Ratchet down CA lifetimes

[nightkr]

We used to hard-code CA durations to 2 years, because we didn't have a way to rotate them, and we didn't have a way to override it. These days both of these have been addressed (#93, #354), so there's no reason anymore to keep it as ridiculously long. As a starting point, a week should be more than plenty, but in that case we would also need to reduce the default maxCertificateLifetime.

/cc @sbernauer

Tasks

Beta Give feedback

1. chore: Reduce CA default lifetime to 1 year #403
   0 of 9
   release/2024-07 +1
   
2. docs: Add note about current default CA lifetime #441
   0 of 9
   +0
   
3. Blog Post (Optional)
4. Follow-up issue for further reduction

[sbernauer]

Happy to reduce it to something less than 2 years, but would prefer >= 15 days or even >= 31 days. Let's have a discussion (in e.g. Arch meeting)

[lfrancke]

I made the decision to move it to 1 year for the 24.3 release together with release notes and maybe a blog post announcing our future plans of lowering this even further.

We need documentation on what it means and an FAQ or something similar on what it means

[lfrancke]

Refinement by Nick, Sascha

[NickLarsenNZ]

Does this require anything more than just setting the default CA lifetime?

[lfrancke]

Documentation and potentially a blog post outlining our policy going forward but that's optional.
And a follow-up issue.

But in general I had hoped that this is going to be a simple thing, yes.

[NickLarsenNZ]

@lfrancke, what kind of documentation do you mean? I assume you mean on the docs site. Just need to know at least one of the following:

1. Where in the navigation hierarchy?
2. To what extent does it need documenting?

I can probably figure it out from there.

[lfrancke]

It is still not very common to have short lifetimes for certificates and I think we should document it somewhere.
Not sure what the best place would be. @fhennig

I don't think it needs much. Just a paragraph about our certificate handlind.

[fhennig]

The Secret operator could use a bit more docs in general. There isn't really a section about it being able to do TLS certs, there isn't a good landing page. Maybe I'd just stick it in the Usage page or the 'Security' page.

[NickLarsenNZ]

The Secret operator could use a bit more docs in general. There isn't really a section about it being able to do TLS certs, there isn't a good landing page. Maybe I'd just stick it in the Usage page or the 'Security' page.

I have read both, and Usage seems most suitable. I'll update the task list in the description.