API change to icinga2 CA as default

[lbetz]

The class icinga2::feature::api uses the Puppet Cert as default. We change it to icinga2.

[baurmatt]

Is there a specific reason why this was done? Puppet certs was IMHO easier to set up.

[dnsmichi]

Re-using the Puppet CA for a different application implies a security problem in some scenarios with opening the matter of trust to Puppet and Icinga. Agreed on the easiness, but security matters these days and we should follow best practices imho.

[lbetz]

Michi is right of course. With the certificate from puppet you're able to get a catalog, maybe with passwords.

[baurmatt]

Thanks for explaining your decision, that's everything i wanted ;)