Fix ClusterIssuer priority to prevent selfsigned being tried first

[treddy08]

Problem

When ocp4_workload_rhacs_enable_reencrypt_route: true is set, the role filters out Google Trust Services ClusterIssuers but the priority logic incorrectly tries selfsigned before ACME issuers.

Current Behavior (Broken):

Filtered issuers: ['acme-bifrost-production-ddns-fallback', 'selfsigned']
Priority logic: non-fallback first, fallback last
Result: ['selfsigned', 'acme-bifrost-production-ddns-fallback']

Impact:

• ❌ Tries selfsigned ClusterIssuer FIRST
• ❌ Creates self-signed certificate for Central route
• ❌ Browser shows certificate warnings/errors
• ❌ Central route cert is broken (untrusted)
• ✅ Reencrypt route works (has proper CA chain)

Root Cause:

The old priority logic used:

reject('search', 'fallback') + select('search', 'fallback')

This prioritized ALL non-fallback issuers (including selfsigned) before fallback ACME issuers.

Solution

Replace complex fallback-based prioritization with simple alphabetical sorting.

New Behavior (Fixed):

Filtered issuers: ['acme-bifrost-production-ddns-fallback', 'selfsigned']
Alphabetical sort: ['acme-bifrost-production-ddns-fallback', 'selfsigned']

Result:

• ✅ Tries ACME issuer (ZeroSSL) FIRST
• ✅ Creates trusted certificate signed by public CA
• ✅ No browser warnings
• ✅ Both central route and reencrypt route work correctly
• ✅ Selfsigned used only as last resort fallback

Why Alphabetical Works

ACME ClusterIssuer naming conventions naturally prioritize them:

• acme-* (starts with 'a')
• letsencrypt-* (starts with 'l')
• zerossl (starts with 'z')

All come alphabetically before selfsigned (starts with 's').

Test Scenarios

✅ Scenario 1: reencrypt=false (all issuers kept)

Result: ['acme-bifrost-production-ddns', 'acme-bifrost-production-ddns-fallback', 'selfsigned']
Tries: Google → ZeroSSL → selfsigned

✅ Scenario 2: reencrypt=true (Google filtered out)

Result: ['acme-bifrost-production-ddns-fallback', 'selfsigned']
Tries: ZeroSSL → selfsigned

✅ Scenario 3: Multiple ACME providers

Result: ['letsencrypt-prod', 'letsencrypt-staging', 'selfsigned', 'zerossl']
Tries: All ACME issuers before selfsigned

Changes

File: roles/ocp4_workload_rhacs/tasks/certificate.yml

Before:

- name: Build list of ClusterIssuers to try (fallback issuers last)
  ansible.builtin.set_fact:
    _cluster_issuers_to_try: >-
      {{
        (_ready_cluster_issuers | map(attribute='metadata.name') | list | reject('search', 'fallback') | list)
        + (_ready_cluster_issuers | map(attribute='metadata.name') | list | select('search', 'fallback') | list)
      }}

After:

- name: Build list of ClusterIssuers to try (alphabetical order)
  ansible.builtin.set_fact:
    _cluster_issuers_to_try: >-
      {{
        _ready_cluster_issuers | map(attribute='metadata.name') | list | sort
      }}

Benefits

1. ✅ Simpler - 1 line instead of 2 complex filter chains
2. ✅ Predictable - Alphabetical order is easy to understand
3. ✅ Fixes the bug - ACME issuers tried before selfsigned
4. ✅ Works with any ACME provider - Not tied to "fallback" naming
5. ✅ Future-proof - Works with Let's Encrypt, ZeroSSL, custom ACME CAs

Testing

Tested on cluster cluster-mhn4g with:

• acme-bifrost-production-ddns (Google Trust Services)
• acme-bifrost-production-ddns-fallback (ZeroSSL)
• selfsigned

Verified alphabetical sorting produces correct priority in all scenarios.