config: sort certs to prevent churn (#1246)

## Summary

sort certs in the config, to prevent configuration churn. 

## Related issues

Ref: #1244

## Checklist

- [x] reference any related issues
- [ ] updated docs
- [x] updated unit tests
- [ ] updated UPGRADING.md
- [x] add appropriate tag (`improvement` / `bug` / etc)
- [x] ready for review

Author: wasaga

pomerium/deterministic.go

@@ -0,0 +1,24 @@
+package pomerium
+
+import (
+	"cmp"
+	"slices"
+	"sort"
+
+	pb "github.com/pomerium/pomerium/pkg/grpc/config"
+)
+
+func ensureDeterministicConfigOrder(cfg *pb.Config) {
+	if cfg == nil {
+		return
+	}
+	// https://kubernetes.io/docs/concepts/services-networking/ingress/#multiple-matches
+	// envoy matches according to the order routes are present in the configuration
+	sort.Sort(routeList(cfg.Routes))
+
+	if len(cfg.GetSettings().GetCertificates()) > 0 {
+		slices.SortFunc(cfg.Settings.Certificates, func(a, b *pb.Settings_Certificate) int {
+			return cmp.Compare(a.Id, b.Id)
+		})
+	}
+}

pomerium/deterministic_test.go

@@ -0,0 +1,123 @@
+package pomerium
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/testing/protocmp"
+
+	configpb "github.com/pomerium/pomerium/pkg/grpc/config"
+)
+
+func TestEnsureDeterministicConfigOrder(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name string
+		cfg  *configpb.Config
+		want *configpb.Config
+	}{
+		{
+			name: "sorts routes and certificates",
+			cfg: &configpb.Config{
+				Routes: []*configpb.Route{
+					{Name: "route-b", From: "https://b.example.com"},
+					{Name: "route-a", From: "https://a.example.com"},
+				},
+				Settings: &configpb.Settings{
+					Certificates: []*configpb.Settings_Certificate{
+						{Id: "cert-b"},
+						{Id: "cert-a"},
+					},
+				},
+			},
+			want: &configpb.Config{
+				Routes: []*configpb.Route{
+					{Name: "route-a", From: "https://a.example.com"},
+					{Name: "route-b", From: "https://b.example.com"},
+				},
+				Settings: &configpb.Settings{
+					Certificates: []*configpb.Settings_Certificate{
+						{Id: "cert-a"},
+						{Id: "cert-b"},
+					},
+				},
+			},
+		},
+		{
+			name: "sorts routes with identical hosts",
+			cfg: &configpb.Config{
+				Routes: []*configpb.Route{
+					{
+						Name: "route-root",
+						From: "https://a.example.com",
+						Path: "/",
+					},
+					{
+						Name: "route-deep",
+						From: "https://a.example.com",
+						Path: "/nested",
+					},
+				},
+			},
+			want: &configpb.Config{
+				Routes: []*configpb.Route{
+					{
+						Name: "route-deep",
+						From: "https://a.example.com",
+						Path: "/nested",
+					},
+					{
+						Name: "route-root",
+						From: "https://a.example.com",
+						Path: "/",
+					},
+				},
+			},
+		},
+		{
+			name: "leaves sorted config untouched",
+			cfg: &configpb.Config{
+				Routes: []*configpb.Route{
+					{Name: "route-a", From: "https://a.example.com"},
+				},
+				Settings: &configpb.Settings{
+					Certificates: []*configpb.Settings_Certificate{
+						{Id: "cert-a"},
+					},
+				},
+			},
+			want: &configpb.Config{
+				Routes: []*configpb.Route{
+					{Name: "route-a", From: "https://a.example.com"},
+				},
+				Settings: &configpb.Settings{
+					Certificates: []*configpb.Settings_Certificate{
+						{Id: "cert-a"},
+					},
+				},
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			cfg := proto.Clone(tc.cfg).(*configpb.Config)
+			ensureDeterministicConfigOrder(cfg)
+
+			if diff := cmp.Diff(tc.want, cfg, protocmp.Transform()); diff != "" {
+				t.Fatalf("unexpected config (-want +got):\n%s", diff)
+			}
+
+			again := proto.Clone(cfg).(*configpb.Config)
+			ensureDeterministicConfigOrder(again)
+
+			if diff := cmp.Diff(cfg, again, protocmp.Transform()); diff != "" {
+				t.Fatalf("ensureDeterministicConfigOrder not idempotent (-first +second):\n%s", diff)
+			}
+		})
+	}
+}

pomerium/sync.go

@@ -4,7 +4,6 @@ package pomerium
 import (
 	"context"
 	"fmt"
-	"sort"
 
 	"github.com/hashicorp/go-multierror"
 	"github.com/sergi/go-diff/diffmatchpatch"
@@ -194,9 +193,7 @@ func (r *DataBrokerReconciler) saveConfig(ctx context.Context, prev, next *pb.Co
 		}
 	}
 
-	// https://kubernetes.io/docs/concepts/services-networking/ingress/#multiple-matches
-	// envoy matches according to the order routes are present in the configuration
-	sort.Sort(routeList(next.Routes))
+	ensureDeterministicConfigOrder(next)
 
 	if err := validate(ctx, next, id); err != nil {
 		return false, fmt.Errorf("config validation: %w", err)