refactor(mariadb): switch CA and leaf private keys to ECDSA P-256

ECDSA P-256 keys offer equivalent or better security than RSA-4096 with
significantly smaller key material and faster handshake operations. Both
CA and leaf certificates are updated; existing rotation policies are
preserved (Never for CA, Always for leaf).

Note: cert-manager will re-issue both CA and leaf on next reconcile.
Existing trust anchors that pin the CA cert will break; tenants must
refresh their ca.crt after upgrading.

Assisted-by: LLM
Signed-off-by: Arsolitt <arsolitt@gmail.com>

packages/apps/mariadb/templates/certmanager.yaml

@@ -29,8 +29,8 @@ spec:
     group: cert-manager.io
   privateKey:
     rotationPolicy: Never
-    algorithm: RSA
-    size: 4096
+    algorithm: ECDSA
+    size: 256
   # CA usages: signing + cert sign (issuing leaf certs) + crl sign (RFC 5280)
   usages:
     - signing
@@ -83,8 +83,8 @@ spec:
     {{- end }}
   privateKey:
     rotationPolicy: Always
-    algorithm: RSA
-    size: 4096
+    algorithm: ECDSA
+    size: 256
   issuerRef:
     name: {{ .Release.Name }}-ca
     kind: Issuer

packages/apps/mariadb/tests/tls_test.yaml

@@ -714,3 +714,62 @@ tests:
       - contains:
           path: spec.dnsNames
           content: "*.my-mariadb-internal"
+
+  # -------------------------------------------------------------------
+  # ECDSA: CA and leaf use ECDSA P-256
+  # Smaller keys, faster handshakes, stronger per-bit security than RSA.
+  # rotationPolicy preserved: Never for CA, Always for leaf.
+  # -------------------------------------------------------------------
+  - it: "CA cert uses ECDSA P-256 algorithm"
+    templates:
+      - templates/certmanager.yaml
+    set:
+      tls:
+        enabled: true
+    documentIndex: 1
+    asserts:
+      - equal:
+          path: spec.privateKey.algorithm
+          value: ECDSA
+      - equal:
+          path: spec.privateKey.size
+          value: 256
+
+  - it: "leaf cert uses ECDSA P-256 algorithm"
+    templates:
+      - templates/certmanager.yaml
+    set:
+      tls:
+        enabled: true
+    documentIndex: 3
+    asserts:
+      - equal:
+          path: spec.privateKey.algorithm
+          value: ECDSA
+      - equal:
+          path: spec.privateKey.size
+          value: 256
+
+  - it: "CA cert rotationPolicy is Never (ECDSA)"
+    templates:
+      - templates/certmanager.yaml
+    set:
+      tls:
+        enabled: true
+    documentIndex: 1
+    asserts:
+      - equal:
+          path: spec.privateKey.rotationPolicy
+          value: Never
+
+  - it: "leaf cert rotationPolicy is Always (ECDSA)"
+    templates:
+      - templates/certmanager.yaml
+    set:
+      tls:
+        enabled: true
+    documentIndex: 3
+    asserts:
+      - equal:
+          path: spec.privateKey.rotationPolicy
+          value: Always