Migration path for improved certificate signing in the cluster

[dnsmichi]

Follows #5450

Requirements

We need to ensure that the certificates are copied to LocalStateDir + "/lib/icinga2/certs" during startup. The user must be notified about these changes and encouraged to use the default path.

The ApiListener configuration options will be deprecated thus enforcing the default certificate path

/var/lib/icinga2/certs/<NodeName>.{crt,key}

If the attributes are set, but the path is empty, only a deprecation warning will be logged. Icinga 2 prefers the /var/lib path then.

Tasks

• Deprecate ca_path, cert_path and key_path in the ApiListener object.
• Copy the certificates from pki/ if
  • the files are not in /var/lib
  • the files in pki/ are newer than in /var/lib
• Add log entries when copying the files during startup
• Update node wizard/setup CLI commands to not write ApiListener configuration attributes anymore
• Update documentation

Notes

Instead of a shell script (e.g. prepare-dirs) we have that migration path inside the binary. This makes it easy to migrate Windows clients in the same way like Linux nodes.