Support auto-generating required CAs for amphora

[Nobuto Murata]

I though this was requested before, but I couldn't find it so filing it here.

As per the documentation, we need to generate two sets of custom CA for Amphora provider. Since we need to pass blanket CAs anyway, there is no deployment specific input is required to generate those.
https://opendev.org/openstack/charm-octavia#amphora-provider-required-configuration

It would be nice if it's fully automated in the charm itself or with an relation to Vault.

[Frode Nordahl (fnordahl)]

Triaging this as wishlist because it is a request for a new feature, that should not be used as a gauge for prioritization of how important that feature is.

The charm itself should not take on the responsibility of managing secrets or life cycle of the CA certificates.

What we would need to do to support this is to extend the Vault charm and its relations with support for issuing CA certificates with attributes and chain of trust appropriate for the use case.

The upstream Octavia documentation [0] recommends using CAs from different chain of trust to avoid a situation where a compromised amphora could impersonate the controller. And this of course complicates the requirements for this feature.

0: https://docs.openstack.org/octavia/latest/admin/guides/certificates.html