Add support for standard TLS secret key names for helm charts

[kshi36]

Fixes #59389
Part of #60411

This PR adds support for standard TLS secret key names (eg. from tools like cert-manager, or type: kubernetes.io/tls secrets) for helm charts. This allows users to specify a TLS secret key name via setting a new field existingCASecretKeyName, such as tls.crt or ca.crt. Backwards compatibility is preserved by setting default to ca.pem.

This includes teleport-plugin-event-handler, teleport-cluster, teleport-operator, teleport-kube-agent charts.

changelog: Added support for standard TLS secret key names for helm charts: teleport-plugin-event-handler, teleport-cluster, teleport-operator, teleport-kube-agent

[github-actions]

Amplify deployment status

Branch	Commit	Job ID	Status	Preview	Updated (UTC)
kevin/helm-tls-secret-standard	5f989d6	8	✅SUCCEED	kevin-helm-tls-secret-standard	2025-12-16 20:19:30

[kshi36]

As a side note: currently teleport-relay chart implements this feature to provide standard tls secret key names, mounting the CA file to /etc/teleport-tls-ca.pem.

deployment.yaml

            {{- if .Values.tls.existingCASecretName }}
            - name: SSL_CERT_FILE
              value: /etc/teleport-tls-ca.pem
            {{- end }}

Should this be standardized and renamed to /etc/teleport-tls-ca/{{ .Values.tls.existingCASecretKeyName }} as in this PR? This maintains the directory-based CA file as in the previous hard-coded version.

This will then change the volume mount from

            {{- if .Values.tls.existingCASecretName }}
            - mountPath: /etc/teleport-tls-ca.pem
              name: teleport-tls-ca
              subPath: {{ required "tls.existingCASecretKeyName must be set if tls.existingCASecretName is set in chart values" .Values.tls.existingCASecretKeyName | quote }}
            {{- end }}

to

          {{- if .Values.tls.existingCASecretName }}
            - mountPath: /etc/teleport-tls-ca
              name: "teleport-tls-ca"
          {{- end }}

Alternatively, we can standardize the CA file path in this PR to /etc/teleport-tls-ca.pem, which unifies the value for the env var SSL_CERT_FILE regardless of chosen key name, but specifies a subpath in the volume mount.

Which approach is preferred?

[bernardjkim]

I think it's a good call to standardize our approach here. I don't have a strong opinion on what we choose, but if I understand correctly, using the first approach has the small benefit of providing the helpful error message when the required value is missing.

[kshi36]

In teleport-relay chart, migrated the required check (and standardized CA file name) from volumeMounts. This removes subPath from the volume mount. LMK if the other way is preferred (for all charts).

[backport-bot-workflows]

@kshi36 See the table below for backport results.

Branch	Result
branch/v18	Failed