Support Central exposure through reencrypt Routes #343

Summary

Support Central endpoints exposed through OpenShift Routes with reencrypt TLS termination.

PR #331 adds Route endpoint discovery for passthrough Routes. Reencrypt Routes are outside that PR's scope. A reencrypt Route can present a router-side certificate that is not trusted by the CA bundle roxie loads from Central's central-tls secret and optional defaultTLSSecret. As a result, CRS generation can fail TLS certificate validation.

Required changes

• Detect and handle a reencrypt Route when using the Route as the Central endpoint.
• Determine how to obtain the router-side certificate chain or appropriate trust anchors from a trusted source, including the case where the Route uses the router's default certificate. Do not trust a certificate solely because it is presented by the remote endpoint.
• Add the required trust material to the trust used for Central connections and CRS generation. Preserve the existing Central CA and optional defaultTLSSecret trust sources.
• Validate the server certificate chain and the Route hostname. Do not disable TLS verification.
• Update the endpoint discovery and CA handling in internal/deployer/deploy_via_operator.go and the Central HTTP client and CRS flow in internal/deployer/crs.go as needed.
• Document the supported reencrypt configuration and any trust or permission requirements.

Acceptance criteria

• CRS generation succeeds through a reencrypt Route when its router-side certificate chains to an appropriate trusted source and matches the Route hostname.
• An untrusted certificate, an invalid certificate, or a hostname mismatch is rejected.
• Missing or inaccessible required trust material produces a useful error without disabling verification.
• Existing passthrough Route and other exposure modes continue to work with their existing trust sources.
• Tests cover successful reencrypt verification, rejection cases, and passthrough behavior.

Context

Requested by @mclasmeier.

• PR: support route exposure for Central endpoint #331
• Review comment: support route exposure for Central endpoint #331 (comment)