ca.crt should be added in an independent secret

[alinadonisa]

Move ca.crt in the another secret, so it can be mounted independently of the node.crt.

[keith-mcclellan]

No, we do not want to move ca.crt to the same secret as the ca.key, we need to create a cockroach.ca-crt secret that only includes the ca.crt. No one other than a user minting a new certificate should ever be mounting ca.key

[alinadonisa]

@keith-mcclellan this means we will have 4 secrets, right?

[keith-mcclellan]

yes. We don't want to remove ca.crt from the node and client secrets, just have a 4th secret that only has the ca.crt. Thanks