Fix trusted-bundle conflict in ES secret controller

[caseydavenport]

Description

This controller is a bit complicated, but it tries to manage a few things:

• Creation of KeyPairs for ES and ES related components
• Creation of a trusted bundle to use for ES and ES related components.

It needs to do this differently depending on:

• If this is a single-tenant or multi-tenant system.
• If using internal or external ES

The bug this PR fixes occurred when using external ES in a single-tenant system. In this case, we would attempt to write two trusted bundles into the tigera-elasticsearch Namespace with conflicting contents, resulting in the tigera-ca-bundle ConfigMap oscillating between two states.

We need to make sure that this code:

• Generates only a single trusted bundle in single-tenant mode (regardless of internal / external ES)
• Generates both a trusted bundle for the tigera-elasticsearch NS, as well as for each tenant in multi-tenant mode (only supported with external ES)

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • kind/bug if this is a bugfix.
  • kind/enhancement if this is a a new feature.
  • enterprise if this PR applies to Calico Enterprise only.

[rene-dekker]

lgtm