THREESCALE-7836 Refactor TLS InsecureSkipVerify logic to use annotations

[carlkyrillos]

Issue link

THREESCALE-7836

What

This refactors the insecure skip verify logic for the porta client to be enabled via annotations on individual CRs rather than globally as an environment variable.

This PR also add documentation around supported environment variables.

Verification steps

[openshift-ci]

Hi @carlkyrillos. Thanks for your PR.

I'm waiting for a 3scale member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[MStokluska]

/ok-to-test

[austincunningham]

/hold

[eguzki]

After #856, by default, the operator verifies TLS connections. That breaks backwards compat. And I think the default behavior should be TLS cerification. However, for backward compatibility or because I am using self-signed certs, me, as a user, how do I enable insecureSkipVerify ?? Let's say I install the operator using OLM (usual way). How do I enable skip verification?

Have you considered reading enable/disable skip TLS verification from an annotation of the CR? I find it more flexible than global setting at the operator level.

[MStokluska]

After #856, by default, the operator verifies TLS connections. That breaks backwards compat. And I think the default behavior should be TLS cerification. However, for backward compatibility or because I am using self-signed certs, me, as a user, how do I enable insecureSkipVerify ?? Let's say I install the operator using OLM (usual way). How do I enable skip verification?

Have you considered reading enable/disable skip TLS verification from an annotation of the CR? I find it more flexible than global setting at the operator level.

That's a good point. Backward compatibility might be an issue, to enable it as it is when installing via operator you can add the required env to the subscription configuration of the operator. To me this is good and makes sense to do it that way rather than via APIM because in my head, an operator configuration is different to 3scale configuration.

[codeclimate]

Code Climate has analyzed commit e5c98b1 and detected 2 issues on this pull request.

Here's the issue category breakdown:

Category	Count
Duplication	2

View more on Code Climate.

[carlkyrillos]

/unhold

[MStokluska]

Small but to be precise, verbose logging is enabled for local by default, disabled for olm

[MStokluska]

Looks good to me, good job!

/lgtm