[Merged by Bors] - Support tls authentication

deploy/crd/kafkacluster.crd.yaml

@@ -275,6 +275,45 @@ spec:
                   required:
                     - roleGroups
                   type: object
+                config:
+                  default:
+                    tls:
+                      secretClass: tls
+                    internalTls:
+                      secretClass: tls
+                  properties:
+                    clientAuthentication:
+                      description: "Only affects client connections. This setting controls: - If clients need to authenticate themselves against the server via TLS - Which ca.crt to use when validating the provided client certs Defaults to `None`"
+                      nullable: true
+                      properties:
+                        authenticationClass:
+                          type: string
+                      required:
+                        - authenticationClass
+                      type: object
+                    internalTls:
+                      default:
+                        secretClass: tls
+                      description: "Only affects internal communication. Use mutual verification between Kafka nodes This setting controls: - Which cert the servers should use to authenticate themselves against other servers - Which ca.crt to use when validating the other server"
+                      nullable: true
+                      properties:
+                        secretClass:
+                          type: string
+                      required:
+                        - secretClass
+                      type: object
+                    tls:
+                      default:
+                        secretClass: tls
+                      description: "Only affects client connections. This setting controls: - If TLS encryption is used at all - Which cert the servers should use to authenticate themselves against the client Defaults to `TlsSecretClass` { secret_class: \"tls\".to_string() }."
+                      nullable: true
+                      properties:
+                        secretClass:
+                          type: string
+                      required:
+                        - secretClass
+                      type: object
+                  type: object
                 log4j:
                   nullable: true
                   type: string

deploy/helm/kafka-operator/crds/crds.yaml

@@ -277,6 +277,45 @@ spec:
                   required:
                     - roleGroups
                   type: object
+                config:
+                  default:
+                    tls:
+                      secretClass: tls
+                    internalTls:
+                      secretClass: tls
+                  properties:
+                    clientAuthentication:
+                      description: "Only affects client connections. This setting controls: - If clients need to authenticate themselves against the server via TLS - Which ca.crt to use when validating the provided client certs Defaults to `None`"
+                      nullable: true
+                      properties:
+                        authenticationClass:
+                          type: string
+                      required:
+                        - authenticationClass
+                      type: object
+                    internalTls:
+                      default:
+                        secretClass: tls
+                      description: "Only affects internal communication. Use mutual verification between Kafka nodes This setting controls: - Which cert the servers should use to authenticate themselves against other servers - Which ca.crt to use when validating the other server"
+                      nullable: true
+                      properties:
+                        secretClass:
+                          type: string
+                      required:
+                        - secretClass
+                      type: object
+                    tls:
+                      default:
+                        secretClass: tls
+                      description: "Only affects client connections. This setting controls: - If TLS encryption is used at all - Which cert the servers should use to authenticate themselves against the client Defaults to `TlsSecretClass` { secret_class: \"tls\".to_string() }."
+                      nullable: true
+                      properties:
+                        secretClass:
+                          type: string
+                      required:
+                        - secretClass
+                      type: object
+                  type: object
                 log4j:
                   nullable: true
                   type: string

deploy/helm/kafka-operator/templates/roles.yaml

@@ -89,3 +89,11 @@ rules:
       - {{ include "operator.name" . }}clusters/status
     verbs:
       - patch
+  - apiGroups:
+      - authentication.stackable.tech
+    resources:
+      - authenticationclasses
+    verbs:
+      - get
+      - list
+      - watch

deploy/manifests/crds.yaml

@@ -278,6 +278,45 @@ spec:
                   required:
                     - roleGroups
                   type: object
+                config:
+                  default:
+                    tls:
+                      secretClass: tls
+                    internalTls:
+                      secretClass: tls
+                  properties:
+                    clientAuthentication:
+                      description: "Only affects client connections. This setting controls: - If clients need to authenticate themselves against the server via TLS - Which ca.crt to use when validating the provided client certs Defaults to `None`"
+                      nullable: true
+                      properties:
+                        authenticationClass:
+                          type: string
+                      required:
+                        - authenticationClass
+                      type: object
+                    internalTls:
+                      default:
+                        secretClass: tls
+                      description: "Only affects internal communication. Use mutual verification between Kafka nodes This setting controls: - Which cert the servers should use to authenticate themselves against other servers - Which ca.crt to use when validating the other server"
+                      nullable: true
+                      properties:
+                        secretClass:
+                          type: string
+                      required:
+                        - secretClass
+                      type: object
+                    tls:
+                      default:
+                        secretClass: tls
+                      description: "Only affects client connections. This setting controls: - If TLS encryption is used at all - Which cert the servers should use to authenticate themselves against the client Defaults to `TlsSecretClass` { secret_class: \"tls\".to_string() }."
+                      nullable: true
+                      properties:
+                        secretClass:
+                          type: string
+                      required:
+                        - secretClass
+                      type: object
+                  type: object
                 log4j:
                   nullable: true
                   type: string

deploy/manifests/roles.yaml

@@ -89,3 +89,11 @@ rules:
       - kafkaclusters/status
     verbs:
       - patch
+  - apiGroups:
+      - authentication.stackable.tech
+    resources:
+      - authenticationclasses
+    verbs:
+      - get
+      - list
+      - watch