Certificate management & usage

[ahrtr]

Refer to the high level design.

Tasks breakdown

• Mount secrets into etcd PODs
  From etcd POD perspective, it doesn't care about how the secrets/certificates are generated, it just mounts the secret and use the certificates directly.
  • Extend the CRD definition to include certificate, similar to Issue certifcates for etcd-operator #9 (comment)
  • Update reconciliation workflow to mount the secrets into etcd POD. Blocked by the reconciliation work.
  • Users are supposed to get the secretes/certificates prepared before creating etcd clusters. We need to clearly document this.
    • Users can manually create & manage the secrets & certificates themselves.
    • etcd-operator can try to implement some utilities to manage secrets & certificates (see next section)
• etcd-operator supports certificate management
  • Define an interface, so that users can extend or integrate their own certificate service with the etcd-operator.
    • Note etcd-operator's priority is to simplify & automate the management of the etcd clusters instead of certificate management.
  • Implement some simple certificate management utilities for testing purpose,
    • i.e. supporting auto self-signed certificate.
  • Investigate some best practice & popular certificate issuers to handle certificate management, and decide the next step.