BUG/MINOR: kubernetes-ingress: gate PSP Role and RoleBinding on k8s < 1.25 (#384)

The PodSecurityPolicy template is gated behind a semverCompare "<1.25.0-0"
check, but the Role and RoleBinding that grant "use" on it were only gated
on rbac.create and podSecurityPolicy.enabled. On Kubernetes 1.25 and newer
the chart therefore rendered a Role referencing the policy/podsecuritypolicies
resource, plus its RoleBinding, while the PodSecurityPolicy itself was
correctly omitted.

RBAC rules are not validated against discovery, so these objects applied
without error and were merely dead configuration, but they referenced an API
removed in 1.25 and made podSecurityPolicy.enabled=true look effective on
clusters where it can no longer do anything.

Add the same version gate to both templates so all three objects appear and
disappear together. Verified by rendering with --kube-version: PodSecurityPolicy,
Role and RoleBinding are all present on 1.23 and 1.24, and all absent on 1.25,
1.37 and provider-suffixed versions such as v1.37.1-gke.1000.

Signed-off-by: Dinko Korunic <dkorunic@haproxy.com>

Author: dkorunic

kubernetes-ingress/Chart.yaml

@@ -16,7 +16,7 @@ apiVersion: v2
 name: kubernetes-ingress
 description: A Helm chart for HAProxy Kubernetes Ingress Controller
 type: application
-version: 1.54.1
+version: 1.54.2
 appVersion: 3.2.15
 kubeVersion: ">=1.23.0-0"
 keywords:
@@ -39,4 +39,4 @@ annotations:
     - name: support
       url: https://github.com/haproxytech/helm-charts/issues
   artifacthub.io/changes: |-
-    - Use Ingress Controller 3.2.15 version for base image
+    - Do not render the PodSecurityPolicy Role and RoleBinding on Kubernetes 1.25 and newer

kubernetes-ingress/templates/controller-role.yaml

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */}}
 
-{{- if and .Values.rbac.create .Values.podSecurityPolicy.enabled -}}
+{{- if and (semverCompare "<1.25.0-0" .Capabilities.KubeVersion.Version) .Values.rbac.create .Values.podSecurityPolicy.enabled -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:

kubernetes-ingress/templates/controller-rolebinding.yaml

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */}}
 
-{{- if and .Values.rbac.create .Values.podSecurityPolicy.enabled -}}
+{{- if and (semverCompare "<1.25.0-0" .Capabilities.KubeVersion.Version) .Values.rbac.create .Values.podSecurityPolicy.enabled -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata: