Testing CA Certificate

[shaneutt]

Problem Statement

The cert-manager addon presently provides a default Issuer that provides "self-signed" certificates. Using self-signed certificates presents many challenges and is in general "hacky".

Proposed Solution

Generate an upfront CA Certificate that is used for the duration of a test cluster's lifecycle, and installed as the default issuer.

Acceptance Criteria

• kind and GKE cluster implementations both install the KTF CA on nodes during cluster deployment for container runtime trust
• the cert-manager addon is configured to use the KTF CA as the default Issuer
• the registry addon switches to using a cert signed by the KTF CA to avoid cluster-specific installation of the currently present self-signed cert

[mflendrich]

Closing "won't fix" because of insufficient demand at this moment.