fix: share frontend development certificates

[grolu]

How to categorize this PR?

/area dev-productivity
/kind bug
/label crypto

What this PR does / why we need it:
Frontend development certificates are currently stored inside each repository checkout. Each checkout therefore generates a different CA with the same name and replaces the trusted macOS keychain entry, potentially invalidating certificates from other local Dashboard repositories.

This change stores the certificates under ${HOME}/.gardener/dashboard/ssl, allows overriding the directory with GARDENER_DASHBOARD_SSL_DIR, and restricts access to the directory and private keys.

Which issue(s) this PR fixes:
None.

Special notes for your reviewer:
Validated with make verify and targeted certificate-chain, SAN, permissions, and Vite-loading checks. Developers need to run yarn setup once to populate the shared directory.

Release note:

Frontend development TLS certificates generated by `yarn setup` are now shared across local Dashboard repositories.

Summary by CodeRabbit

• Documentation

  • Expanded local development setup instructions for generating TLS certificates.
  • Added details about certificate storage, sharing across local repositories, macOS keychain integration, and the option to skip keychain setup.
  • Documented how to customize the certificate directory.

• Bug Fixes

  • Improved local HTTPS certificate discovery and setup.
  • Enhanced certificate file protection to help keep private keys secure.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f33ecbed-6e3e-4110-8169-24c70825c29a

📥 Commits

Reviewing files that changed from the base of the PR and between b554739 and a8163ce.

📒 Files selected for processing (3)

• docs/development/local-setup.md
• frontend/vite.config.js
• scripts/vite-server-setup.sh

---

📝 Walkthrough

Walkthrough

The local TLS setup now uses a configurable shared certificate directory, defaults to ~/.gardener/dashboard/ssl, applies restrictive permissions, and updates Vite and documentation to use and describe the new location.

Changes

Local TLS certificate flow

Layer / File(s)	Summary
Certificate directory and key permissions scripts/vite-server-setup.sh	The setup script resolves GARDENER_DASHBOARD_SSL_DIR or the dashboard home-directory default, creates the directory securely, and restricts private key permissions.
Vite certificate lookup and setup guidance frontend/vite.config.js, docs/development/local-setup.md	Vite loads certificates from the shared configurable directory, and local setup documentation and warnings describe certificate storage, keychain behavior, and overrides.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the main change: sharing frontend development certificates.
Description check	✅ Passed	The description matches the template and fills the required categorization, purpose, issue, notes, and release note sections.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/shared-frontend-certificates

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[petersutter]

/lgtm
/approve

[gardener-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: petersutter

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [petersutter]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[gardener-prow]

LGTM label has been added.

Details

Git tree hash: 512e6b7b63e49391b42a6d4e9771d9baded59631