Charm should handle transition to HA during deployment

[Cory Johns]

The currently recommended instructions for deploying Vault as HA requires easyrsa to provide certs for etcd even if Vault is intended to be the primary cert provider.

Having tested and confirmed working bringing Vault up in single-node configuration and then transitioning to HA after etcd has its certs in place (see https://github.com/charmed-kubernetes/kubernetes-docs/pull/207), it seems entirely reasonable to expect the charm to manage this transition automatically when brought up in a fully HA mode.

It should be able to function in single-node mode and defer enabling HA until etcd has its certs, which should only take a moment. Alternatively, it has been discussed that the data stored in etcd isn't actually sensitive and could be allowed to be sent over a non-TLS connection to etcd, but that might require changes to the etcd charm to work and seems less ideal.

[Cory Johns (johnsca)]

Forgot to link to current docs recommending using easyrsa alongside Vault: https://docs.openstack.org/project-deploy-guide/charm-deployment-guide/latest/app-vault.html#enabling-ha