use listener scope for tls

Author: labrenbe

rust/operator-binary/src/controller.rs

@@ -1346,12 +1346,10 @@ async fn build_node_rolegroup_statefulset(
             build_tls_volume(
                 nifi,
                 KEYSTORE_VOLUME_NAME,
-                vec![
-                    &nifi_cluster_name,
-                    &build_reporting_task_service_name(&nifi_cluster_name),
-                ],
+                vec![&build_reporting_task_service_name(&nifi_cluster_name)],
                 SecretFormat::TlsPkcs12,
                 &requested_secret_lifetime,
+                LISTENER_VOLUME_NAME,
             )
             .context(SecuritySnafu)?,
         )

rust/operator-binary/src/reporting_task/mod.rs

@@ -51,6 +51,7 @@ use stackable_operator::{
 use crate::{
     controller::build_recommended_labels,
     crd::{APP_NAME, HTTPS_PORT, HTTPS_PORT_NAME, METRICS_PORT, NifiRole, v1alpha1},
+    listener::LISTENER_VOLUME_NAME,
     security::{
         authentication::{NifiAuthenticationConfig, STACKABLE_ADMIN_USERNAME},
         build_tls_volume,
@@ -356,6 +357,7 @@ fn build_reporting_task_job(
                 // There is no correct way to configure this job since it's an implementation detail.
                 // Also it will be dropped when support for 1.x is removed.
                 &Duration::from_days_unchecked(1),
+                LISTENER_VOLUME_NAME,
             )
             .context(SecretVolumeBuildFailureSnafu)?,
         )

rust/operator-binary/src/security/mod.rs

@@ -50,13 +50,15 @@ pub fn build_tls_volume(
     service_scopes: Vec<&str>,
     secret_format: SecretFormat,
     requested_secret_lifetime: &Duration,
+    listener_scope: &str,
 ) -> Result<Volume> {
     tls::build_tls_volume(
         nifi,
         volume_name,
         service_scopes,
         secret_format,
         requested_secret_lifetime,
+        listener_scope,
     )
     .context(TlsSnafu)
 }

rust/operator-binary/src/security/tls.rs

@@ -27,6 +27,7 @@ pub(crate) fn build_tls_volume(
     service_scopes: Vec<&str>,
     secret_format: SecretFormat,
     requested_secret_lifetime: &Duration,
+    listener_scope: &str,
 ) -> Result<Volume> {
     let mut secret_volume_source_builder =
         SecretOperatorVolumeSourceBuilder::new(nifi.server_tls_secret_class());
@@ -42,8 +43,8 @@ pub(crate) fn build_tls_volume(
     Ok(VolumeBuilder::new(volume_name)
         .ephemeral(
             secret_volume_source_builder
-                .with_node_scope()
                 .with_pod_scope()
+                .with_listener_volume_scope(listener_scope)
                 .with_format(secret_format)
                 .with_auto_tls_cert_lifetime(*requested_secret_lifetime)
                 .build()