tmp: replace the route-specific CA with trust bundle?

Author: stlaz

pkg/operator2/operator.go

@@ -532,9 +532,7 @@ func (c *authOperator) checkDeploymentReady(deployment *appsv1.Deployment, opera
 }
 
 func (c *authOperator) checkRouteHealthy(route *routev1.Route, routerSecret *corev1.Secret, ingress *configv1.Ingress) (ready bool, msg, reason string, err error) {
-	caData := routerSecretToCA(route, routerSecret, ingress)
-
-	rt, err := transportFor("", caData, nil, nil)
+	rt, err := transportForTrustedCA("", nil, nil)
 	if err != nil {
 		return false, "", "FailedTransport", fmt.Errorf("failed to build transport for route: %v", err)
 	}

pkg/operator2/route.go

@@ -1,7 +1,6 @@
 package operator2
 
 import (
-	"crypto/x509"
 	"fmt"
 
 	corev1 "k8s.io/api/core/v1"
@@ -127,31 +126,6 @@ func routerSecretToSNI(routerSecret *corev1.Secret) []configv1.NamedCertificate
 	return out
 }
 
-func routerSecretToCA(route *routev1.Route, routerSecret *corev1.Secret, ingress *configv1.Ingress) []byte {
-	var caData []byte
-
-	// find the domain that matches our route
-	if certs, ok := routerSecret.Data[ingress.Spec.Domain]; ok {
-		caData = certs
-	}
-
-	// if we have no CA, use system roots (or more correctly, if we have no CERTIFICATE block)
-	// TODO so this branch is effectively never taken, because the value of caData
-	// is the concatenation of tls.crt and tls.key - the .crt data gets parsed
-	// as a valid cert by AppendCertsFromPEM meaning ok is always true.
-	// because Go is weird with how it validates TLS connections, having the actual
-	// peer cert loaded in the transport is totally fine with the connection even
-	// without having the CA loaded.  this is weird but it lets us tolerate scenarios
-	// where we do not have the CA (i.e. admin is using a cert from an internal company CA).
-	// thus the only way we take this branch is if len(caData) == 0
-	if ok := x509.NewCertPool().AppendCertsFromPEM(caData); !ok {
-		klog.Infof("using global CAs for %s, ingress domain=%s, cert data len=%d", route.Spec.Host, ingress.Spec.Domain, len(caData))
-		return nil
-	}
-
-	return caData
-}
-
 func getCanonicalHost(route *routev1.Route, ingressConfig *configv1.Ingress) string {
 	host := ingressToHost(ingressConfig)
 	for _, ingress := range route.Status.Ingress {