Modify helm chart: delete validations for certManagerIssuerRef

[Shunpoco]

Because the helm chart generates cert manager issuers and attaches them to certificates, we have to remove validations which fail if we don't specify certManagerIssuerRef.

I investigated that in #17238,

• firstly we set the validations to restrict users to set their certManagerIssuer.
• But finally, we added template files which generates issuers if users don't specify certManagerIssuer.

I think that we have to delete these validations, otherwise helm can't generate manifest files without specifying certManagerIssuerRef.

Here is the trial on my local:

1. Prepare test-values.yaml:

test-values.yaml

rollOutCiliumPods: true

cni:
  exclusive: false
  debug:
    enabled: true

prometheus:
  enabled: true

operator:
  rollOutPods: true
  prometheus:
    enabled: true

kubeProxyReplacement: "strict"

k8sServiceHost: "172.16.102.137"
k8sServicePort: "6443"

bpf:
  masquerade: true

bgp:
  enabled: false
  announce:
    loadbalancerIP: true

ipam:
  mode: "kubernetes"

bgpControlPlane:
  enabled: true

ingressController:
  enabled: true

hubble:
  relay:
    rollOutPods: true
    enabled: true
  ui:
    rollOutPods: true
    enabled: true

bandwidthManager:
  enabled: true

cluster:
  name: "cluster2"
  id: 2

clustermesh:
  name: "cluster2"
  config:
    enable: true
  clusters: ["cluster1", "cluster2"]
  useAPIServer: true
  apiserver:
    tls:
      auto:
        method: "certmanager"

2. Using this test-values.yaml, I ran helm template:

cd install/kubernetes/cilium
helm template test ./ --values=test-values.yaml > generated_manifests.yaml

3. Check the output. the following is the part of the output:

generated_manifests.yaml

# Source: cilium/templates/clustermesh-apiserver/tls-certmanager/admin-secret.yaml
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: clustermesh-apiserver-admin-cert
  namespace: default
spec:
  issuerRef:
    
      group: cert-manager.io
      kind: Issuer
      name: clustermesh-apiserver-issuer
  secretName: clustermesh-apiserver-admin-cert
  commonName: root
  dnsNames:
  - localhost
  duration: 26280h0m0s
---
# Source: cilium/templates/clustermesh-apiserver/tls-certmanager/remote-secret.yaml
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: clustermesh-apiserver-remote-cert
  namespace: default
spec:
  issuerRef:
    
      group: cert-manager.io
      kind: Issuer
      name: clustermesh-apiserver-issuer
  secretName: clustermesh-apiserver-remote-cert
  commonName: remote
  duration: 26280h0m0s
---
# Source: cilium/templates/clustermesh-apiserver/tls-certmanager/server-secret.yaml
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: clustermesh-apiserver-server-cert
  namespace: default
spec:
  issuerRef:
    
      group: cert-manager.io
      kind: Issuer
      name: clustermesh-apiserver-issuer
  secretName: clustermesh-apiserver-server-cert
  commonName: clustermesh-apiserver.cilium.io
  dnsNames:
  - clustermesh-apiserver.cilium.io
  - "*.mesh.cilium.io"
  ipAddresses:
  - "127.0.0.1"
  - "::1"
  duration: 26280h0m0s
---
# Source: cilium/templates/cilium-ingress-service.yaml
apiVersion: v1
kind: Endpoints
metadata:
  name: cilium-ingress
  namespace: default
subsets:
- addresses:
  - ip: "192.192.192.192"
  ports:
  - port: 9999
---
# Source: cilium/templates/clustermesh-apiserver/tls-certmanager/clustermesh-apiserver-issuer.yaml
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: clustermesh-apiserver-issuer
  namespace: default
spec:
  ca:
    secretName: clustermesh-apiserver-ca-cert

Please ensure your pull request adheres to the following guidelines:

• For first time contributors, read Submitting a pull request
• All code is covered by unit and/or runtime tests where feasible.
• All commits contain a well written commit description including a title,
  description and a Fixes: #XXX line if the commit addresses a particular
  GitHub issue.
• If your commit description contains a Fixes: <commit-id> tag, then
  please add the commit author[s] as reviewer[s] to this issue.
• All commits are signed off. See the section Developer’s Certificate of Origin
• Provide a title or release-note blurb suitable for the release notes.
• Thanks for contributing!

Fixes: #22784

helm: Delete validations for certManagerIssuerRef

[sayboras]

Thanks and LGTM ✔️

[darkstarmv]

@nathanjsweet can we get this merged?

[nathanjsweet]

/test

[nathanjsweet]

There is a minor ci-datapath failure, but it is trivial and cannot possibly be linked to this PR. Marking ready-to-merge.