shared cert seemingly removed

[deis]

shared cert seemingly removed

[krancour]

@vdice nice catch. I've put this to the test and have been able to reproduce... however, I believe this is actually a controller bug.

two domains are added to an app, domainA and domainB
a previously added cert is attached to both domains

Manually putting this to the test, at this stage, the service for such an application contains the following relevant annotations:

metadata:
  annotations:
    router.deis.io/certificates: domain-a.foo.com:foo-wildcard,domain-b.foo.com:foo-wildcard
    router.deis.io/domains: timely-odometer,domain-a.foo.com,domain-b.foo.com

And the certificate in question is visible in the app's namespace:

$ kubectl get secrets --namespace=timely-odometer
NAME                  TYPE                                  DATA      AGE
default-token-ja4wo   kubernetes.io/service-account-token   2         53m
foo-wildcard-cert     Opaque                                2         21s
minio-user            Opaque  

the cert is detached from only domainA

After detachment of the foo-wildcard certificate from domain-b.foo.com, the annotations on the service appear correct:

metadata:
  annotations:
    router.deis.io/certificates: domain-b.foo.com:foo-wildcard
    router.deis.io/domains: timely-odometer,domain-a.foo.com,domain-b.foo.com

The problem, however, is that the secret that contains the cert has disappeared:

$ kubectl get secrets --namespace=timely-odometer
NAME                  TYPE                                  DATA      AGE
default-token-ja4wo   kubernetes.io/service-account-token   2         58m
minio-user            Opaque                                2         58m

I would theorize that in the controller, the detachment is removing the secret from the namespace without regard for whether the cert contained within might also be attached to other domains of the same app (therefore in the same namespace).

I will open a separate issue against the controller and reference this one. This issue has also brought to light that the router isn't logging any sort of warning when a secret containing a cert that is expected to exist is not found. I will close this and open a separate issue for that.