:

# contains .api.gov.bc.ca certificate which is also valid for webapps.gov.bc.ca
certificates:
  - cert: "NORMAL_DATA_API_CERT"
    key: "NORMAL_DATA_API_KEY"
    tags: [ns.gw-41c0c]
    id: 73600400-dc9b-45be-9518-47cb0e6b203e
    snis:
      - name: webapps.gov.bc.ca
        id: 79009c9e-0f4d-40b5-9707-bf2fe9f50502
        tags: [ns.gw-41c0c]
services:
  - name: that-custom-one
    host: httpbin.org
    tags: [ns.gw-41c0c]
    port: 443
    protocol: https
    routes:
      - name: test-aps-webapps
        tags: [ns.gw-41c0c, random]
        hosts:
          - webapps.gov.bc.ca
  - name: another-non-custom-one
    host: httpbin.org
    tags: [ns.gw-41c0c]
    port: 443
    protocol: https
    routes:
      - name: that-non-custom-one
        tags: [ns.gw-41c0c]
        hosts:
          - new.api.gov.bc.ca

[ikethecoder]

Can this new block of logic be moved to a separate function that returns cert and cert_id? Also, not sure if the Kong id is a sufficient identifier for determining there is a changed cert, because a user can update the cert.cert and cert.key while keeping the kong id the same. You could hash the cert.cert and use that, or inspect the cert itself to get the serial number. Alternatively, don't bother passing the sslCertificateId and let kube api dig out the serial number for comparison.

[ikethecoder]

Rather than duplicating the is_host_custom_domain function, I would just skip it, and assume that if the certificates is passed, then it is only including custom certs.. so just need to move the logger.debug line under the if certificates. You can then delete the is_host_custom_domain for kube.

[rustyjux]

I believe it's necessary to keep is_host_custom_domain - otherwise how to have kube raise an exception when a custom domain is used but no certs are provided?

e.g. this test: https://github.com/bcgov/gwa-api/blob/feature/custom-certs/microservices/kubeApi/tests/clients/test_ocp_routes.py#L161

[ikethecoder]

kube can still raise an exception - if no cert is found an exception should be thrown

[ikethecoder]

what if host_transformation is enabled? Where does ssl_key and ssl_crt get set to when custom_cert_found is False?

[rustyjux]

@ikethecoder I believe I have address our issues in the last set of commits