Add TLS config observer to update opcon/catd

Add an apiserver TLS config observer. This examines TLS config and
copies the values into the .spec.observedConfig field of the
olms.operator.openshift.io/cluster resource. This is then used to
apply configuration to the operator-controller and catalogd.

The configuration is applied to those deployments via:
* --tls-custom-ciphers=X,Y,Z
* --tls-custom-version=N
* --tls-profile=custom

In addition:
* Move the deployment update hooks (proxy, TLS) into their own files
* Add unit tests
* Changed Apply()s to Patch()s when modifying olms to avoid overwrites
* Update fieldManagers to avoid overwrites

Signed-off-by: Todd Short <[email protected]>
Co-Authored-By: Claude <[email protected]>

Author: tmshort

cmd/cluster-olm-operator/main.go

@@ -182,6 +182,13 @@ func runOperator(ctx context.Context, cc *controllercmd.ControllerContext) error
 		cc.EventRecorder.ForComponent(olmProxyController),
 	)
 
+	tlsObserverController := controller.NewTLSObserverController(
+		"OLMTLSSecurityProfileObserver",
+		cl.OperatorClient,
+		cl.ConfigInformerFactory,
+		cc.EventRecorder.ForComponent("OLMTLSSecurityProfileObserver"),
+	)
+
 	versionGetter := status.NewVersionGetter()
 	versionGetter.SetVersion("operator", status.VersionForOperatorFromEnv())
 
@@ -216,7 +223,7 @@ func runOperator(ctx context.Context, cc *controllercmd.ControllerContext) error
 		return errors.New("timed out waiting for FeatureGate detection")
 	}
 
-	for _, c := range append(staticResourceControllerList, upgradeableConditionController, incompatibleOperatorController, clusterOperatorController, operatorLoggingController, proxyController) {
+	for _, c := range append(staticResourceControllerList, upgradeableConditionController, incompatibleOperatorController, clusterOperatorController, operatorLoggingController, proxyController, tlsObserverController.Controller) {
 		go func(c factory.Controller) {
 			defer runtime.HandleCrash()
 			c.Run(ctx, 1)

manifests/0000_51_olm_02_operator_clusterrole.yaml

@@ -27,6 +27,7 @@ rules:
       - proxies
       - featuregates
       - clusterversions
+      - apiservers
     verbs:
       - get
       - list