feat(api): validate a certificate's private key

[bacongobbler]

closes #1155

[deis-bot]

@helgi and @Joshua-Anderson are potential reviewers of this pull request based on my analysis of git blame information. Thanks @bacongobbler!

[bacongobbler]

@ineu feel free to give this one a try. It should fix your issue.

[codecov-io]

Current coverage is 87.32% (diff: 100%)

No coverage report found for master at 30ab1d3.

Powered by Codecov. Last update 30ab1d3...be44896

[ineu]

Thanks @bacongobbler, going to try. Could you please point me to some documentation on how to update a single component? And also is there some kind of automatic build or do I need to build a Docker image from the repo?

[bacongobbler]

You can just use the image CI built and uploaded to quay.io. After installing v2.9.0, try

kubectl --namespace=deis edit deployment deis-controller

Change the image to quay.io/deisci/controller:git-5b890a2 and Bob's your uncle.

[mboersma]

😺

[mboersma]

Wouldn't this be a bit more DRY if it just called validate_private_key(self.certificate) from above and re-raised ValidationError as SuspiciousOperation? I guess validate_private_key would need to return the key as well then.

[bacongobbler]

It would be, absolutely. I can refactor this.

[ineu]

Tried it:

> $ deis certs:add foo bundle.crt bundle.crt
Adding SSL endpoint... Error: Unknown Error (400): {"key":["Could not load private key: []"]}

So if you upload something other but the correct private key it throws an error, as expected.

Though it's not the problem I've faced in #1155. I think to completely cover the cases when nginx would print an error (and fail to start) following usecases should be taken into account:

1. User uploads incorrect private key: Fixed by this PR
2. User uploads private key not matching the certificate (my case from Validate certificate on certs:add #1155)
3. User joins cert and intermediate cert in the wrong order.

[bacongobbler]

Thank you for providing your use cases. It wasn't clear in the original ticket.

If you feel like hacking on some tests/fixes for this in another PR that'd be great. I'll keep your ticket open in the meantime.