First draft of moving API server TLS cert generation to controllers

- Refactors the existing cert generation code into controllers
  which read and write a Secret containing the certs
- Does not add any new functionality yet, e.g. no new handling
  for cert expiration, and no leader election to allow for
  multiple servers running simultaneously
- This commit also doesn't add new tests for the cert generation
  code, but it should be more unit testable now as controllers

deploy/rbac.yaml

@@ -1,5 +1,6 @@
 #@ load("@ytt:data", "data")
 
+#! Give permission to various cluster-scoped objects
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -28,6 +29,8 @@ roleRef:
   kind: ClusterRole
   name: #@ data.values.app_name + "-aggregated-api-server-cluster-role"
   apiGroup: rbac.authorization.k8s.io
+
+#! Give permission to various objects within the app's own namespace
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -38,6 +41,9 @@ rules:
   - apiGroups: [""]
     resources: [services]
     verbs: [create, get, list, patch, update, watch]
+  - apiGroups: [""]
+    resources: [secrets]
+    verbs: [create, get, list, patch, update, watch]
   - apiGroups: [crds.placeholder.suzerain-io.github.io]
     resources: [logindiscoveryconfigs]
     verbs: [create, get, list, update, watch]
@@ -55,6 +61,8 @@ roleRef:
   kind: Role
   name: #@ data.values.app_name + "-aggregated-api-server-role"
   apiGroup: rbac.authorization.k8s.io
+
+#! Allow both authenticated and unauthenticated LoginRequests (i.e. allow all requests)
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -70,7 +78,6 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: #@ data.values.app_name + "-loginrequests-cluster-role-binding"
 subjects:
-  #! both authenticated and unauthenticated requests (i.e. all requests) should be allowed
   - kind: Group
     name: system:authenticated
     apiGroup: rbac.authorization.k8s.io
@@ -81,6 +88,8 @@ roleRef:
   kind: ClusterRole
   name: #@ data.values.app_name + "-loginrequests-cluster-role"
   apiGroup: rbac.authorization.k8s.io
+
+#! Give permissions for subjectaccessreviews, tokenreview that is needed by aggregated api servers
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
@@ -93,9 +102,10 @@ subjects:
     namespace: #@ data.values.namespace
 roleRef:
   kind: ClusterRole
-  #! give permissions for subjectaccessreviews, tokenreview that is needed by aggregated api servers
   name: system:auth-delegator
   apiGroup: rbac.authorization.k8s.io
+
+#! Give permissions for a special configmap of CA bundles that is needed by aggregated api servers
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
@@ -108,9 +118,10 @@ subjects:
     namespace: #@ data.values.namespace
 roleRef:
   kind: Role
-  #! give permissions for a special configmap of CA bundles that is needed by aggregated api servers
   name: extension-apiserver-authentication-reader
   apiGroup: rbac.authorization.k8s.io
+
+#! Give permission to list and watch ConfigMaps in kube-public
 ---
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1