integrate dex operator credential creation/deletion in MC bootstrap process

[anvddriesch]

We can use opsctl create dexconfig to create, update, clean and delete dex operator configuration.
The actual logic is in the setup module in dex-operator repo and can be imported by a different tool if needed, so opsctl isn't important here. (plus its deprecated)

For CAPI we are still running these commands manually so that credentials are available as secrets during bootstrap.
It should be possible to use the same logic (or update it a little to make it work) in mc bootstrap so that dex credentials management is automated during the bootstrap process and the manual step is not needed.

[anvddriesch]

• mc might not be recreated that often so we need to be able to only run this part
• we want to have a spike and look into what we would need for this to work

[anvddriesch]

what happens currently if nothing exists yet

• pulling default secrets
• manually creating configuration via opsctl
• replacing secret values
• it is then used in installation secrets

what we could do:

• ensure default contains a dedicated default credential
• directly calling opsctl inside mc bootstrap to create new credentials from default ones
• use created values in installation secrets

what happens currently if file exists

• installation secrets is simply reused

what we could do:

• call opsctl inside mc bootstrap to update credentials
• replace values in installation secrets

things to consider:

• rotation of default credentials
• some steps need manual intervention: github in general needs a person going through the flow and azure first time creation needs admin approval. Is that okay?
• just azure could be run without opening any windows, for creation, consent would then need to be given at some point. update would just work
• calling opsctl is not a long term solution. It would be very easy to just use the module if mcb was golang but like this it's tricky.

[anvddriesch]

• for now adding opsctl create dexconfig to setup-config.sh can be most simple but we still need to think about rotation
• we should have a designated note for the credential that is used
• lets look into alternative ways of how dex operator can request new credentials itself, too