Update chart to support azure msi oras auth provider

[fseldow]

Description

Chart update to support Azure MSI as oras auth provider.
Chart update to support AKV cert from multiple keyvault and certs

Fixes # 314

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Please also list any relevant details for your test configuration

• Test A
• Test B

Checklist:

• Does the affected code have corresponding tests?
• Are the changes documented, not just with inline documentation, but also with conceptual documentation such as an overview of a new feature, or task-based documentation like a tutorial? Consider if this change should be announced on your project blog.
• Does this introduce breaking changes that would require an announcement or bumping the major version?
• Do all new files have appropriate license header?

[binbin-li]

I have a concern on the new notary trust store. A notary verifier can only load certs from one specified directory. If we have multiple cert directory, how do you plan to integrate with notation?

[fseldow]

It is a good question. The change is based on current ratify verifier configuration that will declare the cert path. And for AKV csi secret, certs from multiple keyvaults have to be mount on container with different volumeMount. Volume mountPath is unique for container configuration.

So my idea is that when we transfer to trust store:
Option 1. we do not use akv csi secret to download the cert, ratify creates its own azure provider to download it.
Option 2. according to the cert path declared in verifier crd, ratify pod will initially copy the certs to specified directory.

WDYT?

[binbin-li]

synced offline, notation verifier will support in-memory certs soon, then we could support mount arbitrary number of directories to certs. We could just keep Chart update to support Azure MSI as oras auth provider. in this PR to unblock it. And have Chart update to support AKV cert from multiple keyvault and certs in a following PR once notation side is done.

[binbin-li]

lgtm