feat: Add SecretOperatorVolumeSourceBuilder::with_auto_tls_cert_domain_components_in_subject_dn (#1209)

* feat: Support the annotation "secrets.stackable.tech/backend.autotls.cert.domain-components-in-subject-dn"

* chore: Update changelog

* Revise code

Author: siegfriedweber

crates/stackable-operator/CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+### Added
+
+- Support the annotation `secrets.stackable.tech/backend.autotls.cert.domain-components-in-subject-dn`
+  in the `SecretOperatorVolumeSourceBuilder` ([#1209]).
+
+[#1209]: https://github.com/stackabletech/operator-rs/pull/1209
+
 ## [0.113.0] - 2026-06-22
 
 ### Added

crates/stackable-operator/src/builder/pod/volume.rs

@@ -280,6 +280,7 @@ pub struct SecretOperatorVolumeSourceBuilder {
     kerberos_service_names: Vec<String>,
     tls_pkcs12_password: Option<String>,
     auto_tls_cert_lifetime: Option<Duration>,
+    auto_tls_cert_domain_components_in_subject_dn: Option<bool>,
     provision_parts: SecretClassVolumeProvisionParts,
 }
 
@@ -302,6 +303,7 @@ impl SecretOperatorVolumeSourceBuilder {
             kerberos_service_names: Vec::new(),
             tls_pkcs12_password: None,
             auto_tls_cert_lifetime: None,
+            auto_tls_cert_domain_components_in_subject_dn: None,
             provision_parts,
         }
     }
@@ -311,6 +313,14 @@ impl SecretOperatorVolumeSourceBuilder {
         self
     }
 
+    pub fn with_auto_tls_cert_domain_components_in_subject_dn(
+        &mut self,
+        enabled: bool,
+    ) -> &mut Self {
+        self.auto_tls_cert_domain_components_in_subject_dn = Some(enabled);
+        self
+    }
+
     pub fn with_node_scope(&mut self) -> &mut Self {
         self.scopes.push(SecretOperatorVolumeScope::Node);
         self
@@ -391,6 +401,12 @@ impl SecretOperatorVolumeSourceBuilder {
             );
         }
 
+        if let Some(enabled) = self.auto_tls_cert_domain_components_in_subject_dn {
+            annotations.insert(Annotation::auto_tls_cert_domain_components_in_subject_dn(
+                enabled,
+            ));
+        }
+
         Ok(EphemeralVolumeSource {
             volume_claim_template: Some(PersistentVolumeClaimTemplate {
                 metadata: Some(ObjectMetaBuilder::new().annotations(annotations).build()),

crates/stackable-operator/src/kvp/annotation/mod.rs

@@ -159,13 +159,26 @@ impl Annotation {
 
     /// Constructs a `autoscaling.stackable.tech/retry` annotation.
     pub fn autoscaling_retry(retry: bool) -> Self {
-        // SAFETY: We use expect here, because the input parameter can only be one of two possible
+        // PANICS: We use expect here, because the input parameter can only be one of two possible
         // values: true or false. This fact in combination with the known annotation key length
-        // allows use to use expect here, instead of bubbling up the error.
+        // allows us to use expect here, instead of bubbling up the error.
         let kvp = KeyValuePair::try_from(("autoscaling.stackable.tech/retry", retry.to_string()))
             .expect("autoscaling retry annotation must be valid");
         Self(kvp)
     }
+
+    /// Constructs a `secrets.stackable.tech/backend.autotls.cert.domain-components-in-subject-dn` annotation.
+    pub fn auto_tls_cert_domain_components_in_subject_dn(enabled: bool) -> Self {
+        // PANICS: We use expect here, because the input parameter can only be one of two possible
+        // values: true or false. This fact in combination with the known annotation key length
+        // allows us to use expect here, instead of bubbling up the error.
+        let kvp = KeyValuePair::try_from((
+            "secrets.stackable.tech/backend.autotls.cert.domain-components-in-subject-dn",
+            enabled.to_string(),
+        ))
+        .expect("annotation secrets.stackable.tech/backend.autotls.cert.domain-components-in-subject-dn must be valid");
+        Self(kvp)
+    }
 }
 
 /// A validated set/list of Kubernetes annotations.
@@ -357,4 +370,13 @@ mod test {
 
         assert_eq!(annotations.len(), 2);
     }
+
+    #[test]
+    fn test_boolean_annotations() {
+        // Check that the functions do not fail for all possible inputs
+        for value in [false, true] {
+            Annotation::autoscaling_retry(value);
+            Annotation::auto_tls_cert_domain_components_in_subject_dn(value);
+        }
+    }
 }