cephrgw-system: source cephrgw-credentials from Vault via VSO (#262)

## Why

Follow-up to the cephrgw-operator deploy (#261): source the operator's Ceph dashboard credentials from Vault via VSO instead of a hand-created Secret.

## Changes

- Add `apps/base/cephrgw-system/vaultauth.yaml`: `VaultAuth` (mount `k8s/au/syd1`, role `cephrgw-operator`, SA `cephrgw-operator`, `vaultConnectionRef: vso-system/default`).
- Add `apps/base/cephrgw-system/vaultstaticsecret.yaml`: renders KV `service/cephrgw/dashboard-credentials` into the `cephrgw-credentials` Secret (keys copied verbatim → consumed by the Deployment via `envFrom`; the reloader annotation restarts the operator on rotation).
- Reference both from the base kustomization.

## Dependencies / ordering

- Requires the Vault role + policy from **terraform-vault #95** (merge/apply first), and the KV values to be seeded out-of-band:
  ```
  vault kv put kv/service/cephrgw/dashboard-credentials \
    CEPH_DASHBOARD_URL=https://dashboard.ceph.unkin.net \
    CEPH_DASHBOARD_USERNAME=k8s-cephrgw-operator \
    CEPH_DASHBOARD_PASSWORD=... CEPH_RGW_ENDPOINT=https://s3.ceph.unkin.net
  ```
- Until VSO auth succeeds the `cephrgw-credentials` Secret won't exist and the operator pod stays in `CreateContainerConfigError` (expected).

---------

Co-authored-by: benvin <neotheo@gmail.com>
Reviewed-on: #262
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

apps/base/cephrgw-system/kustomization.yaml

@@ -9,3 +9,5 @@ resources:
   - https://git.unkin.net/unkin/cephrgw-operator/raw/tag/v0.1.0/config/crd/install.yaml
   - rbac.yaml
   - deployment.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml

apps/base/cephrgw-system/vaultauth.yaml

@@ -0,0 +1,21 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: cephrgw-system
+spec:
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default
+  allowedNamespaces:
+    - cephrgw-system
+  kubernetes:
+    # Shared "default" role: binds the namespace's default ServiceAccount and
+    # grants the templated kv/kubernetes/namespace/<ns>/<sa>/* read policy, so
+    # no per-app terraform-vault change is needed.
+    role: default
+    serviceAccount: default
+    audiences:
+      - vault
+    tokenExpirationSeconds: 600

apps/base/cephrgw-system/vaultstaticsecret.yaml

@@ -0,0 +1,27 @@
+---
+# Renders the Ceph dashboard credentials from Vault into the cephrgw-credentials
+# Secret the operator Deployment consumes via envFrom. The KV secret's keys
+# (CEPH_DASHBOARD_URL/USERNAME/PASSWORD, optional CEPH_RGW_ENDPOINT/CA) are
+# copied verbatim, so they land as the matching env vars.
+#
+# The path sits under the templated default policy
+# (kv/data/kubernetes/namespace/<ns>/<sa>/*), so it needs no dedicated Vault
+# role or policy. Seed the values with:
+#   vault kv put kv/kubernetes/namespace/cephrgw-system/default/cephrgw-credentials \
+#     CEPH_DASHBOARD_URL=... CEPH_DASHBOARD_USERNAME=... CEPH_DASHBOARD_PASSWORD=...
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: cephrgw-credentials
+  namespace: cephrgw-system
+spec:
+  vaultAuthRef: default
+  mount: kv
+  type: kv-v2
+  path: kubernetes/namespace/cephrgw-system/default/cephrgw-credentials
+  refreshAfter: 5m
+  hmacSecretData: true
+  destination:
+    name: cephrgw-credentials
+    create: true
+    overwrite: true