fix: should reconcile targets consistently

[erikgb]

When checking target keys using managed fields, we must also check binaryData field in target configmaps.

Fixes #259

[inteon]

@erikgb just for context, do you know why the extra reconciliations and patches keep happening? I would expect that the noop patches do not trigger new reconciliations.

[erikgb]

@inteon Neither the JKS nor PKCS#12 format is idempotent, so when the check for keys never match it will patch the target with changes. I really don't know why this didn't happen with JKS only. The added tests only fail on PKCS#12 without the fix...

[inteon]

@erikgb I think we explicitly try to make the JKS encoded value deterministic:

trust-manager/pkg/bundle/sync.go

Lines 191 to 193 in 54e8b09

	// WithOrderedAliases ensures that trusted certs are added to the JKS file in order,
	// which makes the files appear to be reliably deterministic.
	ks := jks.New(jks.WithOrderedAliases())

[inteon]

@erikgb It looks like the pkcs#12 format is using a random salt, which makes it non-idempotent.
see https://github.com/SSLMate/go-pkcs12/blob/v0.4.0/pkcs12.go#L704C5-L706

Now that I fully understand the cause of this issue and why it occurs for pkcs#12 & not for JKS, I'm more than happy to merge this.
/approve
/lgtm

[jetstack-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: inteon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [inteon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[erikgb]

/cherrypick release-0.7

[jetstack-bot]

@erikgb: new pull request created: #265

In response to this:

/cherrypick release-0.7

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.