feat(helm): prepare certificate refactor

[ixxeL2097]

This PR also allows to provision only required resources for Cert-manager Vault PKI using following values :

nameOverride: ggbridge
fullnameOverride: ggbridge

commonLabels: {gg-team: SelfHosted}

mode: server

deploymentCount: 0
serviceAccount:
  create: false

tls:
  enabled: true
  certManager:
    enabled: true
    rbac:
      create: true
    issuer:
      spec:
        vault:
          path: pki_ggbridge_prod_int/sign/ggbridge
          server: https://vault.gitguardian.org
          auth:
            kubernetes:
              role: ggbridge
              mountPath: /v1/auth/kubernetes-prod
              serviceAccountRef:
                name: ggbridge-issuer  

---
# Source: ggbridge/templates/rbac.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ggbridge-issuer
  labels:
    helm.sh/chart: ggbridge-0.0.0
    app.kubernetes.io/name: ggbridge
    app.kubernetes.io/instance: ggbridge
    app.kubernetes.io/version: "unstable"
    app.kubernetes.io/managed-by: Helm
    tenant: ggbridge
    gg-team: SelfHosted
---
# Source: ggbridge/templates/rbac.yaml
apiVersion: v1
kind: Secret
metadata:
  name: ggbridge-issuer-token
  annotations:
    kubernetes.io/service-account.name: ggbridge-issuer
type: kubernetes.io/service-account-token
---
# Source: ggbridge/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: ggbridge-issuer-token-reviewer
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
  - kind: ServiceAccount
    name: ggbridge-issuer
    namespace: ggbridge
---
# Source: ggbridge/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: ggbridge-issuer
  namespace: ggbridge
rules:
  - apiGroups: ['']
    resources: ['serviceaccounts/token']
    resourceNames: ["ggbridge-issuer"]
    verbs: ['create']
---
# Source: ggbridge/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: ggbridge-issuer
  namespace: ggbridge
subjects:
  - kind: ServiceAccount
    name: cert-manager
    namespace: cert-manager
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: ggbridge-issuer
---
# Source: ggbridge/templates/cert-manager.yaml
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: ggbridge-issuer
  namespace: ggbridge
  labels:
    helm.sh/chart: ggbridge-0.0.0
    app.kubernetes.io/name: ggbridge
    app.kubernetes.io/instance: ggbridge
    app.kubernetes.io/version: "unstable"
    app.kubernetes.io/managed-by: Helm
    tenant: ggbridge
    gg-team: SelfHosted
spec:
  vault:
    auth:
      kubernetes:
        mountPath: /v1/auth/kubernetes-prod
        role: ggbridge
        serviceAccountRef:
          name: ggbridge-issuer
    path: pki_ggbridge_prod_int/sign/ggbridge
    server: https://vault.gitguardian.org

[linear]

ENT-3295 Adapt Helm chart to support Vault INT PKI Issuance

[jCOTINEAU]

Conceptually looks good to me, i have not tested, let me know if i should spin up an installation with vault etc.

[ixxeL2097]

Conceptually looks good to me, i have not tested, let me know if i should spin up an installation with vault etc.

Don't think it is necessary, I already tested it on my own and I will also gradually test it on different environments when implementing the whole solution, so it might not be worth to lose your time here