Automatically rotate certificates

[gdemonet]

Component: salt, kubernetes

Why this is needed:

Because certificates have an expiration date, and services depend on them.

See: https://twitter.com/eikke/status/1131194207920640007

What should be done:

Watch certificates TTL and automatically renew them when required (expiration in less than 7 days).
Some certificates are embedded in kubeconfig files, so special care will need to be taken around them.
Some components may need to be restarted after certficates are updated, so we will also need to make sure this is properly triggered if required.

Implementation proposal (strongly recommended):

• Use a beacon to watch certificates (list of certificates to watch will be defined in roles pillar)
• Send an event to renew a certificate when close to expiry (<7 days)
• Use a reactor to react to "renew-cert" events (the state to run depends on the certificate, mapping will be stored in pillar as well)

Test plan:

Add a test to:

• Generate a certificate with less than 7 days TTL
• Manually trigger the beacon
• Observe the certificate was renewed

[NicolasT]

Ref #2208 and #1887

[gdemonet]

Closing in favor of #1887