fix(kube-rbac-proxy): force quay image on operator helm releases

[unni-facets]

Why

gcr.io/kubebuilder/kube-rbac-proxy is deprecated. GCR images are unavailable from 2025-03-18 (kubebuilder#3907); affected pods hit ImagePullBackOff. Reported in #customer-issues.

What

Override the proxy image → quay.io/brancz/kube-rbac-proxy:v0.13.1 on the operator helm_release resources, injected via the values list (yamlencode), not a set{} block:

• Same convention already used in these callers.
• Agnostic to the helm provider set syntax (block in 2.x → list attribute in 3.x).
• Placed before user_supplied_helm_values, so a user override still wins, while overriding the chart's gcr default regardless of the pinned chart version.

Files:

• modules/database_operator/default/0.1/main.tf
• modules/mongodb_auth_operator/default/0.1/main.tf (defensive — chart values already quay)

Notes

• Chart source-of-truth fix is in the helm-charts PR; the in-place patch for already-running workloads is migration 113 in the facets-iac PR.

Summary by CodeRabbit

• Bug Fixes
  • Updated the database and MongoDB auth operators to use the explicitly specified kube-rbac-proxy image repository and tag.
  • Improves reliability by ensuring operator deployments consistently use the supported container image rather than chart defaults.

[coderabbitai]

Walkthrough

Both operator Terraform modules now override the Helm chart’s kube-rbac-proxy image repository and tag with quay.io/brancz/kube-rbac-proxy:v0.13.1, while allowing user-supplied Helm values to override the injected settings.

Changes

Operator image overrides

Layer / File(s)	Summary
Pin kube-rbac-proxy images modules/database_operator/default/0.1/main.tf, modules/mongodb_auth_operator/default/0.1/main.tf	Both helm_release resources explicitly set the kube-rbac-proxy image repository and tag to quay.io/brancz/kube-rbac-proxy and v0.13.1 before user-supplied Helm values.

Suggested reviewers: anshulsao

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title accurately summarizes the main change: forcing the kube-rbac-proxy image on operator Helm releases.
Description check	✅ Passed	The description covers the motivation, change details, affected files, and context, but omits several template sections like testing and related issues.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/kube-rbac-proxy-gcr

---

_{Comment @coderabbitai help to get the list of available commands.}