feat(charts/dex): add optional initContainers to deployment.

[larsla]

Overview

This adds the possibility to configure initContainers for the deployment.

What this PR does / why we need it

Connecting to Postgres using TLS with a client certificate requires the private key to have permission mode 0600.
We need to store the TLS certificates/keys as a Kubernetes Secret and mount that to the deployment.
That is currently not possible when running the process as non-root since securityContext.fsGroup only modifies the group ownership and will chmod g+r the mounted files, thus making github.com/lib/pq reject the key due to bad permissions.

With the help of an initContainer we can copy the files from the secret to another volume and chown/chmod them.
This is the method we used with the old dex helm chart from the stable repository and it's been working well for a couple of years.

Closes: #9
The suggestions in that issue was to either use a mutating webhook or build a custom image. Neither works in our use case
since the cluster is too restricted to allow mutating webhooks and building a custom image would not solve the issue since
the root cause is in a library used by Dex.

Special notes for your reviewer

Checklist

• Change log updated in Chart.yaml (see the contributing guide for details)
• Chart version bumped in Chart.yaml (see the contributing guide for details)
• Documentation regenerated by running make docs

[larsla]

Is there anything missing from this PR? Some feedback would be much appreciated.

[sagikazarmark]

Looks like it needs a rebase. Other than that, it looks good to me.

[larsla]

Looks like it needs a rebase. Other than that, it looks good to me.

I rebased it now.

[eduardohki]

Hey, is there something we can do to help make this PR to be merged, so that we are able to dynamically download the CA Certificates for our databases at startup?

[vihangm]

I'd like to use a sidecar to connect to Google Cloud SQL for my storage. https://docs.cloud.google.com/sql/docs/mysql/connect-kubernetes-engine#proxy-sidecar-pattern

Can we get support for sidecars merged?