Define certKeyBitSize and serviceCertValidityDuration certificate settings in the MeshRootCertificate

[jaellio]

Please describe the Improvement and/or Feature Request

Part of #4502 Dependent on #4710

I propose removing the spec.certificate fields from the OSM MeshConfig CRD and specifying the settings in the MeshRootCertificate CRD. This change would combine all OSM certificate settings into a single resource. A new version of the MeshConfig CRD, v1alpha3, would be created.

Changes to the new fields in the MeshRootCertificate resource would not trigger a root certificate rotation or modify the resource's status. OSM would watch for changes to these fields and make updates accordingly.

High-level changes:

• support conversion between v1alpha2 <-> v1alpha3 versions of the osm MeshConfig
• update MeshRootCertificate CRD and MRC types
• watch new MRC fields

Scope (please mark with X where applicable)

• New Functionality [x]
• Install [x]
• Certificate Management [x]

[steeling]

we also need to add the Vault Port to the VaultSpec

[jaellio]

Should changes to certKeyBitSize and serviceCertValidity duration cause all existing, non-expired certificates to be rotated or should it only be updated for all future certs?

[steeling]

Hmm good question!

I was actually surprised to see that we don't use certKeyBitSize for the CA generation for tresor. If we switch that, then that means a certKeyBitSize change for tresor would require a full rotation of the CA.

The other certificate manager's don't face that problem. From a user perspective, if I made those changes, I would expect them to occur sooner than later, but I think it's a subjective answer, and we have some freedom to make a choice here!

[jaellio]

This is a nice to have for v1.3 but not a requirement. Removing from v1.3 milestone.

[github-actions[bot]]

This issue will be closed due to a long period of inactivity. If you would like this issue to remain open then please comment or update.

[github-actions[bot]]

This issue will be closed due to a long period of inactivity. If you would like this issue to remain open then please comment or update.

[github-actions[bot]]

Issue closed due to inactivity.