feat(operator): add option to customize gateway server cert

[JoaoBraveCoding]

What this PR does / why we need it:

This PR adds fields to the API to allow users to configure a custom LokiStack Gateway certificate to be used instead of the default generated certificates.

Which issue(s) this PR fixes:
https://issues.redhat.com/browse/LOG-8330

Special notes for your reviewer:

Manifests for creating a Loki cert with cert-manager

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: gateway-tls-cluster-issuer
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: gateway-tls-ca
  namespace: openshift-logging
spec:
  isCA: true
  commonName: lokistack-gateway-ca
  secretName: gateway-tls-ca
  privateKey:
    algorithm: RSA
    size: 4096
  issuerRef:
    name: gateway-tls-cluster-issuer
    kind: ClusterIssuer
    group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: gateway-tls-issuer
  namespace: openshift-logging
spec:
  ca:
    secretName: gateway-tls-ca
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: lokistack-dev-gateway-tls
  namespace: openshift-logging
spec:
  secretName: lokistack-dev-gateway-tls
  duration: 2160h # 90d
  renewBefore: 360h # 15d
  commonName: lokistack-dev-gateway-http.openshift-logging.svc
  privateKey:
    rotationPolicy: Never
    algorithm: RSA
    encoding: PKCS8
    size: 4096
  usages:
    - digital signature
    - key encipherment
    - server auth
  dnsNames:
  - "lokistack-dev-gateway-http.openshift-logging.svc"
  - "lokistack-dev-gateway-http.openshift-logging.svc.cluster.local"
  - "localhost"
  issuerRef:
    name: gateway-tls-issuer
    kind: Issuer

Manifests for creating a LokiStack

apiVersion: loki.grafana.com/v1
kind: LokiStack
metadata:
  name: lokistack-dev
  namespace: openshift-logging
spec:
  size: 1x.demo
  storage:
    schemas:
    - version: v13
      effectiveDate: 2023-10-15
    secret:
      name: test
      type: s3
  storageClassName: gp3-csi
  tenants:
    mode: openshift-logging
    gateway:
      tls:
        ca:
          secretName: lokistack-dev-gateway-tls
          key: ca.crt
        certificate:
          secretName: lokistack-dev-gateway-tls
          key: tls.crt
        key:
          secretName: lokistack-dev-gateway-tls
          key: tls.key
  rules:
    enabled: true
    selector:
      matchLabels:
        openshift.io/cluster-monitoring: "true"
    namespaceSelector:
      matchLabels:
        openshift.io/cluster-monitoring: "true"

Checklist

• Reviewed the CONTRIBUTING.md guide (required)
• Documentation added
• Tests updated
• Title matches the required conventional commits format, see here
  • Note that Promtail is considered to be feature complete, and future development for logs collection will be in Grafana Alloy. As such, feat PRs are unlikely to be accepted unless a case can be made for the feature actually being a bug fix to existing behavior.
• Changes that require user attention or interaction to upgrade are documented in docs/sources/setup/upgrade/_index.md
• If the change is deprecating or removing a configuration option, update the deprecated-config.yaml and deleted-config.yaml files respectively in the tools/deprecated-config-checker directory. Example PR

[xperimental]

I have not actually tested setting a custom CA yet, only if the change breaks the default configuration. But I have gone through most of the code-change already 🙂

[xperimental]

Works fine. Noticed some references to the old field name, I think.