ROX-23255: emailsender read auth cfg from kubernetes

[johannes94]

Description

Follow Up on #1826 .

This adds a function to the AuthConfig of emailsender that allows reading it from it's own Kubernetes service account.

emailsender is expected to be called by central with it's Kubernetes service account. Since emailsender has its own service account as well we can use that information to read the configuration values required for authentication (issuer, audience, jwks_url).

This way we don't need a config file / config map that is different per environment we deploy to, where we have to manually managed the input vars (e.g addon parameters).

Checklist (Definition of Done)

• Unit and integration tests added
• Added test description under Test manual
• Documentation added if necessary (i.e. changes to dev setup, test execution, ...)
• CI and all relevant tests are passing
• Add the ticket number to the PR title if available, i.e. ROX-12345: ...
• Discussed security and business related topics privately. Will move any security and business related topics that arise to private communication channel.
• Add secret to app-interface Vault or Secrets Manager if necessary
• RDS changes were e2e tested manually
• Check AWS limits are reasonable for changes provisioning new resources
• (If applicable) Changes to the dp-terraform Helm values have been reflected in the addon on integration environment

Test manual

• Deployed the emailsender service to kube
• Create a dummy pod central in a dummy namespace rhacs-test with nginx image called central
• Exec into that pod and send a curl to emailsender with the serviceaccount -> works
• Send the curl without authentication -> is blocked

# To run tests locally run:
make db/teardown db/setup db/migrate
make ocm/setup
make verify lint binary test test/integration

[johannes94]

@kurlov I copied a lot of this logic from the PR you already review in the core repo. The function itself is still somewhat different, as it errors on failed certificates loads and does not return a full http.Transport like here.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: johannes94, kurlov

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [johannes94,kurlov]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[kurlov]

Looks great 🎉

[openshift-ci]

New changes are detected. LGTM label has been removed.