feat: allow provisioner password from env var or file

[joshdrake]

Summary

Adds two optional, mutually-exclusive ways to supply the JWK provisioner password to a StepIssuer / StepClusterIssuer, alongside the existing Kubernetes Secret reference:

Field	Reads from	Use case
spec.provisioner.passwordRef (existing)	a key in a Kubernetes Secret	default
spec.provisioner.passwordEnv	an environment variable in the controller pod	password injected as an env var
spec.provisioner.passwordFile	a file path in the controller pod	password rendered to a file (e.g. a Vault Agent template)

Motivation

Requested by a user deploying step-issuer who manages secrets with HashiCorp Vault / Vault Agent and hasn't adopted Kubernetes Secrets. Previously the password could only come from a Secret read via the Kubernetes API, so there was no way to consume a password that Vault injects into the controller pod. passwordEnv / passwordFile read from the controller's own environment / filesystem, so they need no Secret and no extra RBAC.

Details

• passwordRef is now optional; validation requires exactly one of the three sources (controllers/password.go: validateProvisionerPasswordSource).
• Password resolution is factored into resolveProvisionerPassword and shared by both issuer controllers.
• The source is configured per issuer (env var name / file path), so multiple issuers with distinct passwords are still supported.
• A trailing newline is trimmed from the env/file sources (templating tools commonly add one); Secret data is used verbatim, so existing behavior is unchanged.
• CRDs regenerated to expose the new fields; README documents the options with a Vault example.

Test plan

• go build ./..., go vet ./..., gofmt
• go test ./api/... ./controllers/... — new unit tests for resolution + validation
• golangci-lint with the smallstep/workflows config — 0 issues
• make generate — CRDs + deepcopy regenerate cleanly
• Manual: deploy with a Vault-injected passwordFile / passwordEnv and confirm the issuer reaches Ready

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ maraino
❌ joshdrake
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[maraino]

LGTM, I've tested the 3 options and they work.