Repository: zalando-stups/senza

Issue:
Can't Deploy ZMON appliance (without SSL Certificate)
Senza is returning an error, when I'm trying to deploy the ZMON appliance: 

```
senza --region=eu-central-1 create zmon-appliance-planetexpress-qa.yaml cd14c1 cd14
Generating Cloud Formation template.. EXCEPTION OCCURRED: An error occurred (ValidationError) when calling the GetServerCertificate operation: The specified value for serverCertificateName is invalid. It must contain only alphanumeric characters and/or the following: +=,.@_-
Unknown Error: An error occurred (ValidationError) when calling the GetServerCertificate operation: The specified value for serverCertificateName is invalid. It must contain only alphanumeric characters and/or the following: +=,.@_-.
Please create an issue with the content of /var/folders/cv/08715ldx7qx_76kkn3kmdmdnlc10w4/T/senza-traceback-l_pvs53y
```

Contents of this file are the following:
```
Traceback (most recent call last):
  File "/usr/local/lib/python3.5/site-packages/senza/manaus/iam.py", line 80, in get_by_name
    certificate = certificates[0]
IndexError: list index out of range

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.5/site-packages/senza/error_handling.py", line 69, in __call__
    self.function(*args, **kwargs)
  File "/usr/local/lib/python3.5/site-packages/click/core.py", line 716, in __call__
    return self.main(*args, **kwargs)
  File "/usr/local/lib/python3.5/site-packages/click/core.py", line 696, in main
    rv = self.invoke(ctx)
  File "/usr/local/lib/python3.5/site-packages/click/core.py", line 1060, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/usr/local/lib/python3.5/site-packages/click/core.py", line 889, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/usr/local/lib/python3.5/site-packages/click/core.py", line 534, in invoke
    return callback(*args, **kwargs)
  File "/usr/local/lib/python3.5/site-packages/senza/cli.py", line 555, in create
    data = create_cf_template(definition, region, version, parameter, force, parameter_file)
  File "/usr/local/lib/python3.5/site-packages/senza/cli.py", line 638, in create_cf_template
    data = evaluate(definition.copy(), args, account_info, force)
  File "/usr/local/lib/python3.5/site-packages/senza/cli.py", line 239, in evaluate
    definition = componentfn(definition, configuration, args, info, force, account_info)
  File "/usr/local/lib/python3.5/site-packages/senza/components/elastic_load_balancer.py", line 67, in component_elastic_load_balancer
    certificate = IAMServerCertificate.get_by_name(ssl_cert)
  File "/usr/local/lib/python3.5/site-packages/senza/manaus/iam.py", line 82, in get_by_name
    raise error
  File "/usr/local/lib/python3.5/site-packages/senza/manaus/iam.py", line 71, in get_by_name
    response = client.get_server_certificate(ServerCertificateName=name)
  File "/usr/local/lib/python3.5/site-packages/botocore/client.py", line 278, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/usr/local/lib/python3.5/site-packages/botocore/client.py", line 572, in _make_api_call
    raise ClientError(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (ValidationError) when calling the GetServerCertificate operation: The specified value for serverCertificateName is invalid. It must contain only alphanumeric characters and/or the following: +=,.@_-`
```

The LB-part of zmon-appliance-planetexpress-qa.yaml (autogenerated by Stups' script) looks like this:

```
    ZmonApplianceLoadBalancer:
      Type: Senza::ElasticLoadBalancer
      HTTPPort: 9090
      HealthCheckPath: /health
      HealthCheckPort: 9090
      SecurityGroups:
          app-zmon-{{AccountInfo.TeamID}}
      Scheme: internal
      SSLCertificateId: arn:none # hack to disable SSL
      Listeners:
        LoadBalancerPort: 9090
        Protocol: HTTP
        InstancePort: 9090
        InstanceProtocol: HTTP
```

(had to remove the '-' signs for Markup to work).

Am I right to assume SSLCertificateId: arn:none is causing the issue?
What can I do?

Discussion:

Patch:
diff --git a/senza/components/elastic_load_balancer.py b/senza/components/elastic_load_balancer.py
index 6140440..347b515 100644
--- a/senza/components/elastic_load_balancer.py
+++ b/senza/components/elastic_load_balancer.py
@@ -23,34 +23,7 @@ def get_load_balancer_name(stack_name: str, stack_version: str):
     return '{}-{}'.format(stack_name[:l], stack_version)
 
 
-def component_elastic_load_balancer(definition, configuration, args, info, force, account_info):
-    lb_name = configuration["Name"]
-
-    # domains pointing to the load balancer
-    subdomain = ''
-    main_zone = None
-    for name, domain in configuration.get('Domains', {}).items():
-        name = '{}{}'.format(lb_name, name)
-        definition["Resources"][name] = {
-            "Type": "AWS::Route53::RecordSet",
-            "Properties": {
-                "Type": "CNAME",
-                "TTL": 20,
-                "ResourceRecords": [
-                    {"Fn::GetAtt": [lb_name, "DNSName"]}
-                ],
-                "Name": "{0}.{1}".format(domain["Subdomain"], domain["Zone"]),
-                "HostedZoneName": "{0}".format(domain["Zone"])
-            },
-        }
-
-        if domain["Type"] == "weighted":
-            definition["Resources"][name]["Properties"]['Weight'] = 0
-            definition["Resources"][name]["Properties"]['SetIdentifier'] = "{0}-{1}".format(info["StackName"],
-                                                                                            info["StackVersion"])
-            subdomain = domain['Subdomain']
-            main_zone = domain['Zone']  # type: str
-
+def get_listeners(subdomain, main_zone, configuration):
     ssl_cert = configuration.get('SSLCertificateId')
 
     if ACMCertificate.arn_is_acm_certificate(ssl_cert):
@@ -95,6 +68,46 @@ def component_elastic_load_balancer(definition, configuration, args, info, force
                             'SSL certificate for "{}"'.format(name))
             else:
                 fatal_error('Could not find any SSL certificate')
+    return [
+        {
+            "PolicyNames": [],
+            "SSLCertificateId": ssl_cert,
+            "Protocol": "HTTPS",
+            "InstancePort": configuration["HTTPPort"],
+            "LoadBalancerPort": 443
+        }
+    ]
+
+
+def component_elastic_load_balancer(definition, configuration, args, info, force, account_info):
+    lb_name = configuration["Name"]
+
+    # domains pointing to the load balancer
+    subdomain = ''
+    main_zone = None
+    for name, domain in configuration.get('Domains', {}).items():
+        name = '{}{}'.format(lb_name, name)
+        definition["Resources"][name] = {
+            "Type": "AWS::Route53::RecordSet",
+            "Properties": {
+                "Type": "CNAME",
+                "TTL": 20,
+                "ResourceRecords": [
+                    {"Fn::GetAtt": [lb_name, "DNSName"]}
+                ],
+                "Name": "{0}.{1}".format(domain["Subdomain"], domain["Zone"]),
+                "HostedZoneName": "{0}".format(domain["Zone"])
+            },
+        }
+
+        if domain["Type"] == "weighted":
+            definition["Resources"][name]["Properties"]['Weight'] = 0
+            definition["Resources"][name]["Properties"]['SetIdentifier'] = "{0}-{1}".format(info["StackName"],
+                                                                                            info["StackVersion"])
+            subdomain = domain['Subdomain']
+            main_zone = domain['Zone']  # type: str
+
+    listeners = configuration.get('Listeners') or get_listeners(subdomain, main_zone, configuration)
 
     health_check_protocol = "HTTP"
     allowed_health_check_protocols = ("HTTP", "TCP", "UDP", "SSL")
@@ -157,15 +170,7 @@ def component_elastic_load_balancer(definition, configuration, args, info, force
                 "Timeout": "5",
                 "Target": health_check_target
             },
-            "Listeners": [
-                {
-                    "PolicyNames": [],
-                    "SSLCertificateId": ssl_cert,
-                    "Protocol": "HTTPS",
-                    "InstancePort": configuration["HTTPPort"],
-                    "LoadBalancerPort": 443
-                }
-            ],
+            "Listeners": listeners,
             "ConnectionDrainingPolicy": {
                 "Enabled": True,
                 "Timeout": 60


Test patch:
diff --git a/tests/test_components.py b/tests/test_components.py
index 7112492..4b3330f 100644
--- a/tests/test_components.py
+++ b/tests/test_components.py
@@ -136,6 +136,28 @@ def test_component_load_balancer_idletimeout(monkeypatch):
     assert 'HTTPPort' not in result["Resources"]["test_lb"]["Properties"]
 
 
+def test_component_load_balancer_http_only(monkeypatch):
+    configuration = {
+        "Name": "test_lb",
+        "SecurityGroups": "",
+        "HTTPPort": "9999",
+        "SSLCertificateId": "arn:none", # should be ignored as we overwrite Listeners
+        "Listeners": [{"Foo": "Bar"}]
+    }
+    info = {'StackName': 'foobar', 'StackVersion': '0.1'}
+    definition = {"Resources": {}}
+
+    args = MagicMock()
+    args.region = "foo"
+
+    mock_string_result = MagicMock()
+    mock_string_result.return_value = "foo"
+    monkeypatch.setattr('senza.components.elastic_load_balancer.resolve_security_groups', mock_string_result)
+
+    result = component_elastic_load_balancer(definition, configuration, args, info, False, MagicMock())
+    assert 'Bar' == result["Resources"]["test_lb"]["Properties"]["Listeners"][0]["Foo"]
+
+
 def test_component_load_balancer_namelength(monkeypatch):
     configuration = {
         "Name": "test_lb",