add peerpods support for the node-installer

[Freax13]

This PR adds support for peerpods on SEV-SNP AKS to the node-installer and adjusts our justfile to use the node-installer instead of the coco-operator-based runtime steps.

[katexochen]

We are still unable to deploy the runtime without knowing the target namespace, right? Please create a ticket with a detailed issue description.

[Freax13]

No, this has been fixed. Instead of using federated credentials, we know use a application password credential and directly pass a client id and secret to the cloud-api-adaptor. Conventionally, we already had a application password credential set up:
https://github.com/edgelesssys/contrast/blob/0362d8ccc7892311a799dfca717ac84cc595cea9/infra/azure-peerpods/main.tf#L80C11-L82

[msanft]

Nothing that needs to be done now, but if we still want to have a "working peerpods cluster" through a single terraform apply, using the Kubernetes Terraform provider might be cleaner here.

[msanft]

I think using an octal literal 0o600 would be more readable here

[msanft]

Who is supposed to place peer-pods-config.yaml in that directory?

[Freax13]

Terraform:

contrast/infra/azure-peerpods/main.tf

Lines 126 to 163 in f649399

	resource "local_file" "peer-pods-config" {
	filename = "./peer-pods-config.yaml"
	file_permission = "0777"
	content = <<EOF
	apiVersion: v1
	kind: ConfigMap
	metadata:
	name: peer-pods-cm
	data:
	AZURE_CLIENT_ID: ${azuread_application.app.client_id}
	AZURE_TENANT_ID: ${data.azurerm_subscription.current.tenant_id}
	AZURE_AUTHORITY_HOST: https://login.microsoftonline.com/
	AZURE_IMAGE_ID: ${var.image_id}
	AZURE_INSTANCE_SIZE: Standard_DC2as_v5
	AZURE_REGION: ${data.azurerm_resource_group.rg.location}
	AZURE_RESOURCE_GROUP: ${data.azurerm_resource_group.rg.name}
	AZURE_SUBNET_ID: ${one(azurerm_virtual_network.main.subnet.*.id)}
	AZURE_SUBSCRIPTION_ID: ${data.azurerm_subscription.current.subscription_id}
	CLOUD_PROVIDER: azure
	DISABLECVM: "false"
	---
	apiVersion: v1
	data:
	AZURE_CLIENT_SECRET: ${base64encode(azuread_application_password.cred.value)}
	kind: Secret
	metadata:
	name: azure-client-secret
	---
	type: Opaque
	apiVersion: v1
	data:
	id_rsa.pub: ${data.local_file.id_rsa.content_base64}
	kind: Secret
	metadata:
	name: ssh-key-secret
	type: Opaque
	EOF
	}

[3u13r]

The nginx deployment still fails with the same error

Events:
  Type     Reason            Age                    From               Message
  ----     ------            ----                   ----               -------
  Warning  FailedScheduling  6m8s                   default-scheduler  0/1 nodes are available: 1 Insufficient memory. preemption: 0/1 nodes are available: 1 No preemption victims found for incoming pod.
  Normal   Scheduled         5m59s                  default-scheduler  Successfully assigned default/nginx-56bf5648cd-8dbfc to aks-default-34657868-vmss000000
  Normal   Pulled            4m34s                  kubelet            Successfully pulled image "nginx" in 4.268s (4.268s including waiting)
  Normal   Pulled            2m31s                  kubelet            Successfully pulled image "nginx" in 746ms (747ms including waiting)
  Warning  Failed            2m21s                  kubelet            Error: failed to create containerd task: failed to create shim task: ttrpc: closed: unknown
  Warning  BackOff           2m20s (x2 over 2m21s)  kubelet            Back-off restarting failed container nginx in pod nginx-56bf5648cd-8dbfc_default(9c8eca10-1358-437c-929b-ca5c6ba4adaf)
  Normal   Pulling           2m5s (x3 over 4m38s)   kubelet            Pulling image "nginx"
  Normal   Pulled            2m4s                   kubelet            Successfully pulled image "nginx" in 797ms (797ms including waiting)
  Normal   Created           2m2s (x3 over 4m28s)   kubelet            Created container nginx
  Warning  Failed            15s (x2 over 3m51s)    kubelet            Error: failed to create containerd task: failed to create shim task: Could not send CopyFile request: Dead agent: unknown
  Normal   SandboxChanged    15s (x2 over 3m50s)    kubelet            Pod sandbox changed, it will be killed and re-created.

but the openssl deployments are in the expected state (policy rejected).

[3u13r]

Suggested change

	expectedConfAKSPEERSNP []byte
	expectedConfAKSPeerSNP []byte