feat: Support DCs in the subject DN of TLS certificates

[siegfriedweber]

Description

Support adding domain components to the subject DN of TLS certificates with the volume annotation secrets.stackable.tech/backend.autotls.cert.domain-components-in-subject-dn

Part of #617

Definition of Done Checklist

• Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
• Please make sure all these things are done and tick the boxes

Author

• Changes are OpenShift compatible
• CRD changes approved: stackabletech/decisions#81
• CRD documentation for all fields, following the style guide.
• Helm chart can be installed and deployed operator works
• Integration tests passed (for non trivial changes)
• Changes need to be "offline" compatible
• Links to generated (nightly) docs added: https://docs.stackable.tech/home/nightly/secret-operator/volume/#_secrets_stackable_techbackend_autotls_cert_domain_components_in_subject_dn
• Release note snippet added: feat: Support DCs in the subject DN of TLS certificates #708 (comment)

Reviewer

• Code contains useful comments
• Code contains useful logging statements
• (Integration-)Test cases added
• Documentation added or updated. Follows the style guide.
• Changelog updated
• Cargo.toml only contains references to git tags (not specific commits or branches)

Acceptance

• Feature Tracker has been updated
• Proper release label has been added
• Links to generated (nightly) docs added
• Release note snippet added
• Add type/deprecation label & add to the deprecation schedule
• Add type/experimental label & add to the experimental features tracker

[Techassi]

Just two nitpicks, otherwise looks very straight forward.

[siegfriedweber]

Release notes

Stackable secret-operator

The Stackable secret-operator now supports adding domain components to the subject DN of TLS certificates with the volume annotation secrets.stackable.tech/backend.autotls.cert.domain-components-in-subject-dn (see https://docs.stackable.tech/home/stable/secret-operator/volume/#_secrets_stackable_techbackend_autotls_cert_domain_components_in_subject_dn), e.g.:

volumes:
  - name: tls
    ephemeral:
      volumeClaimTemplate:
        metadata:
          annotations:
            secrets.stackable.tech/backend.autotls.cert.domain-components-in-subject-dn: "true"
            secrets.stackable.tech/class: tls
            secrets.stackable.tech/scope: node,pod
        spec:
          storageClassName: secrets.stackable.tech
          accessModes:
            - ReadWriteOnce
          resources:
            requests:
              storage: "1"

A pod of a StatefulSet could then serve a TLS certificate with the following subject DN:

CN=generated certificate for pod, DC=my-pod-0, DC=my-statefulset-service, DC=my-namespace, DC=svc, DC=cluster, DC=local

[lfrancke]

Can you maybe add a concrete example for how this is used?

[siegfriedweber]

Can you maybe add a concrete example for how this is used?

Concrete example added in #708 (comment)