Add Certificates Refresh Controller - Control Plane

[mateoflorido]

Important

This implementation depends on the work in canonical/k8s-snap#699

Overview

Create a new controller to handle refresh certificates for control plane nodes running on CAPI.

Rationale

We need to expose the certificate refresh functionality for control plane nodes without requiring a full rollout deployment, which would consume more resources. Instead, we leverage the business logic baked in k8s-snap to refresh the certificates in place, which allows us to refresh the self-signed certificates without the additional overhead or down time in the cluster.

Changes

• Implemented a new Certificates Controller.
• Added logic to annotate machines with the certificate expiration date, enabling the expiry date to bubble up from the node.
• Added functionality to refresh certificates for control plane nodes.
• Increased the default socat timeout (0.5 seconds) to 5 seconds due to latency when creating new certificates.

Further Information

Proposal 003 - #54

[berkayoz]

Great work! Did a first pass and left some comments.