chore: Address review comments

Author: siegfriedweber

extra/crds.yaml

@@ -753,13 +753,13 @@ mod tests {
             datetime!(2025-01-01 0:00 UTC),
             datetime!(2025-01-01 12:00 UTC),
         )
-        .expect("should create a valid certificate");
+        .expect("must be able to create a valid certificate");
         let ca2 = create_certificate_authority(
             2,
             datetime!(2025-01-01 6:00 UTC),
             datetime!(2025-01-01 18:00 UTC),
         )
-        .expect("should create a valid certificate");
+        .expect("must be able to create a valid certificate");
 
         let manager = Manager {
             source_secret: ObjectRef::<Secret>::new("secret-provisioner-tls-ca"),
@@ -794,30 +794,30 @@ mod tests {
             datetime!(2025-01-01 0:00 UTC),
             datetime!(2025-01-01 12:00 UTC),
         )
-        .expect("should create a valid certificate");
+        .expect("must be able to create a valid certificate");
         let ca1_certificate = ca1.certificate.clone();
 
         let ca2 = create_certificate_authority(
             2,
             datetime!(2025-01-01 6:00 UTC),
             datetime!(2025-01-01 18:00 UTC),
         )
-        .expect("should create a valid certificate");
+        .expect("must be able to create a valid certificate");
         let ca2_certificate = ca2.certificate.clone();
 
         let (trust_root1, _) = create_certificate(
             3,
             datetime!(2025-01-01 0:00 UTC),
             datetime!(2025-01-01 12:00 UTC),
         )
-        .expect("should create a valid certificate");
+        .expect("must be able to create a valid certificate");
 
         let (trust_root2, _) = create_certificate(
             4,
             datetime!(2025-01-01 6:00 UTC),
             datetime!(2025-01-01 18:00 UTC),
         )
-        .expect("should create a valid certificate");
+        .expect("must be able to create a valid certificate");
 
         let manager = Manager {
             source_secret: ObjectRef::<Secret>::new("secret-provisioner-tls-ca"),

rust/operator-binary/src/backend/tls/ca.rs

@@ -428,14 +428,16 @@ impl SecretBackend for TlsGenerate {
         _selector: &super::TrustSelector,
     ) -> Result<SecretContents, Self::Error> {
         let now = OffsetDateTime::now_utc();
+        let active_trust_roots = self.ca_manager.trust_roots(now);
+        let pems = active_trust_roots.into_iter().map(|ca| {
+            ca.to_pem()
+                .context(SerializeCertificateSnafu { tpe: CertType::Ca })
+        });
+        let concatenated_pem = iterator_try_concat_bytes(pems)?;
+
         Ok(SecretContents::new(SecretData::WellKnown(
             WellKnownSecretData::TlsPem(well_known::TlsPem {
-                ca_pem: iterator_try_concat_bytes(
-                    self.ca_manager.trust_roots(now).into_iter().map(|ca| {
-                        ca.to_pem()
-                            .context(SerializeCertificateSnafu { tpe: CertType::Ca })
-                    }),
-                )?,
+                ca_pem: concatenated_pem,
                 certificate_pem: None,
                 key_pem: None,
             }),

rust/operator-binary/src/backend/tls/mod.rs

@@ -164,7 +164,8 @@ pub mod versioned {
 
         /// Duration at the end of the CA certificate lifetime where no signed certificate will exist.
         ///
-        /// Retired (or expired) CA certificates will not be published.
+        /// Retired (or expired) CA certificates will not be published and will not be used for
+        /// signing leaf certificates.
         #[serde(default = "v1alpha2::AutoTlsCa::default_ca_certificate_retirement_duration")]
         pub ca_certificate_retirement_duration: Duration,