feat: Add FQDNs to the subject DNs of TLS certificates

Author: siegfriedweber

CHANGELOG.md

@@ -16,10 +16,12 @@ All notable changes to this project will be documented in this file.
   controllers).
   Previously, arbitrary file names were silently accepted and ignored ([#960]).
 - Bump `stackable-operator` to 0.111.1 and snafu to 0.9 ([#960], [#961]).
+- BREAKING: Extend the subject DNs of TLS certificates with the FQDNs of the Kafka pods ([#972]).
 
 [#953]: https://github.com/stackabletech/kafka-operator/pull/953
 [#960]: https://github.com/stackabletech/kafka-operator/pull/960
 [#961]: https://github.com/stackabletech/kafka-operator/pull/961
+[#972]: https://github.com/stackabletech/kafka-operator/pull/972
 
 ## [26.3.0] - 2026-03-16
 

Cargo.lock

@@ -31,4 +31,4 @@ tracing = "0.1"
 
 [patch."https://github.com/stackabletech/operator-rs.git"]
 # stackable-operator = { path = "../operator-rs/crates/stackable-operator" }
-# stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "main" }
+stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "feat/annotation-auto-tls-cert-subject-dn" }

Cargo.nix

@@ -563,6 +563,7 @@ impl KafkaTlsSecurity {
                             .with_pod_scope()
                             .with_format(SecretFormat::TlsPkcs12)
                             .with_auto_tls_cert_lifetime(*requested_secret_lifetime)
+                            .with_auto_tls_cert_domain_components_in_subject_dn(true)
                             .build()
                             .context(SecretVolumeBuildSnafu)?,
                         )
@@ -864,6 +865,7 @@ impl KafkaTlsSecurity {
                 .with_pod_scope()
                 .with_format(SecretFormat::TlsPem)
                 .with_auto_tls_cert_lifetime(*requested_secret_lifetime)
+                .with_auto_tls_cert_domain_components_in_subject_dn(true)
                 .build()
                 .context(SecretVolumeBuildSnafu)?,
             )
@@ -888,6 +890,7 @@ impl KafkaTlsSecurity {
                 .with_listener_volume_scope(LISTENER_BOOTSTRAP_VOLUME_NAME)
                 .with_format(SecretFormat::TlsPkcs12)
                 .with_auto_tls_cert_lifetime(*requested_secret_lifetime)
+                .with_auto_tls_cert_domain_components_in_subject_dn(true)
                 .build()
                 .context(SecretVolumeBuildSnafu)?,
             )

Cargo.toml

@@ -18,18 +18,27 @@ commands:
           default allow := false
 
           allow if {
-            input.requestContext.principal.name == "kafka"
+            is_internal_request
+            startswith(
+              input.requestContext.principal.name,
+              "DC=local,DC=cluster,DC=svc,DC=$NAMESPACE,DC=test-kafka-broker-default-headless,DC=test-kafka-broker-default-",
+            )
           }
 
           allow if {
-            input.requestContext.principal.name == "CN=generated certificate for pod"
+            is_external_request
+            input.requestContext.principal.name == "kafka"
           }
 
           allow if {
+            is_external_request
             input.requestContext.principal.name == "developer"
             resource_is_allowed
           }
 
+          is_internal_request if input.requestContext.listenerName == "INTERNAL"
+          is_external_request if not is_internal_request
+
           # only allow access to a specific topic
           resource_is_allowed if {
             input.action.resourcePattern.resourceType == "TOPIC"