docs make kubernetes_ca_cert optional on kubernetes auth

[thyton]

update kubernetes auth docs and api-docs to indicate

• kubernetes_ca_cert field optional
• the host's root CA set is used for TLS when kubernetes_ca_cert is not provided and disable_local_ca_jwt is true if running Vault in a Kubernetes pod.

[github-actions]

CI Results:
All Go tests succeeded! ✅

[github-actions]

Build Results:
All builds succeeded! ✅

[benashz]

Which behavior are you referring to?

[thyton]

I'm referring to the behavior of kubernetes_ca_cert defaulting to the local CA cert if Vault is running a Kubernetes pod from the previous paragraph.

vault/website/content/api-docs/auth/kubernetes.mdx

Lines 67 to 70 in 77142a9

	If Vault is running in a Kubernetes Pod, the `kubernetes_ca_cert` and
	`token_reviewer_jwt` parameters will automatically default to the local CA cert
	(`/var/run/secrets/kubernetes.io/serviceaccount/ca.crt`) and local service
	account JWT (`/var/run/secrets/kubernetes.io/serviceaccount/token`).

I can reiterate to make it clearer here. Let me know your thought.

Suggested change

	If this behavior is disabled by setting `disable_local_ca_jwt` to `true`,
	If `kubernetes_ca_cert` defaulting to the local CA cert is disabled by setting `disable_local_ca_jwt` to `true`,

[schavis]

Suggested change

	- `kubernetes_ca_cert` `(string: "")` - Optional PEM encoded CA cert for use by the TLS client used to talk with the Kubernetes API.
	NOTE: Every line must end with a newline: `\n`
	- `kubernetes_ca_cert` `(string: "")` - Optional PEM encoded CA cert. The TLS
	client can use the cert to talk with the Kubernetes API. **Every line in the
	cert file must end with a newline character (`\n`) rather than a carriage
	return (`\r`)**.

Added an assumed clarification re: newline vs carriage return, but it prompted a question: do we read CRLF as ending in a newline (\r\n)? Or must it be explicitly LF (\n)?
Style correction: active voice

[thyton]

I've tested locally. Ending each line in kubernetes_ca_cert with \r\n fails vault-plugin-auth-kubernetes unit tests. Therefore, it must be explicitly LF \n.

Wondering if we should preserve the old NOTE's content and drop "rather than a carriage return (\r)" for simplicity.

[schavis]

Suggested change

	If not set and `disable_local_ca_jwt` set to true, the system's trust store will be used.
	If `kubernetes_ca_cert` is unset and `disable_local_ca_jwt` is `true`, Vault uses the Kubernetes trust store.

What is "the system" in "the system's trust store"? Is it Vault or Kubernetes? (I made an entirely uninformed guess for the sake of editing to provide an example of what I would suggest)

[thyton]

"the system" here is:

• the operating system if Vault is running on a machine
• the container operating system if Vault is running in a container

[thyton]

Is it Vault or Kubernetes?

Vault (specifically, the TLS client of the Vault plugin) will use the system's trust store for certificate verification.

[thyton]

Thank you both for the suggestions!