refactor: cleanup security properties

Author: maltesander

rust/operator-binary/src/controller/build/command.rs

@@ -15,7 +15,7 @@ use crate::crd::{
 /// The JVM options selecting the Kafka log4j/log4j2 config file. Kafka 3.x uses log4j,
 /// Kafka 4.0 and higher use log4j2.
 pub fn kafka_log_opts(product_version: &str) -> String {
-    if product_version.starts_with("3.") {
+    if super::properties::uses_legacy_log4j(product_version) {
         format!(
             "-Dlog4j.configuration=file:{STACKABLE_LOG_CONFIG_DIR}/{log4j}",
             log4j = ConfigFileName::Log4j

rust/operator-binary/src/controller/build/properties/logging.rs

@@ -47,7 +47,7 @@ pub fn role_group_config_map_data(
     let mut configs: BTreeMap<String, Option<String>> = BTreeMap::new();
 
     // Starting with Kafka 4.0, log4j2 is used instead of log4j.
-    match product_version.starts_with("3.") {
+    match super::uses_legacy_log4j(product_version) {
         true => {
             configs.insert(
                 ConfigFileName::Log4j.to_string(),

rust/operator-binary/src/controller/build/properties/mod.rs

@@ -46,6 +46,16 @@ pub fn config_file_name(config: &AnyConfig) -> ConfigFileName {
     }
 }
 
+/// Whether the given Kafka version uses the legacy log4j logging framework.
+///
+/// Kafka 3.x uses log4j ([`ConfigFileName::Log4j`]); Kafka 4.0 and later use log4j2
+/// ([`ConfigFileName::Log4j2`]). This is the single source of truth for that decision,
+/// used both when rendering the log config file and when selecting the JVM option that
+/// points at it.
+pub fn uses_legacy_log4j(product_version: &str) -> bool {
+    product_version.starts_with("3.")
+}
+
 pub(crate) fn kraft_controllers(pod_descriptors: &[KafkaPodDescriptor]) -> Vec<String> {
     pod_descriptors
         .iter()