feat: migrate certificate creation from bicep to CreateCertificate pipeline steps

[geoberle]

What

Migrate all certificate creation from bicep ARM templates to native CreateCertificate pipeline steps:

Maestro (ARO-28055)

• Add CreateCertificate steps to svc-pipeline.yaml and mgmt-pipeline.yaml for maestro-server and maestro-consumer
• Replace maestro.certDomain config with explicit maestro.server.certSAN and maestro.agent.certSAN with CEL validation
• Extract key-vault-secret-access.bicep module for RBAC-only cert secret access
• Simplify maestro-server.bicep and maestro-consumer.bicep to only handle RBAC and EventGrid registration
• Store certificate thumbprint as a tag on KV certificate (tags propagate to associated secret, readable from bicep)
• Keep ThumbprintMatch validation for self-signed certs (dev), DnsMatchesAuthenticationName for CA-signed certs (prod)
• Safe-navigate tags property on secrets that predate the tag pattern

FPA, Geneva Actions, Geneva logs (ARO-28053)

• Extract FPA, Geneva Actions, and Geneva RP/cluster logs certificates from bicep into CreateCertificate pipeline steps
• Remove cert modules from svc-cluster, mgmt-cluster, geneva-identities bicep
• Replace key-vault-cert-with-access with standalone keyvault-secret-access for CSI secret provider access grants
• Drop keyCredentials from Geneva Actions Entra app (SNI only)
• Replace manageCertificates bool with per-cert manage (Enabled/Disabled) enum for conditional gating
• Add CEL rules enforcing SAN construction
• Add certificateManage shared schema definition

Tooling

• Support optional manage field on CreateCertificate pipeline steps — when Disabled, step is skipped; when nil, proceeds as before (backward compatible)
• Upstream: feat(pipelines): add manage field to CreateCertificateStep (ARO-28053) ARO-Tools#261

Why

Deployment scripts for certificate creation violate SFI-ID4.2.1 compliance requirements. The CreateCertificate pipeline step is a native replacement that avoids deployment scripts entirely. Self-signed certificates require ThumbprintMatch validation in EventGrid since we cannot register them as CA certificates — the thumbprint-as-tag pattern bridges the gap between the pipeline step (which creates the cert) and the bicep deployment (which configures EventGrid). The manage gate allows environments to opt out of pipeline-managed cert creation where certs are provisioned externally.

https://redhat.atlassian.net/browse/ARO-28055
https://redhat.atlassian.net/browse/ARO-28053

Testing

• Existing unit tests for certificate policy matching pass
• New unit tests for manage field gating
• Manual verification: certificate thumbprint tag set correctly in KV, propagates to secret, readable via ARM
• Deployment to pers env to verify maestro connects to EventGrid

PR Checklist

• PR is scoped to a single task (no mixed concerns)
• Title follows Conventional Commits format
• Summary explains the "Why" behind the change
• Linked to relevant ticket/issue
• Self-reviewed the diff
• CI/CD checks are passing (ignore Tide)
• Commit history is clean (rebased/squashed)

[Copilot]

Pull request overview

Reintroduces Maestro EventGrid certificate provisioning via the native CreateCertificate pipeline step (removing deployment-script-based cert creation for SFI-ID4.2.1 compliance), and updates infra/config so Bicep can configure EventGrid authentication using SAN-based validation (prod) and thumbprint matching (self-signed dev) sourced from Key Vault tags.

Changes:

• Adds a post-create reconciliation in the CreateCertificate step implementation to tag KV certificates with their thumbprint (so Bicep can read it via ARM tags).
• Updates SVC/MGMT pipelines and cluster templates to create Maestro server/consumer certs before deployments and pass explicit certSAN/issuer values.
• Replaces the previous cert-creation/access pattern with a new RBAC-only Key Vault secret access module and adds schema + CEL validation for SAN consistency.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tooling/templatize/pkg/pipeline/certificate.go	Tags KV certificates with thumbprints after create/skip to enable Bicep consumption.
dev-infrastructure/templates/svc-cluster.bicep	Switches Maestro server module inputs from certDomain to explicit maestroServerCertSAN.
dev-infrastructure/templates/mgmt-cluster.bicep	Switches Maestro consumer module inputs from certDomain to explicit maestroConsumerCertSAN.
dev-infrastructure/svc-pipeline.yaml	Adds maestro-server-cert CreateCertificate step and wires it into cluster dependencies.
dev-infrastructure/modules/maestro/maestro-server.bicep	Replaces cert-creation module with secret RBAC + reads thumbprint from KV secret tags for EventGrid config.
dev-infrastructure/modules/maestro/maestro-consumer.bicep	Replaces cert-creation module with secret RBAC + reads thumbprint from KV secret tags for EventGrid config.
dev-infrastructure/modules/keyvault/key-vault-secret-access.bicep	New module to grant MI RBAC access to a specific Key Vault secret.
dev-infrastructure/mgmt-pipeline.yaml	Adds maestro-consumer-cert CreateCertificate step and wires it into dependencies.
dev-infrastructure/configurations/svc-cluster.tmpl.bicepparam	Maps config maestro.server.certSAN into the SVC cluster deployment parameter.
dev-infrastructure/configurations/mgmt-cluster.tmpl.bicepparam	Maps config maestro.agent.certSAN into the MGMT cluster deployment parameter.
config/rendered/dev/pers/westus3.yaml	Adds rendered Maestro server/agent certSAN and removes certDomain.
config/rendered/dev/perf/westus3.yaml	Adds rendered Maestro server/agent certSAN and removes certDomain.
config/rendered/dev/dev/westus3.yaml	Adds rendered Maestro server/agent certSAN and removes certDomain.
config/rendered/dev/cspr/westus3.yaml	Adds rendered Maestro server/agent certSAN and removes certDomain.
config/rendered/dev/ci01/centralus.yaml	Adds rendered Maestro server/agent certSAN and removes certDomain.
config/rendered/dev/ci00/centralus.yaml	Adds rendered Maestro server/agent certSAN and removes certDomain.
config/config.yaml	Replaces Maestro certDomain with templated server.certSAN / agent.certSAN defaults/overrides.
config/config.schema.json	Removes maestro.certDomain, adds required certSAN fields, and adds CEL validations tying SANs to DNS + names.

[Copilot]

Pull request overview

Copilot reviewed 25 out of 25 changed files in this pull request and generated 10 comments.

[raelga]

/lgtm
/approve

[raelga]

/retest

[raelga]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: geoberle, raelga

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• config/OWNERS [geoberle,raelga]
• dev-infrastructure/OWNERS [geoberle,raelga]
• tooling/templatize/OWNERS [geoberle,raelga]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[geoberle]

/test e2e-parallel