Handle certificate rotation

[skitt]

Epic Description

We want to enable certificate rotation, especially for accessing the broker. Rotated certificates will need to be propagated somehow, or we’ll need to find some other (secure) way of authenticating and authorising access to the broker. This will have to include broker-info.subm files — we want subctl join to be possible throughout the lifetime of a broker.

Acceptance Criteria

• Broker certificates are automatically rotated
• Connected clusters suffer no disruption
• subctl join continues working with broker-info.subm files produced during initial broker deployment (but not necessarily with an older version of subctl); any additional requirements are documented

Definition of Done (Checklist)

• Code complete
• Relevant metrics added
• The acceptance criteria met
• Unit/e2e test added & pass
• CI jobs pass
• Deployed using cloud-prepare+subctl
• Deployed using ACM/OCM addon
• Deploy using Helm
• Deployed on supported platforms (for e.g kind, OCP on AWS, OCP on GCP)
• Run subctl verify, diagnose and gather
• Uninstall
• Troubleshooting (gather/diagnose) added
• Documentation added
• Release notes added

Work Items

• The operator needs to refresh broker tokens periodically submariner-operator#1673
• Broker credentials should be made available as a mounted secret admiral#301
• Broker credentials should be made available as a mounted secret submariner-operator#1685
• subctl gather needs to be able to access the broker without credentials from the Submariner CR subctl#53
• Handle secrets for broker access lighthouse#657

[skitt]

Migrated to https://issues.redhat.com/browse/ACM-3280.