Add support for FQDN K8s API servers and Root CA chains

[thephw]

Problem

Our k8s API servers use a fully qualified domain name and TLS certs from LetsEncrypt. In the current implementation no root CA certfiles are provided to HTTPoison. This causes an error when trying to configure and use a connection like below with :verify_peer. This is a bit unexpected.

> {:ok, auth} = K8s.Conn.Auth.Token.create(%{"token" => "avalidbearertokenhere"})
...
> conn = %K8s.Conn{auth: auth, cluster_name: "thephw", ca_cert: nil, user_name: "thephw", url: "https://k8s.flowerwork.net/"}
...
> operation = K8s.Client.list("v1", "Node") 
...
> conn  |> K8s.Client.run(operation)
{:error, %HTTPoison.Error{id: nil, reason: {:options, {:cacertfile, []}}}}

Prior Art

Looked at a handful of other elixir libraries to see how they were managing root CA files. Most of them were using CAStore

• tailwind hex package usage
• esbuild hex package usage

Solution

Add CAStore dependency and integrate cacertfile option into K8s.Conn with CAStore.file_path() as the default.

Changelog

• Add CAStore dependency for root CAs
• This adds support for k8s servers using TLS certs with a custody chain back to a root certificate authority. i.e. no intermediate certificates
• This would be typical of any k8s server with a public API available at a FQDN with a TLS cert whose chain of custody is covered by the root certificate authorities.
• Sets the default ca_provider on K8s.Conn to CAStore
• Sets the default cacertfile parameter for ssl_options to conn. cacertfile
• Update conn_test.exs assertions for ssl_options
• This makes the default when not using an intermediate certificate chain to use the root CA certificate chain.
• This does not change the behavior when using connection configuration with intermediate certificate authorities

[mruoss]

This is great, thanks @thephw!

[mruoss]

Why not {:castore, "~> 0.1.0"}?

[thephw]

I think you're right it'd probably be better to pin to the minor version. At the moment they are functionally equivalent all releases are 0.1.X, but we could protect against any major API changes by pinning it to the minor version. Let me update that real quick.

[thephw]

Updated 👍🏻