feat: Add domain components to the subject DN if enabled

Author: siegfriedweber

rust/operator-binary/src/backend/auto_tls/mod.rs

@@ -355,6 +355,21 @@ impl SecretBackend for TlsGenerate {
                     }
                 }
 
+                let domain_components = if selector.autotls_cert_domain_components_in_subject_dn {
+                    [
+                        Some(pod_info.pod_name.as_str()),
+                        pod_info.service_name.as_deref(),
+                        Some(&pod_info.namespace),
+                        Some("svc"),
+                    ]
+                    .into_iter()
+                    .flatten()
+                    .chain(pod_info.kubernetes_cluster_domain.split('.'))
+                    .collect()
+                } else {
+                    vec![]
+                };
+
                 let pod_cert = X509Builder::new()
                     .and_then(|mut x509| {
                         let subject_name = X509NameBuilder::new()
@@ -363,6 +378,12 @@ impl SecretBackend for TlsGenerate {
                                     Nid::COMMONNAME,
                                     "generated certificate for pod",
                                 )?;
+                                for domain_component in domain_components {
+                                    name.append_entry_by_nid(
+                                        Nid::DOMAINCOMPONENT,
+                                        domain_component,
+                                    )?;
+                                }
                                 Ok(name)
                             })?
                             .build();

rust/operator-binary/src/backend/mod.rs

@@ -129,6 +129,13 @@ pub struct SecretVolumeSelector {
     )]
     pub autotls_cert_jitter_factor: f64,
 
+    #[serde(
+        rename = "secrets.stackable.tech/backend.autotls.cert.domain-components-in-subject-dn",
+        deserialize_with = "SecretVolumeSelector::deserialize_str_as_bool",
+        default
+    )]
+    pub autotls_cert_domain_components_in_subject_dn: bool,
+
     /// The TLS cert lifetime (when using the [`cert_manager`] backend).
     ///
     /// The format is documented in <https://docs.stackable.tech/home/nightly/concepts/duration>.
@@ -301,6 +308,16 @@ impl SecretVolumeSelector {
             )
         })
     }
+
+    fn deserialize_str_as_bool<'de, D: Deserializer<'de>>(de: D) -> Result<bool, D::Error> {
+        let str = String::deserialize(de)?;
+        str.parse().map_err(|_| {
+            <D::Error as serde::de::Error>::invalid_value(
+                Unexpected::Str(&str),
+                &"a string containing a boolean",
+            )
+        })
+    }
 }
 
 #[derive(Debug)]

rust/operator-binary/src/backend/pod_info.rs

@@ -104,7 +104,9 @@ pub enum FromPodError {
 #[derive(Debug)]
 pub struct PodInfo {
     pub pod_ips: Vec<IpAddr>,
+    pub pod_name: String,
     pub service_name: Option<String>,
+    pub namespace: String,
     pub node_name: String,
     pub node_ips: Vec<IpAddr>,
     pub listener_addresses: Option<ListenerAddresses>,
@@ -119,6 +121,8 @@ impl PodInfo {
         scopes: &[SecretScope],
     ) -> Result<Self, FromPodError> {
         use from_pod_error::*;
+        let pod_name = pod.metadata.name.clone().context(NoPodNameSnafu)?;
+        let namespace = pod.metadata.namespace.clone().context(NoNamespaceSnafu)?;
         let node_name = pod
             .spec
             .as_ref()
@@ -150,7 +154,9 @@ impl PodInfo {
                         .context(from_pod_error::IllegalAddressSnafu { address: ip })
                 })
                 .collect::<Result<_, _>>()?,
+            pod_name,
             service_name: pod.spec.as_ref().and_then(|spec| spec.subdomain.clone()),
+            namespace,
             node_name,
             node_ips: node
                 .status