The image-reflector controller now accepts a secret containing a client certificate and key, and/or a CA certificate; so it's useful to have a command for creating them. `flux create secret helm` is close, but accepts username/password (which would be ignored), and has the wrong name of course. Happily though, much can be shared between the implementations. Signed-off-by: Michael Bridgen <michael@weave.works>