Bug 1316698

Description of problem:

When a Re-Encrypt Termination route is created the ca-file not created in /var/lib/containers/router/cacerts/<PROJECT><ROUTE_NAME>  when created with only destinationCACertificate, cert and key are not included due to wanting to use the routers "--default-cert"


Version-Release number of selected component (if applicable):
3.1.1.6

How reproducible:
100%

Steps to Reproduce:
1. Create route [1] 

2. `oc rsh router` 

3. $ grep bug haproxy.config                  
    backend be_secure_default_bug-reencrypt
    cookie OPENSHIFT_REENCRYPT_default_bug-reencrypt_SERVERID insert indirect nocache httponly secure
    server 10.1.5.18:5000 10.1.5.18:5000 ssl check inter 5000ms verify required ca-file /var/lib/containers/router/cacerts/default_bug-reencrypt.pem cookie 10.1.5.18:5000

4.ll /var/lib/containers/router/cacerts/ -a
  total 8
  drwxrwxrwx. 2 root root   37 Mar 10 14:33 .
  drwxrwxrwx. 4 root root   50 Mar  9 10:29 ..
  -rw-r--r--. 1 root root 4109 Mar 10 14:33 default_test-secured.pem


Actual results:


  [ALERT] 056/103231 (25235) : Proxy 'default_bug-reencrypt', server '10.1.0.66:8443' [/var/lib/haproxy/conf/haproxy.config:302] unable to load CA file '/var/lib/containers/router/cacerts/default_bug-reencrypt.pem'.
  [ALERT] 056/103231 (25235) : Fatal errors found in configuration.


Expected results:

Work with the default certs and the supplied destinationCACertificate for a Re-Encrypt Termination route


Additional info:

[1] BUG route object

$ oc get route bug-reencrypt -o yaml 
apiVersion: v1
items:
- apiVersion: v1
  kind: Route
  metadata:
    creationTimestamp: 2016-03-10T19:39:30Z
    name: bug-reencrypt
    namespace: default
    resourceVersion: "1199068"
    selfLink: /oapi/v1/namespaces/default/routes/bug-reencrypt
    uid: ce9d4308-e6f7-11e5-ae52-fa163eb4e380
  spec:
    host: www.bug.com
    tls:
      destinationCACertificate: |-
        -----BEGIN CERTIFICATE-----
        XXXXXX CONTENTS HERE XXXXXX
        -----END CERTIFICATE-----
        -----BEGIN CERTIFICATE-----
        XXXXXX CONTENTS HERE XXXXXX
        -----END CERTIFICATE-----
      termination: reencrypt
    to:
      kind: Service
      name: docker-registry
  status: {}

[2] Control Test to ensure it works when including all data: 

# oc route get test-secured -o yaml

  apiVersion: v1
  kind: Route
  metadata:
    creationTimestamp: 2016-03-10T18:57:48Z
    name: test-secured
    namespace: default
    resourceVersion: "1194643"
    selfLink: /oapi/v1/namespaces/default/routes/test-secured
    uid: fb8d2884-e6f1-11e5-ae52-fa163eb4e380
  spec:
    host: www.test.com
    tls:
      certificate: |-
        -----BEGIN CERTIFICATE-----
        XXXXXX CONTENTS HERE XXXXXX
      destinationCACertificate: |-
        -----BEGIN CERTIFICATE-----
        XXXXXX CONTENTS HERE XXXXXX
        -----END CERTIFICATE-----
        -----BEGIN CERTIFICATE-----
         XXXXXX CONTENTS HERE XXXXXX
        -----END CERTIFICATE-----
      key: |-
        -----BEGIN PRIVATE KEY-----
         XXXXXX CONTENTS HERE XXXXXX
        -----END PRIVATE KEY-----
      termination: reencrypt
    to:
      kind: Service
      name: docker-registry
  status: {}
kind: List
metadata: {}


$ ll /var/lib/containers/router/cacerts/ -a
  total 8
  drwxrwxrwx. 2 root root   37 Mar 10 14:33 .
  drwxrwxrwx. 4 root root   50 Mar  9 10:29 ..
  -rw-r--r--. 1 root root 4109 Mar 10 14:33 default_test-secured.pem

$ oc rsh -n default router-5-6wo5k
[root@rnode5 conf]# grep "test-secured" haproxy.config       
backend be_secure_default_test-secured
  cookie OPENSHIFT_REENCRYPT_default_test-secured_SERVERID insert indirect nocache httponly secure
  server 10.1.5.18:5000 10.1.5.18:5000 ssl check inter 5000ms verify required ca-file /var/lib/containers/router/cacerts/default_test-secured.pem cookie 10.1.5.18:5000