teams rewrite secret/env functionality

[kaelanspatel]

What does this PR change?

Implements supporting helm changes for new RBAC teams. This includes token signing secret and teams helm config configmap mountings, env var configuration, and a config block in Values.yaml.

Does this PR rely on any other PRs?

See linked KCM PR.

How does this PR impact users? (This is the kind of thing that goes in release notes!)

See linked KCM PR.

Links to Issues or tickets this PR addresses or fixes

Adds ability to configure new Teams functionality in 2.6.0, including enable/disable, blocking invalid configurations of rbac, and configuring teams via helm values and/or mounting a secret.

What risks are associated with merging this PR? What is required to fully test this PR?

The risks are likely minimal, though testing should be performed for downgrade/upgrade scenarios.

How was this PR tested?

See linked KCM PR for general auth testing.
Tested no-rbac auth config, simple rbac auth config, self-created configmap config, and config with helm-created configmap.

Have you made an update to documentation? If so, please provide the corresponding PR.

In progress.

[Sean-Holcomb]

I am wondering if we should take a stand here a split out rbac from having duplicate entries in saml and oidc

[nealormsbee]

I am wondering if we should take a stand here a split out rbac from having duplicate entries in saml and oidc

@Sean-Holcomb @kaelanspatel what do we need to do to make progress here? Never opposed to simplifying the Helm values, but if that'll add ~days to the cycle getting this merged, I'd ask to take that stand another time. We have folks waiting on the new and improved RBAC capabilities.

[kaelanspatel]

@nealormsbee Just simplifying and testing the config this morning, should be done with it and a draft for the associated setup docs by EoD today.

[nealormsbee]

You the man! Thanks.

[kaelanspatel]

For posterity, latest change adds/changes:

• Removes explicit teamsEnabled or rbacTeams.enabled flags for existing implicit enablement of teams by specifying oidc/saml.rbac.enabled without groups. This is to facilitate a smooth upgrade. Existing env functionality not changed.
• Renames rbacTeams to teams.
• Adds a configmap name under teams that, if specified, overrides any other helm config and uses an existing configmap defined by the user.
• Fixes issues relating to the first change.

[nealormsbee]

Bumping this one gents. Looks like the lint checker is just failing on two bad links in the README.

[nikovacevic]

Not sure but I think that the README links should be updated to https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api-reference/api.md#monitoring.coreos.com/v1.PodMonitor