setup database certificates

[boddumanohar]

Fixes: simplyblock/vela#169

The database connection endpoint connects to PGBouncer service. So the changes in PR sets up TLS termination for at PGBouncer.

As a part of this changes, we create the certificate:

• Create the certificate as a part of Helm chart
• update PGBouncer Config to require certificates
• update vm.yaml definition with certificates

We first provision a temporary certificate (using the annotation: cert-manager.io/issue-temporary-certificate: "true") and then the certificate will be replaced by the actual lets encrypt certificate.

initially PSQL connection works.

root@pgbench2:/# psql "postgresql://postgres@db.01kjw123b90acqvn6ext0a7m4v.pr623.dev.kernel-labs.org:32138/postgres"
psql (17.8 (Debian 17.8-1.pgdg13+1), server 18.1)
WARNING: psql major version 17, server major version 18.
         Some psql features might not work.
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, compression: off, ALPN: postgresql)
Type "help" for help.

postgres=> \q

but then it doesn't work verify-full mode.

root@pgbench2:/# psql "postgresql://postgres@db.01kjw123b90acqvn6ext0a7m4v.pr623.dev.kernel-labs.org:32138/postgres?sslmode=verify-full&sslrootcert=system"
psql: error: connection to server at "db.01kjw123b90acqvn6ext0a7m4v.pr623.dev.kernel-labs.org" (34.141.107.241), port 32138 failed: SSL error: certificate verify failed

after sometime it works again. Because the certificate will be replaced by lets encrypt's TLS secret

root@pgbench2:/# psql "postgresql://postgres@db.01kjw123b90acqvn6ext0a7m4v.pr623.dev.kernel-labs.org:32138/postgres?sslmode=verify-full&sslrootcert=system"
psql (17.8 (Debian 17.8-1.pgdg13+1), server 18.1)
WARNING: psql major version 17, server major version 18.
         Some psql features might not work.
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, compression: off, ALPN: postgresql)
Type "help" for help.

postgres=> \q

and on the image logs

TLS explicitly required by configuration. Waiting for certificates...
Certificates found. Starting hot-reload watcher in background...
Certificates modified, reloading PgBouncer...

[mxsrc]

Small comment, otherwise it looks good.