EnsureCertificate creates a namespace/name Secret for subject signed by the CA in the mtlsCASecretNamespace/mtlsCASecretName Secret, or does nothing if a namespace/name Secret is already present.

GetManagedLabelForServiceSecret returns a label selector for the ServiceSecret.

IsTLSSecretValid checks if a Secret contains a valid TLS certificate and key.