Enable configure Connect Injector and Controller Webhooks to be managed by Vault

[jmurret]

Changes proposed in this PR:

• Managing mutating webhook certs for controller and connect injector locally within those components when configured with Vault.
• Not deploying webhook-cert-manager when webhook certs have been configured with Vault
• To turn on this configuration, this will not just be turned on when Vault is turned on. Users will have to configure the below properties that effect both connect inject webhooks and controller webhooks (the reason being that the systemdoes not deploy webhook-cert-manager entirely which normally manages the certs with k8s secrets):
  • global.secretsBackend.vault.enabled
  • global.secretsBackend.vault.consulConnectInjectCARole
  • global.secretsBackend.vault.connectInject.tlsCert.secretName
  • global.secretsBackend.vault.connectInject.caCert.secretName
  • global.secretsBackend.vault.consulControllerCARole
  • global.secretsBackend.vault.controller.tlsCert.secretName
  • global.secretsBackend.vault.controller.caCert.secretName

How to read this PR:

• start with charts/consul/values.yaml to get a sense of what is exposed
• check out acceptance/tests/vault/vault_webhook_certs_test.go and the comments left there
• view charts/consul/templates/connect-inject-deployment.yaml and charts/consul/templates/controller-deployment.yaml to see how configuration is passed
• then view the below commands to see how the managing of webhook certs got implemented locally (and bypassed inwebhook-cert-manager):
  • control-plane/subcommand/controller/command.go
  • control-plane/subcommand/inject-connect/command.go
  • control-plane/subcommand/webhook-cert-manager/command.go

How I've tested this PR:

• manual testing and acceptance tests

How I expect reviewers to test this PR:
👀

Checklist:

• Tests added
• CHANGELOG entry added

  HashiCorp engineers only, community PRs should not add a changelog entry.
  Entries should use present tense (e.g. Add support for...)