K8SPG-1045: add .spec.tls.certManagementPolicy field

[pooknull]

https://perconadev.atlassian.net/browse/K8SPG-1045

CHANGE DESCRIPTION

This PR adds .spec.tls.certManagementPolicy which controls how TLS secrets are managed. The following values are supported:

• auto - the operator creates and maintains TLS secrets. This is the default.
• userProvidedOnly - the operator never generates or modifies TLS secrets. Reconciliation pauses until every required secret is provided by the user.

When secrets are missing (when userProvidedOnly is used), the cluster reports:

conditions:
- type: TLSSecretsReady
  status: "False"
  reason: TLSSecretsMissing
- type: Progressing
  status: "False"
  reason: Paused

The TLSSecretsReady message lists the missing secret names.

Once these secrets are present, the operator creates the instance StatefulSet so its generated name can be seen by the user.

After that, user should create corresponding <statefulset-name>-certs secret.

CHECKLIST

Jira

• Is the Jira ticket created and referenced properly?
• Does the Jira ticket have the proper statuses for documentation (Needs Doc) and QA (Needs QA)?
• Does the Jira ticket link to the proper milestone (Fix Version field)?

Tests

• Is an E2E test/test case added for the new feature/change?
• Are unit tests added where appropriate?

Config/Logging/Testability

• Are all needed new/changed options added to default YAML files?
• Are all needed new/changed options added to the Helm Chart?
• Did we add proper logging messages for operator actions?
• Did we ensure compatibility with the previous version or cluster upgrade process?
• Does the change support oldest and newest supported PG version?
• Does the change support oldest and newest supported Kubernetes version?

[JNKPercona]

Test Name	Result	Time
backup-enable-disable	passed	00:12:37
builtin-extensions	passed	00:06:12
cert-manager-tls	passed	00:09:38
cert-management-policy	passed	00:03:04
custom-envs	passed	00:18:20
custom-tls	passed	00:06:09
database-init-sql	passed	00:02:28
demand-backup	passed	00:24:03
demand-backup-offline-snapshot	passed	00:17:44
dynamic-configuration	passed	00:03:15
finalizers	passed	00:05:26
init-deploy	passed	00:03:21
huge-pages	passed	00:03:12
major-upgrade-14-to-15	passed	00:12:08
major-upgrade-15-to-16	passed	00:12:01
major-upgrade-16-to-17	passed	00:13:03
major-upgrade-17-to-18	passed	00:10:17
ldap	passed	00:04:17
ldap-tls	passed	00:07:33
monitoring	passed	00:09:12
monitoring-pmm3	passed	00:09:11
one-pod	passed	00:05:25
operator-self-healing	passed	00:10:42
pitr	passed	00:12:51
scaling	passed	00:05:29
scheduled-backup	passed	00:27:33
self-healing	passed	00:11:04
sidecars	passed	00:02:47
standby-pgbackrest	passed	00:17:32
standby-streaming	passed	00:12:58
start-from-backup	passed	00:11:49
tablespaces	passed	00:07:13
telemetry-transfer	passed	00:04:41
upgrade-consistency	passed	00:06:50
upgrade-minor	failure	00:10:07
users	passed	00:05:05
migration-from-crunchy-standby	passed	00:19:14
migration-from-crunchy-pv	passed	00:10:04
migration-from-crunchy-backup-restore	passed	00:16:24

Summary	Value
Tests Run	39/39
Job Duration	02:00:32
Total Test Time	06:31:19

commit: 859b53b
image: perconalab/percona-postgresql-operator:PR-1679-859b53b7e

[egegunes]

we're returning a nil *corev1.Secret with a nil error. this is unexpected for caller. can we improve if possible or at least comment in function's godoc

[nmarukovich]

What would be if I create secret manually? As I understand we don't have labels in secret in this case.

[hors]

@pooknull please fix conflicts