Many customers have requested to manage serving certificates for non-core control plane components such as Monitoring server, logging server, console to be configurable with cert-manager generated certificates for integration with corporate CAs/external CAs. 

Today these certificates are managed by the Service CA operator that creates an internal CA which provides the serving certs to monitoring or logging operator. See https://docs.openshift.com/container-platform/4.13/security/certificate_types_descriptions/service-ca-certificates.html 

The goal of this Spike is to investigate how to replace Serving certificates generated internally to those generated by cert-manager, which is a Day 2 Operator. 

Non Goal: Replacing Service CA is a non-goal. We want to understand if its possible to augment what Service CA does, and add a certificate that these services can consume.