[certificates]: validate that certs are valid for a Gitpod install

[mrsimonemms]

Description

Add some rudimentary checks for the certificate - importantly, these are the skateboard not the finished article. These download and decode the certificate secret and perform the following checks:

1. that the secret exists and is able to be decoded as an OpenSSL x509 certificate
2. that $DOMAIN, *.$DOMAIN and *.ws.$DOMAIN exist in the secret (the subject alternate names seems to be non-standard, so this is a simple grep)
3. that the current timestamp is between the notBefore and notAfter timestamps

NB it does NOT validate that the certificate's CA is known and installed in the cluster. That's important but it's beyond the 🛹

As with the other KOTS checks, these are perhaps a little rudimentary but they give an indication of whether the provided state is Gitpod-compatible. As there's a time-based test, it is plausible (however unlikely) that this could fail 5 minutes later if the cert expiry then occurs - again, this can be tweaked as a 🚲

IMPORTANT this is not provided as a pre-flight check. As the majority of our users will be using LetsEncrypt and cert-manager to generate their certs, these are not triggered until AFTER the first deployment. This would mean that the pre-flight checks are likely to fail. Instead, this is part of the troubleshooting to provide answers if the installation is not working.

Related Issue(s)

Fixes #11865

How to test

Example support bundle - file and analyzer

Install via KOTS and go to "troubleshoot" to build a support bundle. This has been checked with both a LetsEncrypt and a self-signed cert built in-cluster. I do not have a valid, publicly-signed cert that's not provided by LetsEncrypt.

To check the edge-cases that KOTS smooths away for us, you can run the script in the image directly

docker run -it --rm \
  -v "${HOME}/.kube:/root/.kube" \
  eu.gcr.io/gitpod-core-dev/build/kots-config-check/certificate:mrsimonemms-add-kots-support-bundle-11865.1 \
  <domain> \
  gitpod \
  https-certificates

Release Notes

[certificates]: validate that certs are valid for a Gitpod install

Documentation

Werft options:

• /werft with-local-preview
  If enabled this will build install/preview
• /werft with-preview
• /werft with-integration-tests=all
  Valid options are all, workspace, webapp, ide

[Pothulapati]

LGTM! 👍🏼

holding on the small nit, but feel free to remove it if it's not worth it.

/hold

[mrsimonemms]

/unhold