K8SSAND-1369 ⁃ Certificate rotation for cass-operator

[Miles-Garnsey]

What is missing?

CA certificates cannot currently be rotated without downtime for cass-operator deployed clusters.

We should enable the injection of both old and new certificates during a grace period so that CAs can be rotated smoothly.

┆Issue is synchronized with this Jira Task by Unito ┆friendlyId: K8SSAND-1369 ┆priority: Medium

[jsanda]

Hey team! Please add your planning poker estimate with ZenHub @burmanm @Miles-Garnsey

[Miles-Garnsey]

This one is relatively complex and may benefit from a preliminary research ticket. Estimates are as follows:

• 2 days on design work to determine how this needs to work and socialise (as there are a few options and the design doc has not been approved+merged.)
• 4 days to implement a layer of indirection so that a change to the certificates triggers a copy of the existing encryption materials before commencing rotation.
• 4 days to implement features relating to injecting encryption materials into the truststore and combining them.

Note that I've put estimates at the higher end of the range here but I think they will be roughly accurate once we account for the need for some nuanced test cases.

[burmanm]

This work was superseded by other CA work.