Ability to use "long lasting" Kubernetes certificates

[sk4zuzu]

By design Kubernetes assumes all newly created certificates have expiration time set to 1 year. There is really no automatic way to overcome that and modify expiration time (kubernetes/kubeadm#1505 (comment)).

What can be done though is:

1. A combination of automatic certificate renewal (https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#automatic-certificate-renewal) and kubelet certificate rotation (https://kubernetes.io/docs/tasks/tls/certificate-rotation/) could be used (after upgrade to 1.18+).

2. Custom certificate authority (https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#custom-certificates) managed by ansible, where we could try ignoring the 1 year requirement (at the cost of decreased security) and set it to arbitrary value.

[toszo]

Consider to backport it to 0.5.x branch

[atsikham]

As another task requires a hotfix, this one is on hold.

[atsikham]

Certificates settings in epiphany's config were refactored and extended, example:

---
kind: configuration/kubernetes-master
title: "Kubernetes Master Config"
name: default
provider: azure
specification:
  advanced:
    certificates:
      location: /etc/kubernetes/pki
      expiration_days: 800
      renew: false

Cases need to be tested 'at least':

• single-master and HA installations
• renew: true and renew:false with different periods, including default
• when certificates are updated, they have the same structure and fields as before update:

# useful commands
* kubeadm alpha certs check-expiration

# certificates location - /etc/kubernetes/pki/
* openssl x509 -in apiserver.crt -text -noout

# certificates embed to config files also participate in update process
* grep 'client-certificate-data' /etc/kubernetes/controller-manager.conf | awk '{print $2}' | base64 -d | openssl x509 -text

• it's possible to renew certs by kubeadm manually: kubeadm alpha certs renew apiserver

[atsikham]

Using openssl_* ansible modules is blocked by #1593.
Draft PR with changes that can be merged only if python-cryptography is installed on target hosts.

These changes can be modified to work without openssl_* modules, with shell.

[przemyslavic]

• single machine, single-master and HA installations have been tested
• tested parameter values: renew: true, renew: false with different periods, including default
• new installations have been tested as well as running epicli apply for the second time after changing parameters