Derive load balancer IP from manually provisioned certificates

[nightkr]

(For other SBLE staff, see https://stackable.atlassian.net/browse/SUP-187)

Currently, we support nudging NodePort services onto Nodes that have certificates provisioned, but we don't support anything similar for LoadBalancer services. That can make them difficult to use for short-lived listeners (like Kafka broker (non-bootstrap) listeners) if you require manually provisioned certificates.

[nightkr]

As a workaround, Kubernetes can be configured to avoid deleting the Listener object by attaching a secondary owner beyond the PVC:

kubectl create configmap simple-kafka-broker-listener-owner
for listener in simple-kafka-broker-default-{0..2}-listener-broker; do
  kubectl get listener/$listener -o json \
    | jq '.metadata.ownerReferences += [$owner | {apiVersion, kind, name: .metadata.name, uid: .metadata.uid}]' \
      --argjson owner "$(kubectl get cm/simple-kafka-broker-listener-owner -o json)" \
    | kubectl replace -f-
done

When doing this, don't use a SDP-managed resource (like a KafkaCluster) as the owner, since SDP operators will delete any child objects that it doesn't recognize as having created.