[THREESCALE-7921] New APIcast CRD field: caCertificateSecretRef

[tkan145]

What

Fix https://issues.redhat.com/browse/THREESCALE-7921

Verification step

• Checkout this branch

• Run

make install

• Create apicast config

export NAMESPACE=apicast-test
oc new-project $NAMESPACE

cat << EOF | oc create -f -
apiVersion: v1
kind: Secret
metadata:
  name: apicast-config-secret
  namespace: $NAMESPACE
type: Opaque
stringData:
  config.json: |
    {
      "services": [
        {
          "proxy": {
            "policy_chain": [
              { "name": "apicast.policy.upstream",
                "configuration": {
                  "rules": [{
                    "regex": "/",
                    "url": "http://echo-api.3scale.net"
                  }]
                }
              }
            ]
          }
        }
      ]
    }
EOF

• Generate CA cert

openssl genrsa -out rootCA.key 2048
openssl req -batch -new -x509 -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem

• Create secret

oc create secret generic cacert --namespace=apicast-test --from-file=ca-bundle.crt=rootCA.pem 

• Create APIcast

cat << EOF | oc create -f -
apiVersion: apps.3scale.net/v1alpha1
kind: APIcast
metadata:
  name: example-apicast
  namespace: $NAMESPACE
spec:
  caCertificateSecretRef:
    name: cacert
  embeddedConfigurationSecretRef:
    name: apicast-config-secret
EOF

• Run operator locally

make run

• Wait APIcast pod comes online
• Check that the cert is mounted correctly

 ▲ t/fixtures/CA oc get pod                                                                                     
                       
NAME                                       READY   STATUS    RESTARTS   AGE                                     
apicast-example-apicast-666bddf8d5-nns84   0/1     Running   0          27s                                     
 ▲ t/fixtures/CA oc rsh apicast-example-apicast-666bddf8d5-nns84 cat /var/run/secrets/apicast/ca-bundle.crt     
                         
-----BEGIN CERTIFICATE-----                                                                                     
[CA certificate content]                                                   
-----END CERTIFICATE-----                                                                                       

• Check the env var is set correctly

 △ t/fixtures/CA oc rsh apicast-example-apicast-666bddf8d5-nns84 env | grep SS
SSL_CERT_FILE=/var/run/secrets/apicast/ca-bundle.crt   

[MStokluska]

root-ca.crt doesn't exists, I think we need to change the rootCA.pem > root-ca.crt

[tkan145]

updated doc and also rebased