Make auth-webhook async (#156)

* Make auth-webhook async

This converts auth-webhook from a synchronous Flask app managed by
gunicorn to an asynchronous aiohttp app managed by gunicorn. This allows
it to process any number of concurrent requests even if requests end up
blocked or timing out on a configured external auth endpoint (keystone,
custom addr, etc).

Fixes: [lp:1927145][]

[lp:1927145]: https://bugs.launchpad.net/charm-kubernetes-master/+bug/1927145

* Fix verify_ssl flag after failed cert

Co-authored-by: Kevin W Monroe <kevin.monroe@canonical.com>

* Fix rendering of extra auth URLs when they are None

Co-authored-by: Kevin W Monroe <kevin.monroe@canonical.com>

* Fix api_ver to be rendered as template var, not dynamic route

Co-authored-by: Kevin W Monroe <kevin.monroe@canonical.com>

* Cache secrets in memory

Cache the secrets in memory and refresh them in a background task,
rather than hitting the API server again on every request.

Also fixes the subprocess / kubectl calls not actually being async.

* Improve error handling around request and config file parsing

* Add test for auth load / slow custom endpoint

* Fix lint errors

Apparently, I needed to recreate the tox env to update dependencies.

* Add retry for reading kube config to account for race between charm and webhook

* Drop Flask and Werkzeug, and pin aiohttp

Co-authored-by: Kevin W Monroe <kevin.monroe@canonical.com>

reactive/kubernetes_master.py

@@ -851,6 +851,14 @@ def set_final_status():
         )
         return
 
+    if not is_flag_set("kubernetes-master.auth-webhook-service.started"):
+        hookenv.status_set("waiting", "Waiting for auth-webhook service to start")
+        return
+
+    if not is_flag_set("kubernetes-master.apiserver.configured"):
+        hookenv.status_set("waiting", "Waiting for API server to be configured")
+        return
+
     auth_setup = is_flag_set("authentication.setup")
     webhook_tokens_setup = is_flag_set("kubernetes-master.auth-webhook-tokens.setup")
     if auth_setup and not webhook_tokens_setup: