Add Cluster-wide Certificates Refresh

[mateoflorido]

Overview

Add a proposal for implementing a cluster-wide certificates refresh in the Canonical Kubernetes providers

[HomayoonAlimohammadi]

Thanks a lot @mateoflorido! Something that I wonder is that do we have a retry mechanism on the single machine certs refresh reconciler? If that's the case, then you might need to consider the problem that we already have with the in-place upgrade reconcilers.
In short, currently the single machine in-place upgrade reconciler retries by removing the status annotation on a machine without removing the upgrade instructions, which in a sense reverts everything back to a state that looks like a fresh upgrade command has been triggered. This can cause some confusions on the higher level which is the MachineDeploymentReconciler.
There are workarounds for that tho, and I'm currently going for the one that I consider the best (adding a new annotation).

[berkayoz]

LGTM, great work left a small comment.

[bschimke95]

LGTM, great proposal @mateoflorido

[mateoflorido]

Thanks a lot @mateoflorido! Something that I wonder is that do we have a retry mechanism on the single machine certs refresh reconciler? If that's the case, then you might need to consider the problem that we already have with the in-place upgrade reconcilers. In short, currently the single machine in-place upgrade reconciler retries by removing the status annotation on a machine without removing the upgrade instructions, which in a sense reverts everything back to a state that looks like a fresh upgrade command has been triggered. This can cause some confusions on the higher level which is the MachineDeploymentReconciler. There are workarounds for that tho, and I'm currently going for the one that I consider the best (adding a new annotation).

Great, we should consider this approach when we implement the proposal. Thanks, @HomayoonAlimohammadi!

[bschimke95]

Let's change to accepted and merge the proposal.