Save the CA bundle to a kubernetes secret

[balciiberk]

If the nginx in front of IAM is an ingress controller, the CA bundle must be given to nginx as a kubernetes secret object, but currently, it's just saved to a volume.

If the CA_BUNDLE_SECRET_TARGET env variable exists, it saves the CA bundle also as a kubernetes secret with the name $CA_BUNDLE_SECRET_TARGET. If this variable doesn't exist, it skips saving as kubernetes secret. So, it's backwards compatible.

We have been using the image from this branch at our kubernetes deployment at CERN for months. So, I think it's well-tested.

[giacomini]

Usually there is only one RUN command (if possible):

Suggested change

	RUN curl -LO https://dl.k8s.io/release/v1.29.0/bin/linux/amd64/kubectl
	RUN chmod +x ./kubectl
	RUN mv ./kubectl /usr/local/bin
	RUN curl -LO https://dl.k8s.io/release/v1.29.0/bin/linux/amd64/kubectl \
	&& chmod +x ./kubectl \
	&& mv ./kubectl /usr/local/bin

which you can then merge with the following one. curl also allows to download directly in /usr/local/bin/kubectl (-o option).
Said that, have you considered putting these commands directly into update-trust-anchors.sh, inside the if [ -n "${CA_BUNDLE_SECRET_TARGET}" ]; then? in that way, kubectl would be available in the container only if needed; before downloading it, you could check if it's already present, in case the script has already been run.