Allow Custom Signer signingCA to Specify Namespace in AddOnTemplate

[mikeshng]

Describe the enhancement
In the current AddOnTemplate API, the SigningCARef does not allow for specifying a namespace value. This means the signing CA secret must be in the open-cluster-management-hub namespace where the addon-manager-controller resides.

In some cases, such as when the argocd-agent principal deployment needs to leverage the signing CA secret, the current restriction forces users to place the argocd-agent deployment in the open-cluster-management-hub namespace instead of its intended argocd namespace.

Requesting an enhancement to add a namespace field in SigningCARef, allowing it to reference a signing CA secret in a specified namespace. Users are still required for granting the necessary RBAC permissions (same as now).

[mikeshng]

CC @qiujian16 @zhujian7 @xuezhaojun

[zhujian7]

@mikeshng This feature has been implemented, I will close this issue, feel free to have a try.
/close

[openshift-ci]

@zhujian7: Closing this issue.

In response to this:

@mikeshng This feature has been implemented, I will close this issue, feel free to have a try.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.