If a node has no registered TLS info, or has TLS info indicating that it was signed by a different CA cert, and the cluster is in the middle of a root rotation, then the root reconciler updates the node info to mark it as needing a rotation.
If a node has no registered TLS info, or has TLS info indicating that it was signed
by a different CA cert, and the cluster is in the middle of a root rotation, then
the root reconciler updates the node info to mark it as needing a rotation.

However, when a node requests a new cert, it will only download the new cert if the
issuance status is ISSUED.  If the root reconciler happens to get to the node
immediately after the CA signs it but before the node downloads it, then the node
will never download it and will poll until timeout, and then request a new certificate
instead.

Since a node only gets marked as ROTATE if it's not already in PENDING, just download
the cert even if the cluster says that the issuance state is ROTATE.  This will cut
short a lot of extra polling before the node gets a new certificate as per the ROTATE
directive.

Signed-off-by: Ying Li <f39392f1e2d21dabc2bc5ab11d2bf832bde87b60@docker.com>

docker/swarmkit,RenaudWasTaken/swarmkit,AliyunContainerService/swarmkit,alyyousuf7/swarmkit,jlhawn/swarmkit,jlhawn/swarmkit,alyyousuf7/swarmkit,sungwonh/swarmkit,dperny/swarmkit-1,Noyan759/swarmkit,docker/swarmkit,sungwonh/swarmkit,diogomonica/swarmkit,dperny/swarmkit-1,RenaudWasTaken/swarmkit,Noyan759/swarmkit,AliyunContainerService/swarmkit,cheyang/swarmkit,cheyang/swarmkit,diogomonica/swarmkit