[6.1.x] service CIDR update (#1839)

* wip: serviceCIDR upgrade

* Add services step to reset services before the first master node undergoes endpoints test

* Add telekube dependency for image scanning

* Fix JSON tags

* Update GetLocalSite to accept a context to be able to minimize wait when
dealing with operation plan and the controller is inaccessible.
Refine rollingupdate implementation to handle planet secrets package
rotation.

* Extend cluster configuration validation to disallow service subnet specification
in the middle of an IP range (i.e. indirect equality).
Have planet agent reconcile invalid kubernetes service upon reelection.

* Fix display issue when deploying agents

* * Explicitly allocate service cluster IPs from the new service subnet
   when creating to be able counter the race in apiserver when the new
   service subnet is not immediately active.
 * Make kubernetes operations ((un-)taint, drain, set unschedulable bit)
   resilient to transient errors

* * Fix tests
 * Remove debug code

* Renew etcd test certificates.
Update clusterconfiguration builder test plan.

* Address review comments

* Use a temporary planet distribution with runc fix.
Use service CIDR when rotating secrets during upgrade.

* Bump planet

* Use service subnet directly from clusterconfig when configuring operation steps

* Address review comments

* * Wait for cluster controller when rolling back update-config step.
 * Account for another error when creating a services: 'IP not in valid
   range' indicating the api server has not committed the new
   configuration yet.

* Bump e/planet to corresponding releases

Makefile

@@ -31,7 +31,7 @@ ETCD_VER := v2.3.7
 VERSION_TAG := 0.0.2
 
 # Current versions of the dependencies
-CURRENT_TAG := $(shell ./version.sh)
+CURRENT_TAG ?= $(shell ./version.sh)
 GRAVITY_TAG := $(CURRENT_TAG)
 # Abbreviated gravity version to use as a build ID
 GRAVITY_VERSION := $(CURRENT_TAG)
@@ -42,7 +42,7 @@ RELEASE_OUT ?=
 TELEPORT_TAG = 3.2.13
 # TELEPORT_REPOTAG adapts TELEPORT_TAG to the teleport tagging scheme
 TELEPORT_REPOTAG := v$(TELEPORT_TAG)
-PLANET_TAG := 6.1.30-$(K8S_VER_SUFFIX)
+PLANET_TAG := 6.1.31-$(K8S_VER_SUFFIX)
 PLANET_BRANCH := $(PLANET_TAG)
 K8S_APP_TAG := $(GRAVITY_TAG)
 TELEKUBE_APP_TAG := $(GRAVITY_TAG)
@@ -463,7 +463,7 @@ publish-artifacts: opscenter telekube
 # scan-artifacts uploads a copy of all vendored containers to a docker registry for scanning and vulnerability reporting
 #
 .PHONY: scan-artifacts
-scan-artifacts:
+scan-artifacts: telekube
 	$(GRAVITY) app sync \
 		--registry=$(TELE_COPY_TO_REGISTRY) \
 		--registry-username=$(TELE_COPY_TO_USER) \

assets/certs/.gitignore

@@ -0,0 +1 @@
+ca.srl

assets/certs/Makefile

@@ -0,0 +1,5 @@
+all:
+	for f in etcd1 etcd2 etcd3 proxy1; do \
+		openssl req -new -key $$f-key.pem -out $$f.csr -config config; \
+		openssl x509 -req -days 1000 -CA ca.pem -CAkey ca-key.pem -CAcreateserial -in $$f.csr -out $$f.pem -extfile config -extensions 'v3_req'; \
+	done

assets/certs/config

@@ -0,0 +1,14 @@
+[req]
+distinguished_name = req_distinguished_name
+x509_extensions = v3_req
+prompt = no
+[req_distinguished_name]
+C = us
+ST = ca
+L = sf
+O = gravity
+CN = etcd
+[v3_req]
+subjectAltName = @alt_names
+[alt_names]
+DNS.1 = localhost

assets/certs/etcd1.csr

@@ -1,10 +1,16 @@
 -----BEGIN CERTIFICATE REQUEST-----
-MIIBczCB+wIBADBVMRUwEwYDVQQHEwx0aGUgaW50ZXJuZXQxFjAUBgNVBAoTDWF1
-dG9nZW5lcmF0ZWQxFTATBgNVBAsTDGV0Y2QgY2x1c3RlcjENMAsGA1UEAxMEZXRj
-ZDB2MBAGByqGSM49AgEGBSuBBAAiA2IABGHk9hCOjVJfYb/0XRiD18i+jj7VN4Gu
-DqFHbQXqfhya8ZvhZXHL97/yOVr9vXqvCRDufUSWVWLRK7eMfz34o7/vmsG+t2Sw
-RmWhSG6xKDIz8WCfULHcBsk7qWNOOpeK0aAnMCUGCSqGSIb3DQEJDjEYMBYwFAYD
-VR0RBA0wC4IJbG9jYWxob3N0MAoGCCqGSM49BAMDA2cAMGQCMGBddDkQP9/FfpFI
-BBzpH4jOia653a/tQ3zVdG7pccjnN3QxzGkEMPHm8b4uylO2TAIwFoW02Lr4FdAa
-AZP5FEzD2K96j6ex4XSPRr4L38cghNcJbGb5cdX2zLfrJzWB1PPz
+MIICjTCCAXUCAQAwSDELMAkGA1UEBhMCdXMxCzAJBgNVBAgMAmNhMQswCQYDVQQH
+DAJzZjEQMA4GA1UECgwHZ3Jhdml0eTENMAsGA1UEAwwEZXRjZDCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAOhe2Z7YjK30kcw+ae9B5Rw7elzcgEMsVCIV
+sggke3WvSKY6A8/fovhMXMjTzwKKwjEymWoboe17YuIUSJBKihi5zseiKKEOLMbT
+cnCL/gAEkH8QxwkNO5oAD1usa60XqVjnc61ttEm7WGXZSBf6ZQLYQeT3d3p1lsEn
+zrbjmacy/i6rMe92p9dQ8VrKvQwJrkswMf5i+I7isKMeEA7bXF21FXnZdKc2U5Je
+pB3m1RSvg5q2JC5JPW1YuaK+G2nhNsXBf79b1uQMFIBu9aZ/rJY3RTB1RZ2A+lbJ
+acu8ZVsDrAwvhfNWdhf/qSlDAcHE8hLUFF8cHRmSQ8FDlFetbsMCAwEAAaAAMA0G
+CSqGSIb3DQEBCwUAA4IBAQCKh+acNlW/xjzpS2ndlHad6suAtKakMzwesUnpi4wm
+R/If3tIttt33VR5N7RTd6uAME48RNQ/YO/uXKhLciVEwNgtCPUgJ78zTjFFxxrLs
+QB/f3qzkEnc5T5Ot9IoaN/Z40wKSWyv//cHJ9SZ8N2fQvacyiNXrJwb4HntsO4/N
+D6vI8aXfQo1jYdVJqH/sgBivbYSnFZD0D28CmPSJwN2AaN+KUC42ZNtn9Poo0XvS
+KP+MCra/hM603NcyTf363IH4a0lyhLzuT5AlLwmopS2Kvw9EcXdI6xTIpMPUEWOo
+v5LGpffhd1k6vUQccT23QhBzpcHT+LRzMjiCRBKC6C9o
 -----END CERTIFICATE REQUEST-----

assets/certs/etcd1.pem

@@ -1,21 +1,18 @@
 -----BEGIN CERTIFICATE-----
-MIIDhzCCAwygAwIBAgIUVHFNYEeKJ9tRS1G7fxRpd3ngmnYwCgYIKoZIzj0EAwMw
+MIIC+jCCAoCgAwIBAgIUVZiz0KfDL09LAL0aHUSeXWRWeu8wCgYIKoZIzj0EAwIw
 gawxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
 YW4gRnJhbmNpc2NvMSowKAYDVQQKEyFIb25lc3QgQWNobWVkJ3MgVXNlZCBDZXJ0
 aWZpY2F0ZXMxKTAnBgNVBAsTIEhhc3RpbHktR2VuZXJhdGVkIFZhbHVlcyBEaXZp
-c29uMRkwFwYDVQQDExBBdXRvZ2VuZXJhdGVkIENBMB4XDTE4MDcxMDEwMDMxNFoX
-DTIwMDYyOTExMDMxNFowVTEVMBMGA1UEBxMMdGhlIGludGVybmV0MRYwFAYDVQQK
-Ew1hdXRvZ2VuZXJhdGVkMRUwEwYDVQQLEwxldGNkIGNsdXN0ZXIxDTALBgNVBAMT
-BGV0Y2QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDoXtme2Iyt9JHM
-PmnvQeUcO3pc3IBDLFQiFbIIJHt1r0imOgPP36L4TFzI088CisIxMplqG6Hte2Li
-FEiQSooYuc7HoiihDizG03Jwi/4ABJB/EMcJDTuaAA9brGutF6lY53OtbbRJu1hl
-2UgX+mUC2EHk93d6dZbBJ86245mnMv4uqzHvdqfXUPFayr0MCa5LMDH+YviO4rCj
-HhAO21xdtRV52XSnNlOSXqQd5tUUr4OatiQuST1tWLmivhtp4TbFwX+/W9bkDBSA
-bvWmf6yWN0UwdUWdgPpWyWnLvGVbA6wML4XzVnYX/6kpQwHBxPIS1BRfHB0ZkkPB
-Q5RXrW7DAgMBAAGjgZYwgZMwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsG
-AQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBS2ztO79kVe
-rM8zqODTmOvrmDKTbjAfBgNVHSMEGDAWgBSqJqJwwDOhQbNatku6Iino4bI1RzAU
-BgNVHREEDTALgglsb2NhbGhvc3QwCgYIKoZIzj0EAwMDaQAwZgIxANFVW14mdWR/
-5Tachy54QWtuTC9g/A2N42mlcitusWHNeHJYxxQbwPBObL0YYOFb4wIxAMZ8wL4t
-157x9l44XtvN5bQ79uvn31bi8YsN1vCGq2/fhT6P9vXygyIPp8BQ/WlKcw==
+c29uMRkwFwYDVQQDExBBdXRvZ2VuZXJhdGVkIENBMB4XDTIwMDcwNjEwNTY1MloX
+DTIzMDQwMjEwNTY1MlowSDELMAkGA1UEBhMCdXMxCzAJBgNVBAgMAmNhMQswCQYD
+VQQHDAJzZjEQMA4GA1UECgwHZ3Jhdml0eTENMAsGA1UEAwwEZXRjZDCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBAOhe2Z7YjK30kcw+ae9B5Rw7elzcgEMs
+VCIVsggke3WvSKY6A8/fovhMXMjTzwKKwjEymWoboe17YuIUSJBKihi5zseiKKEO
+LMbTcnCL/gAEkH8QxwkNO5oAD1usa60XqVjnc61ttEm7WGXZSBf6ZQLYQeT3d3p1
+lsEnzrbjmacy/i6rMe92p9dQ8VrKvQwJrkswMf5i+I7isKMeEA7bXF21FXnZdKc2
+U5JepB3m1RSvg5q2JC5JPW1YuaK+G2nhNsXBf79b1uQMFIBu9aZ/rJY3RTB1RZ2A
++lbJacu8ZVsDrAwvhfNWdhf/qSlDAcHE8hLUFF8cHRmSQ8FDlFetbsMCAwEAAaMY
+MBYwFAYDVR0RBA0wC4IJbG9jYWxob3N0MAoGCCqGSM49BAMCA2gAMGUCME33euZw
+DHbZGw/G5UvdQoTCAwrjEWk/Sp9RfLaMzd+VhsaVqpYL929NsG4P7T9o8gIxAKUu
+ANnZcCBls1bmdCCV5Cr4m+qHVRvqE27TCv2gTtsZfBCIIww89QZG7yvtFBuXjQ==
 -----END CERTIFICATE-----

assets/certs/etcd2.csr

@@ -1,10 +1,16 @@
 -----BEGIN CERTIFICATE REQUEST-----
-MIIBdDCB+wIBADBVMRUwEwYDVQQHEwx0aGUgaW50ZXJuZXQxFjAUBgNVBAoTDWF1
-dG9nZW5lcmF0ZWQxFTATBgNVBAsTDGV0Y2QgY2x1c3RlcjENMAsGA1UEAxMEZXRj
-ZDB2MBAGByqGSM49AgEGBSuBBAAiA2IABJ3HsVPq1zTfjjscBpxAIcbJleV2MSY1
-qXXkj//142eQ5d30VDO27HCixAuqQLI0r0I6Xwcj8TKNiUGKb6oDp5UFkuzbpaO5
-FWBJ7fVA3l9HRlzRXlVkllqlTwTrrf2OyqAnMCUGCSqGSIb3DQEJDjEYMBYwFAYD
-VR0RBA0wC4IJbG9jYWxob3N0MAoGCCqGSM49BAMDA2gAMGUCMHbnuvWjnV1D3R7X
-cK6P9VHYP/bKUuByR4OpE2JO93sB/jDFoI+m4/lAZZUK4K+5bwIxAJbGruiVlTPr
-C9c/MAdvem8uUxDU9n7ITSuR3e5scxwU8MSjwaWZJbfwBqD41U9G5g==
+MIICjTCCAXUCAQAwSDELMAkGA1UEBhMCdXMxCzAJBgNVBAgMAmNhMQswCQYDVQQH
+DAJzZjEQMA4GA1UECgwHZ3Jhdml0eTENMAsGA1UEAwwEZXRjZDCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBANI4Es/fkToJgR/7sHV1BObgR5XcnXiGJEuA
+/lJfhIJ1PUqtRB0+xo7ziba026bqtjoj0cwXWI4V2LHj8YME3G+vgM9Y8D6+K/aU
+PTBv1h3tb5YK2BpFLtsMGLWVACvWaD7h3l3CV5UQdLevTdjmApvoeUmj1T1i5pIM
+MbF5J7KlTytqBZbGDHD9wMAS/1IuOZDCW9b5L1h5PH6CVVqexYJmKbchpeaRVs+D
+TNiudttcABRZSbuKpp2MP9OX6TUkvbDihiXvCWIUIDvPXZbcw9tgw4r1crC1Ov+O
+Mc05mS62VtuSYZsHSqdWl5wilotKyR/+kUBKYQCqSOAyQ54qp+MCAwEAAaAAMA0G
+CSqGSIb3DQEBCwUAA4IBAQBkgBJp/AcW7MnIoZ2VMVqmooz8ecYY5DXUUvXfopRB
+o6qZJRwAm+FnhBKdnm4JqrbiU29NjY0S242ZgDrXQA3Kc+J6RETcndCYxKLEvEBE
+RnpkgWTOGO3REJX77DU9BGkjdoN1ND0YG7iPfGLIu7og9geQrijmqJ6PwvFGXwH7
+9zX8AyJ3zj0qdZ7DnEkIuz2+Wn4Ttc6nqil+6rdk0dlbPqJcUjf9IzNMSk1tUqUJ
+PJEdEOPQP357CUG+1g3G8JIxhegNmGqHEHoWVrJqLILifT6YPWvczTvWxVi2To3O
+lUy7tl2Rb16hwq+kDNsWjybNTQ/Eq/O6nHvcqyDyOgZw
 -----END CERTIFICATE REQUEST-----

assets/certs/etcd2.pem

@@ -1,21 +1,18 @@
 -----BEGIN CERTIFICATE-----
-MIIDhzCCAwygAwIBAgIUd5oqiUHZ/j5+CAUMC/R+NAM4SwIwCgYIKoZIzj0EAwMw
+MIIC+zCCAoCgAwIBAgIUVZiz0KfDL09LAL0aHUSeXWRWevAwCgYIKoZIzj0EAwIw
 gawxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
 YW4gRnJhbmNpc2NvMSowKAYDVQQKEyFIb25lc3QgQWNobWVkJ3MgVXNlZCBDZXJ0
 aWZpY2F0ZXMxKTAnBgNVBAsTIEhhc3RpbHktR2VuZXJhdGVkIFZhbHVlcyBEaXZp
-c29uMRkwFwYDVQQDExBBdXRvZ2VuZXJhdGVkIENBMB4XDTE4MDcxMDEwMDUyMVoX
-DTIwMDYyOTExMDUyMVowVTEVMBMGA1UEBxMMdGhlIGludGVybmV0MRYwFAYDVQQK
-Ew1hdXRvZ2VuZXJhdGVkMRUwEwYDVQQLEwxldGNkIGNsdXN0ZXIxDTALBgNVBAMT
-BGV0Y2QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDSOBLP35E6CYEf
-+7B1dQTm4EeV3J14hiRLgP5SX4SCdT1KrUQdPsaO84m2tNum6rY6I9HMF1iOFdix
-4/GDBNxvr4DPWPA+viv2lD0wb9Yd7W+WCtgaRS7bDBi1lQAr1mg+4d5dwleVEHS3
-r03Y5gKb6HlJo9U9YuaSDDGxeSeypU8ragWWxgxw/cDAEv9SLjmQwlvW+S9YeTx+
-glVansWCZim3IaXmkVbPg0zYrnbbXAAUWUm7iqadjD/Tl+k1JL2w4oYl7wliFCA7
-z12W3MPbYMOK9XKwtTr/jjHNOZkutlbbkmGbB0qnVpecIpaLSskf/pFASmEAqkjg
-MkOeKqfjAgMBAAGjgZYwgZMwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsG
-AQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBQvoZINiHDR
-GVJARISaPiPQZv/d2zAfBgNVHSMEGDAWgBSqJqJwwDOhQbNatku6Iino4bI1RzAU
-BgNVHREEDTALgglsb2NhbGhvc3QwCgYIKoZIzj0EAwMDaQAwZgIxAKBVUA4Rwfx5
-mtxgKhHx9ylpukKar01o/XxfYhef9QgBMd9Ki51Xnd1Kx8t4UvA0ywIxAMlq7A9i
-hvWkbXHtO3dpkfkOV6Qe4XoMKyGCkzgDqLiHVpN0Kv0Lrtaw6fWKhe6ueA==
+c29uMRkwFwYDVQQDExBBdXRvZ2VuZXJhdGVkIENBMB4XDTIwMDcwNjEwNTY1MloX
+DTIzMDQwMjEwNTY1MlowSDELMAkGA1UEBhMCdXMxCzAJBgNVBAgMAmNhMQswCQYD
+VQQHDAJzZjEQMA4GA1UECgwHZ3Jhdml0eTENMAsGA1UEAwwEZXRjZDCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBANI4Es/fkToJgR/7sHV1BObgR5XcnXiG
+JEuA/lJfhIJ1PUqtRB0+xo7ziba026bqtjoj0cwXWI4V2LHj8YME3G+vgM9Y8D6+
+K/aUPTBv1h3tb5YK2BpFLtsMGLWVACvWaD7h3l3CV5UQdLevTdjmApvoeUmj1T1i
+5pIMMbF5J7KlTytqBZbGDHD9wMAS/1IuOZDCW9b5L1h5PH6CVVqexYJmKbchpeaR
+Vs+DTNiudttcABRZSbuKpp2MP9OX6TUkvbDihiXvCWIUIDvPXZbcw9tgw4r1crC1
+Ov+OMc05mS62VtuSYZsHSqdWl5wilotKyR/+kUBKYQCqSOAyQ54qp+MCAwEAAaMY
+MBYwFAYDVR0RBA0wC4IJbG9jYWxob3N0MAoGCCqGSM49BAMCA2kAMGYCMQDzKokS
+af6X3ju3w31ej4ZG4bC6f3DxPTRPX0h/2QMEd1liA68uxCN1s1QLBpwNztUCMQD4
+dQex5igsfHV6QmFKTxsBmvDx3+972CpKMttHtLHQ6H6yFQdHvxd4YlVxdUX+D5U=
 -----END CERTIFICATE-----

assets/certs/etcd3.csr

@@ -1,10 +1,16 @@
 -----BEGIN CERTIFICATE REQUEST-----
-MIIBdTCB+wIBADBVMRUwEwYDVQQHEwx0aGUgaW50ZXJuZXQxFjAUBgNVBAoTDWF1
-dG9nZW5lcmF0ZWQxFTATBgNVBAsTDGV0Y2QgY2x1c3RlcjENMAsGA1UEAxMEZXRj
-ZDB2MBAGByqGSM49AgEGBSuBBAAiA2IABLOEYJKkwYrMk2rFqGUDy5LXO1i+d25L
-/t/o9HP2JVeI01sVcqY27VMZwB2nKJD+TXYL+MkrBfw0z1UfvzbSSSjMO0ZR1Ms6
-1UyVHAIOjBIaWRuG6Fgpj6zkWIZ3lf+XsqAnMCUGCSqGSIb3DQEJDjEYMBYwFAYD
-VR0RBA0wC4IJbG9jYWxob3N0MAoGCCqGSM49BAMDA2kAMGYCMQD78jIUCp+J/fY4
-LSBRJXW2Zuz2gkQHFs6fYtKkKDlSPhE7xUGB5aqiFSyzv0t+0x8CMQDRWv+eBIZT
-FsfgcpYM7C1fCEV+PK7jVLVpYXeSDiqrGceHeD/D6GpvxkeNjaWbFfQ=
+MIICjTCCAXUCAQAwSDELMAkGA1UEBhMCdXMxCzAJBgNVBAgMAmNhMQswCQYDVQQH
+DAJzZjEQMA4GA1UECgwHZ3Jhdml0eTENMAsGA1UEAwwEZXRjZDCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBANU7J+hQINkf+2sFAzN4rsIRl4RPKid6W99o
+dzc9wuFnffkcT9P37bDTr/bRVWIn1z2dTDbnVQvop9JA9uZpRCwZ/QG9AwMZ7MCm
+9Qo3tCTn9bWFH3dsck/WK4X0LZcJGzlQfFV2it4PBukhYmi9y84qQv6aQ507oiLP
+tQkq85pPD0LaLG03LtIHDkl4/wRfkBjylBWDorW67bE030NJiwjxSOsg/FqXLEO0
+Cuav62rf24qF1gJRMGKyL0sAt0m/zJjohvZkSsHwZQY7TVHdMTFQpPs11VX/7Et/
+rfxYrSOYlr58lhDWqhhGQZiIt+TCA9xrZo5M3I+lOZhQhW03LnkCAwEAAaAAMA0G
+CSqGSIb3DQEBCwUAA4IBAQAbTrs0xlNCLeOzBZhCy96+iepBcWofxdPaNFl2r+vD
+KuR0iNEHYzZSjyMrINEsTC0Ief3oMKLJ/qK37EzsmBTfPKA+tr25DHv38RuFf31c
+sjI6PfviJGW2kPAf+IcZdJRUL54xcGxhDYbQoEVc/8zk1Y2cvjqQCOtF/1TLKaNl
+4Tn47SgriwYEAC37YOn6cY0m6Wa/qn8YcbDxi4rqmUD7TBl9FSP9ip46xTFcJmAZ
+hWy+sxH4LT/Wq/+XHLrGRwi2TYFcLpKZTKrTzd8AoJE9GEwR0Sa6salfEODCWaLM
+RJynuRJvZv8bt/V+rHxdHCD4d8rs64RQuYt40oGOW91p
 -----END CERTIFICATE REQUEST-----

assets/certs/etcd3.pem

@@ -1,21 +1,18 @@
 -----BEGIN CERTIFICATE-----
-MIIDhTCCAwygAwIBAgIUNxZU27JJ6oyEJf66siVcKHH9x1AwCgYIKoZIzj0EAwMw
+MIIC+TCCAoCgAwIBAgIUVZiz0KfDL09LAL0aHUSeXWRWevEwCgYIKoZIzj0EAwIw
 gawxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
 YW4gRnJhbmNpc2NvMSowKAYDVQQKEyFIb25lc3QgQWNobWVkJ3MgVXNlZCBDZXJ0
 aWZpY2F0ZXMxKTAnBgNVBAsTIEhhc3RpbHktR2VuZXJhdGVkIFZhbHVlcyBEaXZp
-c29uMRkwFwYDVQQDExBBdXRvZ2VuZXJhdGVkIENBMB4XDTE4MDcxMDEwMDUyNloX
-DTIwMDYyOTExMDUyNlowVTEVMBMGA1UEBxMMdGhlIGludGVybmV0MRYwFAYDVQQK
-Ew1hdXRvZ2VuZXJhdGVkMRUwEwYDVQQLEwxldGNkIGNsdXN0ZXIxDTALBgNVBAMT
-BGV0Y2QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDVOyfoUCDZH/tr
-BQMzeK7CEZeETyonelvfaHc3PcLhZ335HE/T9+2w06/20VViJ9c9nUw251UL6KfS
-QPbmaUQsGf0BvQMDGezApvUKN7Qk5/W1hR93bHJP1iuF9C2XCRs5UHxVdoreDwbp
-IWJovcvOKkL+mkOdO6Iiz7UJKvOaTw9C2ixtNy7SBw5JeP8EX5AY8pQVg6K1uu2x
-NN9DSYsI8UjrIPxalyxDtArmr+tq39uKhdYCUTBisi9LALdJv8yY6Ib2ZErB8GUG
-O01R3TExUKT7NdVV/+xLf638WK0jmJa+fJYQ1qoYRkGYiLfkwgPca2aOTNyPpTmY
-UIVtNy55AgMBAAGjgZYwgZMwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsG
-AQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBTMzGmOCYgm
-4iqWUp+AmJXcBzZCkTAfBgNVHSMEGDAWgBSqJqJwwDOhQbNatku6Iino4bI1RzAU
-BgNVHREEDTALgglsb2NhbGhvc3QwCgYIKoZIzj0EAwMDZwAwZAIwBDco0ZUa5BPI
-r8hHYnV9MDAyRipJCVXH/8ozWexKxteIn5hEwyHaZ6h7BiMRNicJAjBgtsNUHvnE
-w7EBuU84BTXtGQyfQey4TN+HJQJMrRRYvmL//QWE6R2nGAC49FqzTgY=
+c29uMRkwFwYDVQQDExBBdXRvZ2VuZXJhdGVkIENBMB4XDTIwMDcwNjEwNTY1MloX
+DTIzMDQwMjEwNTY1MlowSDELMAkGA1UEBhMCdXMxCzAJBgNVBAgMAmNhMQswCQYD
+VQQHDAJzZjEQMA4GA1UECgwHZ3Jhdml0eTENMAsGA1UEAwwEZXRjZDCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBANU7J+hQINkf+2sFAzN4rsIRl4RPKid6
+W99odzc9wuFnffkcT9P37bDTr/bRVWIn1z2dTDbnVQvop9JA9uZpRCwZ/QG9AwMZ
+7MCm9Qo3tCTn9bWFH3dsck/WK4X0LZcJGzlQfFV2it4PBukhYmi9y84qQv6aQ507
+oiLPtQkq85pPD0LaLG03LtIHDkl4/wRfkBjylBWDorW67bE030NJiwjxSOsg/FqX
+LEO0Cuav62rf24qF1gJRMGKyL0sAt0m/zJjohvZkSsHwZQY7TVHdMTFQpPs11VX/
+7Et/rfxYrSOYlr58lhDWqhhGQZiIt+TCA9xrZo5M3I+lOZhQhW03LnkCAwEAAaMY
+MBYwFAYDVR0RBA0wC4IJbG9jYWxob3N0MAoGCCqGSM49BAMCA2cAMGQCMHn8Gsdy
+5Bin6ceq5EdbP5/sNh6XnoNm2qFw40bXcYjfJe+ToIiEV78Jzw9ZW6WBNQIwG2Jp
+G5IINmEoVk3lNA5nMJgA2vAL8cJf8E4aS1xr4ozzRikNXuU8rN87SHFDLMbP
 -----END CERTIFICATE-----

assets/certs/proxy1.csr

@@ -1,10 +1,16 @@
 -----BEGIN CERTIFICATE REQUEST-----
-MIIBczCB+wIBADBVMRUwEwYDVQQHEwx0aGUgaW50ZXJuZXQxFjAUBgNVBAoTDWF1
-dG9nZW5lcmF0ZWQxFTATBgNVBAsTDGV0Y2QgY2x1c3RlcjENMAsGA1UEAxMEZXRj
-ZDB2MBAGByqGSM49AgEGBSuBBAAiA2IABLdL3Qk0avuLvIaY75so/eg3atHXbSQ0
-UhVZdyCKboMYgMAw/BwZ5bpxeKtT73bkTvXGkV1pHJyCR11OaGOwa1WNtuhF/rTz
-xQCkzCCIG0r3x7UOWE6f2Xvel8n4Uc4PeKAnMCUGCSqGSIb3DQEJDjEYMBYwFAYD
-VR0RBA0wC4IJbG9jYWxob3N0MAoGCCqGSM49BAMDA2cAMGQCMGObx2TGensGzywM
-0+zE3XT55P3mO/VkP7xQpGfSxhUgrlBWOx9fB8OuUHTuU19OeQIweXy5RkWFsZSI
-MDPkP50QWS8druxUodCx0QumQCUnYkrpntzZQYn/SkdihcUoDHch
+MIICjTCCAXUCAQAwSDELMAkGA1UEBhMCdXMxCzAJBgNVBAgMAmNhMQswCQYDVQQH
+DAJzZjEQMA4GA1UECgwHZ3Jhdml0eTENMAsGA1UEAwwEZXRjZDCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAK80U7ynAT4V4J8wI6p5TM9hqPgdmEg9BYO/
+EQZ8fwe81/BaBlfavPEpVgsW+KeG7KabXroVwuh5fA4IkY5CodShkF5CyGVlzKSQ
+Wi22kaBatXlPBHFNsu2USv+lyfKxa7Nxu3+R36KYO+Z/EHwyUeMiJ9g0lORbo1ws
+65svEAVhBVuv/2Kw48cx2dqAz1NGtMAiLU6veSoYeqAa1nUszMXd3mqWQjre8SXm
+7ETWdVSTmSqqdvu5sM2LoFeSMYFhZrGcr2ABFcFOb/UeJbydAYDYmXKHHMObywlW
+wsrqN5bfVcG7vU1HMwKCB8p0tx4I2XchNhrJYuZXbwlpxb4HMRcCAwEAAaAAMA0G
+CSqGSIb3DQEBCwUAA4IBAQBpeKVGsxQ/juFJiyzay5uwJnj/HtU62HkOyZLpkT9/
+DVQZiu1sTFMgnvkcYCVivRV/ce6sDCQVgf8WTSgbnq/3PITJaeXI7+h3ZHMEVGrl
+L8z9N6B0vUCl1Otn4Wa+cpimcbiN21QhP6/rKgqDvPpmctkKdBdEfRYA+25njH1o
+Y06Oi+0rj8GT8bYC/gC5DrRN3ran2tOLsb/j6yfnNzwrVGpDgvGKrXrnOOeUYG4k
+DXc+J9Ibru9/vwk+37pM23bn2XFEI+JSLlFCYDRgH1yoT79VZTasLT1quRDJdAR9
+1gTGmQ1H8WPRn8PhtX1s7W8A0hE32dNp5DvAVWy+q5My
 -----END CERTIFICATE REQUEST-----

assets/certs/proxy1.pem

@@ -1,21 +1,18 @@
 -----BEGIN CERTIFICATE-----
-MIIDhTCCAwygAwIBAgIUS7+I8RuiCEXRaryL6/8SP9xKM5wwCgYIKoZIzj0EAwMw
+MIIC+jCCAoCgAwIBAgIUVZiz0KfDL09LAL0aHUSeXWRWevIwCgYIKoZIzj0EAwIw
 gawxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1T
 YW4gRnJhbmNpc2NvMSowKAYDVQQKEyFIb25lc3QgQWNobWVkJ3MgVXNlZCBDZXJ0
 aWZpY2F0ZXMxKTAnBgNVBAsTIEhhc3RpbHktR2VuZXJhdGVkIFZhbHVlcyBEaXZp
-c29uMRkwFwYDVQQDExBBdXRvZ2VuZXJhdGVkIENBMB4XDTE4MDcxMDEwMDUzN1oX
-DTIwMDYyOTExMDUzN1owVTEVMBMGA1UEBxMMdGhlIGludGVybmV0MRYwFAYDVQQK
-Ew1hdXRvZ2VuZXJhdGVkMRUwEwYDVQQLEwxldGNkIGNsdXN0ZXIxDTALBgNVBAMT
-BGV0Y2QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvNFO8pwE+FeCf
-MCOqeUzPYaj4HZhIPQWDvxEGfH8HvNfwWgZX2rzxKVYLFvinhuymm166FcLoeXwO
-CJGOQqHUoZBeQshlZcykkFottpGgWrV5TwRxTbLtlEr/pcnysWuzcbt/kd+imDvm
-fxB8MlHjIifYNJTkW6NcLOubLxAFYQVbr/9isOPHMdnagM9TRrTAIi1Or3kqGHqg
-GtZ1LMzF3d5qlkI63vEl5uxE1nVUk5kqqnb7ubDNi6BXkjGBYWaxnK9gARXBTm/1
-HiW8nQGA2JlyhxzDm8sJVsLK6jeW31XBu71NRzMCggfKdLceCNl3ITYayWLmV28J
-acW+BzEXAgMBAAGjgZYwgZMwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsG
-AQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBR/dlan7zdv
-OPA9mSNS0h86dc5yITAfBgNVHSMEGDAWgBSqJqJwwDOhQbNatku6Iino4bI1RzAU
-BgNVHREEDTALgglsb2NhbGhvc3QwCgYIKoZIzj0EAwMDZwAwZAIwVzalS8UOxuA2
-cOVLcVyMD5r7z7IwCAz6dI/wJ+myndLgP3eLbuJX0sFEovoxl2TxAjA7ukHv3xcb
-nj6Vp4hVzfs/s6twsxfEIjT6Rg2cO2gyAI9DER1xKDTVlJ9uB4sv7v0=
+c29uMRkwFwYDVQQDExBBdXRvZ2VuZXJhdGVkIENBMB4XDTIwMDcwNjEwNTY1MloX
+DTIzMDQwMjEwNTY1MlowSDELMAkGA1UEBhMCdXMxCzAJBgNVBAgMAmNhMQswCQYD
+VQQHDAJzZjEQMA4GA1UECgwHZ3Jhdml0eTENMAsGA1UEAwwEZXRjZDCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBAK80U7ynAT4V4J8wI6p5TM9hqPgdmEg9
+BYO/EQZ8fwe81/BaBlfavPEpVgsW+KeG7KabXroVwuh5fA4IkY5CodShkF5CyGVl
+zKSQWi22kaBatXlPBHFNsu2USv+lyfKxa7Nxu3+R36KYO+Z/EHwyUeMiJ9g0lORb
+o1ws65svEAVhBVuv/2Kw48cx2dqAz1NGtMAiLU6veSoYeqAa1nUszMXd3mqWQjre
+8SXm7ETWdVSTmSqqdvu5sM2LoFeSMYFhZrGcr2ABFcFOb/UeJbydAYDYmXKHHMOb
+ywlWwsrqN5bfVcG7vU1HMwKCB8p0tx4I2XchNhrJYuZXbwlpxb4HMRcCAwEAAaMY
+MBYwFAYDVR0RBA0wC4IJbG9jYWxob3N0MAoGCCqGSM49BAMCA2gAMGUCMFSPSnYf
+EblgP/iAr/uayulnGmqecuyMDDUoS8o3uLEGu8XTqNARgjcd/1NXuKvelQIxAMkc
+A4TuwRYyNPah2k27xsPdZqIcixf0h/maMkNXsZnnPfFiPVAvSVGwqTc3GuN6+Q==
 -----END CERTIFICATE-----