Support client cert auth for agent/broker communication

[qiujian16]

What would you like to be added:
Today submariner agent is using service account token to talk to broker, and user will set the toke directly in operator's CR.

It will be more secure if we can also support other auth mechanism to broker, such as mtls. Maybe we should allow operator CR to reference a secret with kubeconfig and cert/key.

Why is this needed:
We can use other registration mechanism to create csr and rotate certificate, which avoids credential pass across clusters.

[mangelajo]

Can we have more details of how is this implemented? If it allows rotation, etc that'd be a benefit.

[qiujian16]

what we did in open-cluster-management is that we will start a registration agent on the spoke, send csr to hub (broker), one the the hub approves the csr, the agent will use the client cert to generate secret containing kubeconfig that connects to hub.

And example is here https://github.com/qiujian16/addon-framework/blob/main/pkg/manager/controllers/registration/manifests/addon-registration-deployment.yaml.

on the spoke, we will start an agent https://github.com/qiujian16/addon-framework/blob/main/pkg/spoke/controllers/hubclientcert/controller.go like this to generate client cert and rotate the cert.

[stale]

This issue has been automatically marked as stale because it has not had activity for 60 days. It will be closed if no further activity occurs. Please make a comment if this issue/pr is still valid. Thank you for your contributions.

[tpantelis]

bump

[stale]

This issue has been automatically marked as stale because it has not had activity for 60 days. It will be closed if no further activity occurs. Please make a comment if this issue/pr is still valid. Thank you for your contributions.

[skitt]

This is still relevant.

[dfarrell07]

Maybe we should allow operator CR to reference a secret with kubeconfig and cert/key.

This part is done now, thanks to Stephen! 🥳

There's still more we could do, maybe @skitt can provide details.

[dfarrell07]

This was discussed a lot in submariner-io/enhancements#102. We'd love to do it, but need contributor cycles. - PR scrub