feat: load secrets for OpenStack Helm via a values file

[cardoe]

Generate a helm values file with the secrets in it. That can then be stored and used via tools like https://github.com/jkroepke/helm-secrets Then switch to using the OpenStack Helm charts via their repo so that we can execute their helm charts like we do the other components.

[cardoe]

I realize now this wouldn't work because the MariaDB and RabbitMQ operator need to read the secret. So we would need to still create the secret from this data. So still more to iterate here.

[skrobul]

https://github.com/jkroepke/helm-secrets can use sops and it can generate both plain values, Secrets or whatever else. The downside over sealed secrets is that whoever has the key can view the credentials locally. Can be partially mitigated if we use non-gpg backend

[cardoe]

Yeah maybe the docs give a couple of suggested options and that's one?

[cardoe]

The goal with this is to make it easier for folks to run the helm commands and to be less opinionated about the secrets storage.

[cardoe]

So to provide some more context:

1. remove using Sealed Secrets for OpenStack Helm components, which removes the need for the post-renderer
2. Put secrets into a values file instead of creating them as separate files and then loading them dynamically from the cluster

This should make us less opinionated and easier to use.

[cardoe]

Ultimately the helm commands go from:

helm --namespace openstack template \
     ironic \
    ./openstack-helm/ironic/ \
    -f components/13-ironic/aio-values.yaml \
    --set endpoints.identity.auth.admin.password="$(kubectl --namespace openstack get secret keystone-admin -o jsonpath='{.data.password}' | base64 -d)" \
    --set endpoints.oslo_db.auth.ironic.password="$(kubectl --namespace openstack get secret ironic-db-password -o jsonpath='{.data.password}' | base64 -d)" \
    --set endpoints.oslo_messaging.auth.ironic.password="$(kubectl --namespace openstack get secret ironic-rabbitmq-password -o jsonpath='{.data.password}' | base64 -d)" \
    --set endpoints.identity.auth.ironic.password="$(kubectl --namespace openstack get secret ironic-keystone-password -o jsonpath='{.data.password}' | base64 -d)" \
    | kubectl -n openstack apply -f -

to

helm --namespace openstack template \
     ironic \
    ./openstack-helm/ironic/ \
    -f components/13-ironic/aio-values.yaml \
    -f secret-openstack.yaml \
    | kubectl -n openstack apply -f -

I also wrapped up the helm call with kustomize since we've done that in every other component.

[skrobul]

previous review was supposed to be with Approve, not Request changes, sorry