[kong] re-use admission certificates if present

[rainest]

What this PR does / why we need it:

Reuses admission webhook certificate Secrets if they are already present.

Which issue this PR fixes

• fixes Kong pods get replaced on every update to helm release when admission controller is enabled #126
• fixes auto-generated webhook cert should not be overwritten by helm #253

Special notes for your reviewer:

We currently generate our checksum by using the entire admission webhook template output as input to SHA256. For some reason I cannot determine, the checksum still changes with the new lookup functionality between installs and upgrades, although a diff between the two shows no difference in the generated resources. Subsequent upgrades do not change the checksum.

To avoid this, I've modified the checksum generator to extract the tls.crt lines from the template, concatenate those, and checksum that, since we shouldn't need to care about anything else. It's ugly, but it works.

IMO this de facto solves #252 also: the certificate and CA Secret names are predictable, and if you create those Secrets in advance of the install, it should use them instead. Need to check to confirm. We'd only need additional changes for that if we want to make the Secret names user-selectable.

Checklist

[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.]

• PR is based off the current tip of the next branch and targets next, not main
• Title of the PR and commit headers start with chart name (e.g. [kong])

[rainest]

Hold because this change requires Helm 3 and cannot go in until we've removed support for Helm 2 in chart 2.x. It should otherwise be fine to review (and if anyone can figure out why the install/upgrade checksum thing happens or some neater way of working around that, I'd be quite grateful).

As CI helpfully notes, we also need to upgrade CI to use Helm 3.

[mflendrich]

Looks good in general; some comments attached.

Also, why is the test failing (on failure to find the lookup function)?

[rainest]

Also, why is the test failing (on failure to find the lookup function)?

It requires Helm 3. CI still uses Helm 2.

[rainest]

CI now has a different problem!

Error: templates/controller-rbac-resources.yaml: the kind "rbac.authorization.k8s.io/v1beta1 Role" is deprecated in favor of "rbac.authorization.k8s.io/v1 Role"

https://github.com/rainest/charts has a PoC of the updated flow with a cheat: rainest@f4c7da0

This should work with a proper fix for Kong/kubernetes-ingress-controller#801. For roles, apparently just bumping the version is fine. CRDs require other changes, however.

[rainest]

The checksum hack wasn't actually necessary--I thought about why we even had it, looked back in ancient history, and realized it was a workaround to intentionally redeploy the controller because we couldn't keep the certificate stable 🤦 helm/charts#20051

[rainest]

Rebase following 2635265. CI is now happy/this is no longer blocked on KIC#801.