Remove cert and pem enforcement

[imthaghost]

Overview

Some users didn't find it necessary for Vault to enforce the CA cert or PEM keys. Examples can be found in the related issues.

Design of Change

We add false booleans to the kubernetes_ca_cert and pem_keys fields. While the required field on the FieldSchema struct are deprecated we added this just for future reference and documentation. We also remove checks that enforced kubernetes_ca_cert to be present instead we just default to the local CA cert if kubernetes_ca_cert is not set which will return an error of x509: certificate signed by unknown authority if the user did supply an appropriate CA cert.

Related Issues

Issue #62
Issue #88

Docs

I don't believe docs need to be added since this is implied in the example below.

[tomhjp]

Please can we get some unit test coverage? It's harder to test in an automated way, but I'd also like to ensure we at least manually test using the OS trust store. LMK if you'd like any help with that and I can go into more detail.

[tvoran]

Is this test different than "no CA or JWT, default to local" in TestConfig_LocalCaJWT()? IIRC disable_local_ca_jwt defaults to false, and kubernetes_ca_cert defaults to "".

vault-plugin-auth-kubernetes/path_config_test.go

Lines 361 to 375 in a0dfafe

	"no CA or JWT, default to local": {
	config: map[string]interface{}{
	"kubernetes_host": "host",
	},
	setupInClusterFiles: true,
	expected: &kubeConfig{
	PublicKeys: []interface{}{},
	PEMKeys: []string{},
	Host: "host",
	CACert: testLocalCACert,
	TokenReviewerJWT: testLocalJWT,
	DisableISSValidation: true,
	DisableLocalCAJwt: false,
	},
	},

[tomhjp]

How come we don't use system certs if disableLocalJWT is true?

[tomhjp]

This is a more idiomatic check for empty strings:

Suggested change

	if disableLocalJWT || len(caCert) > 0 {
	if disableLocalJWT || caCert != "" {

[rinormaloku]

@imthaghost and @tomhjp can we merge this?