Context:

pki generation is currently implemented by the hcp controller at creation time "statically", there's no rotation mechanism in place.

As part of decoupling the machine config lifecycle from the hcp we need it to be able to generate new certs for new machine config servers.
 
DoD:
 
If a component we own needs a certificate of any kind, that certificate should be expressed declaratively (as a cert request?) and then referenced in terms of the outcome of that request 
The actual certificate generation/issuance is a concern outside hypershift itself.
Consider https://cert-manager.io/docs