fix(health-checker): get certificate with upstream.ws_id

[Oyami-Srk]

Summary

This is to avoid calling get_certificatewith workspace id from ngx.ctx.workspace which is volatile when in a timer callback.

Checklist

• The Pull Request has tests
• A changelog file has been created under changelog/unreleased/kong or skip-changelog label added on PR if changelog is unnecessary. README.md
• There is a user-facing docs PR against https://github.com/Kong/docs.konghq.com - PUT DOCS PR HERE

Issue reference

Fix KAG-5821

[chobits]

Need a changelog entry for this PR, its a bugfix for balancer system

[chobits]

From this fix, I guess there might be similar bugs for other parts of the code that call select(pk) without appending ws_id. Therefore I searched the source code:

$ grep 'select(pk' -R kong -n
kong/runloop/certificate.lua:192:  local certificate, err = kong.db.certificates:select(pk)
kong/db/dao/snis.lua:133:  local _, err, err_t = invalidate_cache(self, self:select(pk))
kong/db/dao/snis.lua:155:  local _, err, err_t = invalidate_cache(self, self:select(pk))

We need to add another internal ticket(KAG) to track and verify whether calling select(pk) without ws_id also causes similar problems.

[Oyami-Srk]

@chobits Every DAO operations for workspace-able entities without ws_id in timer context are dangerous. Not only the select.

[chobits]

@chobits Every DAO operations for workspace-able entities without ws_id in timer context are dangerous. Not only the select.

yep, I'll file a ticket to track this.

updated: the internal ticket https://konghq.atlassian.net/browse/KAG-5842

[team-gateway-bot]

Successfully created cherry-pick PR for master:

• https://github.com/kong/kong-ee/pull/10750