Support manual webhook certificate configuration (no cert-manager)

[vriesdemichael]

Summary

Support manual webhook certificate configuration for environments that cannot or will not run cert-manager.

Motivation

Not all clusters allow cert-manager or installing additional controllers. Provide an alternate, secure option to operate admission webhooks by allowing manual certificate provisioning or user-provided secrets and configuration.

Proposed deliverables

• Helm values to supply existing TLS secret/CA bundle and an option to disable automatic webhook certs
• Documentation on how to create the required secrets and how to rotate them manually
• Optional example scripts to generate signed certs and create secrets in the operator namespace
• Tests: Unit tests and an integration flow verifying the operator starts webhooks when provided certs, and reports helpful error messages when misconfigured

Acceptance Criteria

• Helm chart accepts webhook.certificate.secretName (or similar) and webhook.certificate.caBundle override
• Docs with step-by-step for manual provisioning and rotation
• Integration test or example demonstrating the manual configuration

Notes

This should not remove cert-manager support; it is an additional, documented option for restricted clusters.