generate: add ca.crt to tls secrets

[kaworu]

In an effort to minimize friction and integration with cert-manager, we're aiming to generate the TLS Secrets with the same data keys as it does.

The only missing data key is ca.crt which is the Certificate of the Authority that signed the TLS certificate in tls.crt. This PR populate the ca.crt key in data accordingly.

[kaworu]

I've pushed an image based on this PR at quay.io/kaworu/certgen:dev, you can reproduce with

% helm install cilium cilium/cilium --version 1.9.5 --namespace kube-system \
    --set hubble.enabled=true \
    --set hubble.relay.enabled=true \
    --set hubble.tls.auto.method=cronJob \
    --set certgen.image.repository=quay.io/kaworu/certgen \
    --set certgen.image.tag=dev \
    --set certgen.image.pullPolicy=Always

After the hubble-generate-certs Job is Completed, we get:

% kubectl get secrets -n kube-system hubble-server-certs  -o json | jq .data
{
  "ca.crt": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJnVENDQVNhZ0F3SUJBZ0lVT2RodnNsMEtyOGxvMzBtOFhuUnUvTHdMbkJJd0NnWUlLb1pJemowRUF3SXcKSGpFY01Cb0dBMVVFQXhNVGFIVmlZbXhsTFdOaExtTnBiR2wxYlM1cGJ6QWVGdzB5TVRBek1qTXhNekE0TURCYQpGdzB5TkRBek1qSXhNekE0TURCYU1CNHhIREFhQmdOVkJBTVRFMmgxWW1Kc1pTMWpZUzVqYVd4cGRXMHVhVzh3CldUQVRCZ2NxaGtqT1BRSUJCZ2dxaGtqT1BRTUJCd05DQUFRZXZ4OU9mdkljSTVoYnREK1lFeFFQTUJtVVBienIKZ1N3aXcrdkxlKzVXaXE2emJkWEtRSlBOTHVJVC9QSHl2TEVYejYxTjFMYVBTdlpHbWRzZjVab0ZvMEl3UURBTwpCZ05WSFE4QkFmOEVCQU1DQVFZd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVU5vUmxoUENyCk5TREVJenY5RmJPZGVPTUtEV3N3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlIMFAycUFRWHRNbHFZTEVXUXcKenV2NXdGRlQwblplbXpDVFEyTWVTbS8rQWlFQTdxMTEzSnZ3M1kwUnhjQVA1YVMrWW5CNGFLL2tyMStKSkRrZwowemRQQ2dVPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==",
  "tls.crt": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUI3akNDQVpPZ0F3SUJBZ0lVVER0VXk1NXMyQUxwNmRpT085V1hJME0yN0lBd0NnWUlLb1pJemowRUF3SXcKSGpFY01Cb0dBMVVFQXhNVGFIVmlZbXhsTFdOaExtTnBiR2wxYlM1cGJ6QWVGdzB5TVRBek1qTXhNekE0TURCYQpGdzB5TkRBek1qSXhNekE0TURCYU1Db3hLREFtQmdOVkJBTU1IeW91WkdWbVlYVnNkQzVvZFdKaWJHVXRaM0p3Cll5NWphV3hwZFcwdWFXOHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUUl4YWJJQjRtb1luUS8KYmcvdEdkQVpXTlliakU3V3g1MGc0VUhBSnhiZ0c3bjcwcURTK3NORncwSWZyTS84VUNFT2xpZHFvNnZiTXpqMwp4MHBmclIwNW80R2lNSUdmTUE0R0ExVWREd0VCL3dRRUF3SUZvREFUQmdOVkhTVUVEREFLQmdnckJnRUZCUWNECkFUQU1CZ05WSFJNQkFmOEVBakFBTUIwR0ExVWREZ1FXQkJTME1ya21jeVM5L3h6WEdQN0RZRTNabnVWUnFEQWYKQmdOVkhTTUVHREFXZ0JRMmhHV0U4S3MxSU1Rak8vMFZzNTE0NHdvTmF6QXFCZ05WSFJFRUl6QWhnaDhxTG1SbApabUYxYkhRdWFIVmlZbXhsTFdkeWNHTXVZMmxzYVhWdExtbHZNQW9HQ0NxR1NNNDlCQU1DQTBrQU1FWUNJUUMxCjJiL0p6U2gxeXJTYlBKT1N1TTJad1ZTR3lVS3RGMFZxZ2dOejluWHNmd0loQU5nKzZBWEticXMyREhTYjhFbnkKdUhZRCtMcWRMSGFVNnF6WjlIUWxFbTdWCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K",
  "tls.key": "LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU1hS3VUWWVUbHM2RlVIWWRlVjVYbWhzM2U5YkRtRFZzeDRzUWJ6K1MwZDlvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFQ01XbXlBZUpxR0owUDI0UDdSblFHVmpXRzR4TzFzZWRJT0ZCd0NjVzRCdTUrOUtnMHZyRApSY05DSDZ6UC9GQWhEcFluYXFPcjJ6TTQ5OGRLWDYwZE9RPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo="
}
% kubectl get secrets -n kube-system hubble-relay-client-certs -o json | jq .data
{
  "ca.crt": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJnVENDQVNhZ0F3SUJBZ0lVT2RodnNsMEtyOGxvMzBtOFhuUnUvTHdMbkJJd0NnWUlLb1pJemowRUF3SXcKSGpFY01Cb0dBMVVFQXhNVGFIVmlZbXhsTFdOaExtTnBiR2wxYlM1cGJ6QWVGdzB5TVRBek1qTXhNekE0TURCYQpGdzB5TkRBek1qSXhNekE0TURCYU1CNHhIREFhQmdOVkJBTVRFMmgxWW1Kc1pTMWpZUzVqYVd4cGRXMHVhVzh3CldUQVRCZ2NxaGtqT1BRSUJCZ2dxaGtqT1BRTUJCd05DQUFRZXZ4OU9mdkljSTVoYnREK1lFeFFQTUJtVVBienIKZ1N3aXcrdkxlKzVXaXE2emJkWEtRSlBOTHVJVC9QSHl2TEVYejYxTjFMYVBTdlpHbWRzZjVab0ZvMEl3UURBTwpCZ05WSFE4QkFmOEVCQU1DQVFZd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVU5vUmxoUENyCk5TREVJenY5RmJPZGVPTUtEV3N3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlIMFAycUFRWHRNbHFZTEVXUXcKenV2NXdGRlQwblplbXpDVFEyTWVTbS8rQWlFQTdxMTEzSnZ3M1kwUnhjQVA1YVMrWW5CNGFLL2tyMStKSkRrZwowemRQQ2dVPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==",
  "tls.crt": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUI2akNDQVkrZ0F3SUJBZ0lVQXppeGFNbzVubjhCYnJONEZoU0h2dGoveTdRd0NnWUlLb1pJemowRUF3SXcKSGpFY01Cb0dBMVVFQXhNVGFIVmlZbXhsTFdOaExtTnBiR2wxYlM1cGJ6QWVGdzB5TVRBek1qTXhNekE0TURCYQpGdzB5TkRBek1qSXhNekE0TURCYU1DTXhJVEFmQmdOVkJBTU1HQ291YUhWaVlteGxMWEpsYkdGNUxtTnBiR2wxCmJTNXBiekJaTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCTmJJQzBXZzFhVmR1Ty9mWVpSN0xmdHIKMW8vNy85T2svV1F6eTNzWjNocFlBbnBzUXpFMm9WbEZ1U2c5bHZRa1Y2ZTBVY09LVE5HOVpMdUFFU0dWNWNTagpnYVV3Z2FJd0RnWURWUjBQQVFIL0JBUURBZ1dnTUIwR0ExVWRKUVFXTUJRR0NDc0dBUVVGQndNQkJnZ3JCZ0VGCkJRY0RBakFNQmdOVkhSTUJBZjhFQWpBQU1CMEdBMVVkRGdRV0JCUXd0K3RibnpYR3dsb0NEVlpnQ05QL09UbHYKc3pBZkJnTlZIU01FR0RBV2dCUTJoR1dFOEtzMUlNUWpPLzBWczUxNDR3b05hekFqQmdOVkhSRUVIREFhZ2hncQpMbWgxWW1Kc1pTMXlaV3hoZVM1amFXeHBkVzB1YVc4d0NnWUlLb1pJemowRUF3SURTUUF3UmdJaEFJaVR4NUF6CjRLcldtY08ySmthQ1FUdVJCYzhUK1ZDS055dEpNRStvT0pBeEFpRUF3TGg2b0hrdmxPUnZpYnVGNjVqZ3BSTnQKYWtBbWRnV0trTFhucVFHQWV3UT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=",
  "tls.key": "LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpTQ1JGL1VDVVBRamt6djYrTmxKaktsMVBINUsrc0tyc2Q1Njc0SkdHTXBvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFMXNnTFJhRFZwVjI0Nzk5aGxIc3QrMnZXai92LzA2VDlaRFBMZXhuZUdsZ0NlbXhETVRhaApXVVc1S0QyVzlDUlhwN1JSdzRwTTBiMWt1NEFSSVpYbHhBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo="
}

[kaworu]

Marking as draft for now while I'm working on the required changes at https://github.com/cilium/cilium.