canonical
Allow updating CA files at runtime
Currently when using PKI mode the server.ca and ca.crl files must be present at daemon start up.
It is already possible to replace the cluster certificate at runtime via /1.0/cluster/certificate. This writes the cluster certificate to disk and updates the network certificate on the TLS listener (and forwards the request to other cluster members to do the same).
We can improve PKI mode by allowing a similar update of the server.ca and ca.crl files. In particular for the ca.crl, this would allow certificate revocation without restarting LXD.
This can be in the form of a PATCH /1.0/cluster/certificate endpoint which only updates non-empty fields, and includes cluster_key, cluster_cert, cluster_ca, and cluster_crl fields.
