feat(api,controller): adds an api/controller cabundle option to the values.yaml file

[lknite]

If enabled, it adds an initContainer to the api/controller deployment which parses and mounts certs provided via either a configMap or secret.

The parsing step is nice as it breaks up certs which are specified in one long file into individual files before adding them.

Uses an emptyDir, or optionally a pvc, for the actual certs mount within the controller (one of these is required for the controller as it needs to write to the certs folder).

Will resolve #2271 .

This is a new pull request, previous pull request here.

[netlify]

✅ Deploy Preview for docs-kargo-akuity-io ready!

Name	Link
🔨 Latest commit	3e3ff9f
🔍 Latest deploy log	https://app.netlify.com/sites/docs-kargo-akuity-io/deploys/66e0868333d81100085075f0
😎 Deploy Preview	https://deploy-preview-2413.kargo.akuity.io
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 48.75%. Comparing base (df0ab08) to head (3e3ff9f).
Report is 49 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2413      +/-   ##
==========================================
+ Coverage   48.42%   48.75%   +0.32%     
==========================================
  Files         245      250       +5     
  Lines       17715    17973     +258     
==========================================
+ Hits         8578     8762     +184     
- Misses       8719     8729      +10     
- Partials      418      482      +64     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[krancour]

I've done some cleanup on this and tested it extensively.

I have confirmed the controller's ability to communicate with git repos that have certs signed by a custom CA, which was itself self-signed.

I have similarly confirmed similar for the API server's communication with OIDC identity providers.

Caveat emptor: Kargo CLI and UI communicate directly with OIDC identity providers (PKCE) and therefore also need to trust the signer of an IDP's cert. This is obviously well beyond the scope of what the chart can manage.

[krancour]

@lknite thanks for getting us started on this.