[Spike] Evaluate recert for CRC

[praveenkumar]

recert is a tool to regenerate all cryptographic objects in a cluster (both in the etcd database and filesystem files) before it starts.

This spike is to evaluate this tool for CRC and see if we can consume it without compromising around our start up time and overall cluster stability.

[praveenkumar]

We looked into recert and the way we can consume it to have this binary as part of the bundle creation and then it should be run before the kubelet service and the cert expire date is not set explicitly and in our case we are patching the images for 1 year of cert expire and it worked till now.

Also I though we can also avoid creating a custom kubeconfig as part of crc post cluster start but that was not possible that moment (need to check if that is changed now)

[cfergeau]

we are patching the images for 1 year of cert expire and it worked till now.

It's been working so far, but this means we have non-official builds in our cluster, we need to maintain the build scripts, ...
Moving to something provided by upstream/OpenShift is an improvement from that perspective.
Then it has to work for our needs, it should not slow down cluster startup, ...

[praveenkumar]

We looked into recert and the way we can consume it to have this binary as part of the bundle creation and then it should be run before the kubelet service and the cert expire date is not set explicitly and in our case we are patching the images for 1 year of cert expire and it worked till now.

Also I though we can also avoid creating a custom kubeconfig as part of crc post cluster start but that was not possible that moment (need to check if that is changed now)

[cfergeau]

we are patching the images for 1 year of cert expire and it worked till now.

It's been working so far, but this means we have non-official builds in our cluster, we need to maintain the build scripts, ...
Moving to something provided by upstream/OpenShift is an improvement from that perspective.
Then it has to work for our needs, it should not slow down cluster startup, ...