Remove the experimental.cert-manager.io/ca annotation from CertificateSigningRequests

[JoshVanL]

CertificateSigningRequests do not have a status.CA field. To account for this, we add an experimental.cert-manager.io/ca annotation on signed CertificateSigningRequests which include the base64 encoded CA certificate.

The status of a CertificateSigningRequest is a subresource, and as such, a separate API endpoint to the main object. In practice this means that when updating a CertificateSigningRequest with the signed certificate and CA, we have to make 2 API calls. An edge case can occur whereby the 2nd API call fails, causing the the second API call to never happen:

1. Update status.Certificate
2. Fail to set CA certificate
3. CA certificate cannot be retrieved on the next sync, and is never set.

The status.Certificate field must be set first, otherwise when the annotation is updated, a re-sync would immediately occur and a second issuance would happen.

Other mitigations considered:

• Clients using cert-manager signers could be made aware of this edge case. If a request was signed, but the CA field was never set, the client could have requested another certificate after a timeout.
• Add the CA to status.Certificate. This is generally a bad idea as clients in practice do not expect the CA to be present in this chain. There would need to be some middleware to extract it out, causing lots of headaches.

Path forward:
A mechanism for sharing the signer's CA falls under the "trust distribution" feature. Until cert-manager has some mechanism for "trust distribution", clients are suggested to find other means. Kubernetes and istio have success with a controller populating a well-known configmap in all namespaces.

---

I have updated the website PR by removing reference to this annotation.

---

This is a breaking change however is fine, since this is an alpha API and under the "experimental" group. This group has fair warning that behaviour and API is subject to change.

Regression: CertificateSigningRequests will no longer have a `experimental.cert-manager.io/ca` annotation set.

[SgtCoDFish]

This looks great. I've not run it locally because I feel like the existing e2e tests cover this well; I think it's good to go as-is.

/lgtm

[jetstack-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: JoshVanL, SgtCoDFish

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [JoshVanL,SgtCoDFish]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment