feat: Add FQDNs to the subject DNs of TLS certificates

[siegfriedweber]

Description

Add FQDNs to the subject DNs of TLS certificates

Part of stackabletech/secret-operator#617

Definition of Done Checklist

• Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
• Please make sure all these things are done and tick the boxes

Author

• Helm chart can be installed and deployed operator works
• Integration tests passed: feat: Add FQDNs to the subject DNs of TLS certificates #972 (comment)
• Links to generated (nightly) docs added
• Release note snippet added: feat: Add FQDNs to the subject DNs of TLS certificates #972 (comment)

Reviewer

• Code contains useful comments
• Code contains useful logging statements
• (Integration-)Test cases added
• Documentation added or updated. Follows the style guide.
• Changelog updated
• Cargo.toml only contains references to git tags (not specific commits or branches)

Acceptance

• Feature Tracker has been updated
• Proper release label has been added
• Links to generated (nightly) docs added
• Release note snippet added
• Add type/deprecation label & add to the deprecation schedule
• Add type/experimental label & add to the experimental features tracker

[NickLarsenNZ]

LGTM.

One of the issues needs a release-note and label (maybe the action required one?)

[siegfriedweber]

With VECTOR_AGGREGATOR set:

--- PASS: kuttl (2133.45s)
    --- PASS: kuttl/harness (0.00s)
        --- PASS: kuttl/harness/kerberos_kafka-3.9.2_zookeeper-latest-3.9.5_openshift-false_krb5-1.21.1_kerberos-realm-PROD.MYCORP_kerberos-backend-mit_broker-listener-class-cluster-internal_bootstrap-listener-class-external-unstable (168.84s)
        --- PASS: kuttl/harness/operations-kraft_kafka-kraft-4.2.1_openshift-false (618.58s)
        --- PASS: kuttl/harness/tls_kafka-3.9.2_zookeeper-latest-3.9.5_use-client-tls-true_use-client-auth-tls-true_openshift-false (171.34s)
        --- PASS: kuttl/harness/smoke_kafka-3.9.2_zookeeper-3.9.5_use-client-tls-true_openshift-false (111.44s)
        --- PASS: kuttl/harness/opa_kafka-latest-3.9.2_zookeeper-latest-3.9.5_opa-latest-1.16.2_use-opa-tls-true_openshift-false_krb5-1.21.1 (221.36s)
        --- PASS: kuttl/harness/smoke-kraft_kafka-kraft-4.2.1_openshift-false (393.11s)
        --- PASS: kuttl/harness/delete-rolegroup_kafka-3.9.2_zookeeper-latest-3.9.5_openshift-false (69.17s)
        --- PASS: kuttl/harness/cluster-operation_kafka-latest-3.9.2_zookeeper-latest-3.9.5_openshift-false (85.74s)
        --- PASS: kuttl/harness/upgrade_upgrade_old-3.9.2_upgrade_new-4.2.1_use-client-tls-true_use-client-auth-tls-true_openshift-false (118.09s)
        --- PASS: kuttl/harness/logging_kafka-3.9.2_zookeeper-latest-3.9.5_openshift-false (152.17s)
        --- PASS: kuttl/harness/configuration_kafka-latest-3.9.2_openshift-false (23.60s)

[siegfriedweber]

Release notes

Platform improvements

Kafka

The FQDNs are now set in the Subject DNs of the certificates of the Kafka pods, see https://docs.stackable.tech/home/stable/kafka/usage-guide/security/#_authorization. OPA Rego rules can now check these FQDNs. Existing OPA rules may need to be adjusted.

[NickLarsenNZ]

LGTM