Keep the internal CA private key across renewals with cert-manager 1.18+

[dejanzele]

Fixes #708

Motivation

Since cert-manager 1.18 the default privateKey.rotationPolicy is Always (GA in 1.20, can no longer be turned off). The chart's self-signed CA Certificate doesn't set the field, so the CA now gets a new private key on every renewal and all previously issued certificates stop validating until each of them has been re-issued. See #708.

Modifications

• add certs.internal_issuer.privateKey to values.yaml, defaulting to rotationPolicy: Never
• render it as the privateKey block of the internal CA Certificate

rotationPolicy: Never keeps the CA key across renewals, which was the behavior before cert-manager 1.18. Setting certs.internal_issuer.privateKey: null renders the same manifest as before this change.

Verifying this change

• Make sure that the change passes the CI checks.

[lhotari]

LGTM