feat: Add FQDNs to the subject DNs of TLS certificates

CHANGELOG.md

@@ -18,13 +18,15 @@ All notable changes to this project will be documented in this file.
   Previously, arbitrary file names were silently accepted and ignored ([#960]).
 - Bump `stackable-operator` to 0.111.1 and snafu to 0.9 ([#960], [#961]).
 - Internal operator refactoring: introduce dereference() and validate() steps in the reconciler ([#968]).
+- BREAKING: Extend the subject DNs of TLS certificates with the FQDNs of the Kafka pods ([#972]).
 - test: Bump vector-aggregator to 0.55.0, replace /graphql call with gRPC call ([#971]).
 
 [#953]: https://github.com/stackabletech/kafka-operator/pull/953
 [#960]: https://github.com/stackabletech/kafka-operator/pull/960
 [#961]: https://github.com/stackabletech/kafka-operator/pull/961
 [#968]: https://github.com/stackabletech/kafka-operator/pull/968
 [#971]: https://github.com/stackabletech/kafka-operator/pull/971
+[#972]: https://github.com/stackabletech/kafka-operator/pull/972
 [#973]: https://github.com/stackabletech/kafka-operator/pull/973
 
 ## [26.3.0] - 2026-03-16

Cargo.toml

@@ -31,4 +31,4 @@ tracing = "0.1"
 
 [patch."https://github.com/stackabletech/operator-rs.git"]
 # stackable-operator = { path = "../operator-rs/crates/stackable-operator" }
-# stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "main" }
+stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "feat/annotation-auto-tls-cert-subject-dn" }

docs/modules/kafka/examples/security/01-setup.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: zookeeper.stackable.tech/v1alpha1
+kind: ZookeeperCluster
+metadata:
+  name: simple-zk
+spec:
+  image:
+    productVersion: 3.9.5
+  servers:
+    roleGroups:
+      default:
+        replicas: 1
+---
+apiVersion: zookeeper.stackable.tech/v1alpha1
+kind: ZookeeperZnode
+metadata:
+  name: simple-kafka-znode
+spec:
+  clusterRef:
+    name: simple-zk

docs/modules/kafka/examples/security/02-authorization-opa.yaml

@@ -0,0 +1,63 @@
+---
+apiVersion: opa.stackable.tech/v1alpha1
+kind: OpaCluster
+metadata:
+  name: simple-opa
+spec:
+  image:
+    productVersion: 1.16.2
+  servers:
+    config:
+      logging:
+        containers:
+          opa:
+            loggers:
+              decision:
+                level: INFO
+    roleGroups:
+      default: {}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-rego-rules
+  labels:
+    opa.stackable.tech/bundle: "true"
+data:
+  kafka.rego: |
+    package kafka
+
+    is_internal_request if input.requestContext.listenerName == "INTERNAL"
+    is_external_request if not is_internal_request
+
+    # FQDNs of the brokers as regular expressions
+    brokers_fqdn := [
+      `local`,                                 # cluster domain
+      `cluster`,                               # cluster domain
+      `svc`,
+      `default`,                               # namespace
+      `simple-kafka-broker-default-headless`,  # Pod subdomain
+      `simple-kafka-broker-default-[0-9]+`,    # Pod name
+    ]
+
+    domain_components = [concat("", [`DC=`, dc]) | some dc in brokers_fqdn]
+    common_name = `CN=generated certificate for pod`
+    subject_dn_fields = array.concat(domain_components, [common_name])
+    brokers_subject_dn_pattern := concat("", ["^", concat(",", subject_dn_fields), "$"])
+
+    default allow := false
+
+    allow if {
+      is_internal_request
+
+      regex.match(
+        brokers_subject_dn_pattern,
+        input.requestContext.principal.name,
+      )
+    }
+
+    allow if {
+      is_external_request
+
+      # TODO Add your own rules
+    }

docs/modules/kafka/examples/security/03a-authorization-kafkacluster.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: kafka.stackable.tech/v1alpha1
+kind: KafkaCluster
+metadata:
+  name: simple-kafka
+spec:
+  image:
+    productVersion: 3.9.2
+  clusterConfig:
+    authorization:
+      opa:
+        configMapName: simple-opa
+        package: kafka
+    zookeeperConfigMapName: simple-kafka-znode
+  brokers:
+    roleGroups:
+      default:
+        replicas: 1