Route termination options follow public url scheme

[hallelujah]

If public route was created with http: scheme, do not enforce secure route edge redirect

Fixes THREESCALE-3545

TODO

• Add tests for RouteSpec
• Test in live OpenShift

Issues/Questions

The following does not prevent the merge of this PR but we should take into account that when the environment variable KUBERNETES_ROUTE_TLS is set to 1, t or true then it will prevent creating
non secure routes, which might be an issue as Porta has something different from OpenShift

This prevents removing the :tls option

zync/app/services/integration/kubernetes_service.rb

Lines 6 to 7 in 726962b

	class_attribute :maintain_tls_spec,
	default: ActiveModel::Type::Boolean.new.cast(ENV['KUBERNETES_ROUTE_TLS'])

It is used in

zync/app/services/integration/kubernetes_service.rb

Lines 263 to 271 in 726962b

	def update_resource(existing, resource)
	resource.spec.delete_field(:tls) if maintain_tls_spec?
	client.merge_resource(existing, resource)
	rescue K8s::Error::Invalid
	resource.spec.tls = existing.spec.tls if maintain_tls_spec?
	client.delete_resource(existing)
	client.create_resource(resource)
	end

But the integration service builds all routes for both staging and production endpoint, so disabling the maintain_tls_spec for the integration service is not possible because for example, staging route can be HTTP and production route can be HTTPS

zync/app/services/integration/kubernetes_service.rb

Lines 153 to 158 in 726962b

	def build_proxy_routes(entry)
	build_routes('zync-3scale-api-', [
	RouteSpec.new(entry.data.fetch('endpoint'), 'apicast-production', 'gateway'),
	RouteSpec.new(entry.data.fetch('sandbox_endpoint'), 'apicast-staging', 'gateway')
	], labels: labels_for_proxy(entry), annotations: annotations_for(entry))
	end

Openshift testing

Using this Build config

apiVersion: v1
kind: Template
metadata:
  name: "zync-build"
message: "3scale AMP zync builder"
objects:

- kind: "BuildConfig"
  apiVersion: "v1"
  metadata:
    name: "zync-build"
  spec:
    source:
      git:
        uri: "https://github.com/3scale/zync"
        ref: "THREESCALE-3545"
    output:
      to:
        kind: "ImageStreamTag"
        name: "amp-zync:latest"

    strategy:
      type: Docker
      dockerStrategy:

Screenshots

Caveats

Due to OpenShift router limitation, the HTTP and HTTPS ports are automatically set by OpenShift
If you use different ports than ROUTER_SERVICE_HTTP_PORT and ROUTER_SERVICE_HTTPS_PORT, they are not taken into account

[duduribeiro]

Looks good to me 👍

[guicassolato]

Is it OK to merge tls: nil if uri.class != URI::HTTPS?

[hallelujah]

Yes that is what k8s expect, there is a test for it

Anyway this PR is in conflict with the KUBERNETES_ROUTE_TLS env
I will think of a way to make it compatible later

EDIT: Actually you are right:
There might be other secure protocol that could be used but not supported right now. AFAIK we only accept HTTP and HTTPS

[guicassolato]

A couple things seem not to belong to this PR, but OK. I guess you needed them along the process.

[hallelujah]

I need them to make it pass tests, and really opening 2 other PR is not going to happen :D