support no-auth mode in k8s

[isegall-da]

Cluster test with no-auth validator1

(docs coming in a few minutes, sorry)

Pull Request Checklist

Cluster Testing

• If a cluster test is required, comment /cluster_test on this PR to request it, and ping someone with access to the DA-internal system to approve it.
• If a hard-migration test is required (from the latest release), comment /hdm_test on this PR to request it, and ping someone with access to the DA-internal system to approve it.

PR Guidelines

• Include any change that might be observable by our partners or affect their deployment in the release notes.
• Specify fixed issues with Fixes #n, and mention issues worked on using #n
• Include a screenshot for frontend-related PRs - see README or use your favorite screenshot tool

Merge Guidelines

• Make the git commit message look sensible when squash-merging on GitHub (most likely: just copy your PR description).

[OriolMunoz-da]

tihi

[isegall-da]

When writing the docs, I also realized I have a small testing gap in Pulumi, since I'm still creating auth-related secrets which the docs will say you can skip for no-auth, will fix the tests (and anything they expose...)

[isegall-da]

@OriolMunoz-da @martinflorian-da indeed that exposed some issues when those secrets did not exist. All fixed now. Mind taking another look before I merge please, for sanity?

(successful test on the latest, FTR: https://app.circleci.com/pipelines/github/DACH-NY/canton-network-internal/35854/workflows/65f0f663-6c77-4290-beba-b4720d39c8fb)

[isegall-da]

ping @OriolMunoz-da @martinflorian-da

[OriolMunoz-da]

(successful test on the latest, FTR: https://app.circleci.com/pipelines/github/DACH-NY/canton-network-internal/35854/workflows/65f0f663-6c77-4290-beba-b4720d39c8fb)

redeploy_sv_runbook (191761) failed, though at a quick glance I cannot tell if it's caused by this PR or just flaked

[isegall-da]

Thanks @OriolMunoz-da
Seems unrelated indeed, the point where it should matter has passed (the deploy_cluster and preflight_check), but definitely rerunning before merging: https://app.circleci.com/pipelines/github/DACH-NY/canton-network-internal/36175/workflows/5adbcca0-c573-4862-9c4b-5b9107323263

[martinflorian-da]

LGTM, thanks! (And sorry for ignoring for so long...)

[OriolMunoz-da]

also LGTM provided that ci run passes 😄

[isegall-da]

Thanks @OriolMunoz-da Seems unrelated indeed, the point where it should matter has passed (the deploy_cluster and preflight_check), but definitely rerunning before merging: https://app.circleci.com/pipelines/github/DACH-NY/canton-network-internal/36175/workflows/5adbcca0-c573-4862-9c4b-5b9107323263

Woohoo, that passed.

[moritzkiefer-da]

@isegall-da Sorry I only reviewed this now but I think this is the wrong approach. You now made the same mistake that we made in the docker compose deployment (but have an issue to fix and did fix for localnet): For the ledger API you disabled auth completely. For the validator we have hmac shared secret auth. This mismatch has caused confusion for a number of users. Imho we should use hmac shared secret auth for both.