Security hardening: replace OSAC_AAP_INSECURE_SKIP_VERIFY with proper CA-bundle TLS trust across all overlays

[coderabbitai]

Summary

All deployment overlays (development, caas-ci, vmaas-ci, hypershift2, osac-integration) currently set OSAC_AAP_INSECURE_SKIP_VERIFY: "true" to bypass TLS certificate validation on the operator→AAP connection. This is a consistent convention adopted while the operator lacks CA-bundle support, but it carries High residual risk: authentication tokens and provisioning data exchanged between the operator and the AAP gateway are exposed to man-in-the-middle interception.

Risk

• Severity: High
• Impact: AAP API tokens and provisioning payloads could be intercepted or tampered with in transit if the network path between the operator and AAP gateway is compromised.

Required work

1. Add CA-bundle support to the osac-operator (e.g., a new env var such as OSAC_AAP_CA_BUNDLE pointing to a mounted certificate file or directory).
2. For each overlay, create/reference a Secret or ConfigMap containing the appropriate AAP CA certificate.
3. Mount the CA bundle into the osac-operator-controller-manager container spec in each overlay's kustomization patch.
4. Set OSAC_AAP_INSECURE_SKIP_VERIFY: "false" (or remove it) and point the operator to the CA bundle path.

Affected files

• overlays/development/kustomization.yaml
• overlays/caas-ci/kustomization.yaml
• overlays/vmaas-ci/kustomization.yaml
• overlays/hypershift2/kustomization.yaml
• overlays/osac-integration/kustomization.yaml

Context

Identified during review of PR osac-project/osac-installer#215 (OSAC-874). Setting was intentionally left as-is because CA-bundle support is a prerequisite and was out of scope for that PR.

Related discussion: osac-project/osac-installer#215 (comment)

Requested by: @tchughesiv