[razvan]

Description

Fixes #1066

Practically reverts #1024 and in addition always requires authentication on the CONTROLLER listener.

Kafka nodes now always authenticate each other with the pod certificates of the internal SecretClass, also when Kerberos is enabled. Kerberos is only used on the client-facing broker listeners (CLIENT and BOOTSTRAP).

Changes:

• The CONTROLLER listener is always SSL and always requires client authentication, like INTERNAL. Before, client auth was only required when TLS client authentication, Kerberos or OPA was configured.
• Controllers no longer get a Kerberos keytab, krb5.conf, JAAS configuration or Kerberos environment variables.
• Brokers no longer set sasl.mechanism.controller.protocol, and their JAAS file has only the bootstrap and client sections.
• The quorum-manager sidecar and preStop hook (kafka-metadata-quorum.sh) connect with the internal pod certificate instead of GSSAPI.
• With OPA, super.users contains only the pod certificate subjects of the nodes, and no Kerberos principals.

Definition of Done Checklist

• Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
• Please make sure all these things are done and tick the boxes

Author

• Changes are OpenShift compatible
• CRD changes approved
• CRD documentation for all fields, following the style guide.
• Helm chart can be installed and deployed operator works
• Integration tests passed (for non trivial changes)
• Changes need to be "offline" compatible
• Links to generated (nightly) docs added
• Release note snippet added

Reviewer

• Code contains useful comments
• Code contains useful logging statements
• (Integration-)Test cases added
• Documentation added or updated. Follows the style guide.
• Changelog updated
• Cargo.toml only contains references to git tags (not specific commits or branches)

Acceptance

• Feature Tracker has been updated
• Proper release label has been added
• Links to generated (nightly) docs added
• Release note snippet added
• Add type/deprecation label & add to the deprecation schedule
• Add type/experimental label & add to the experimental features tracker