Add support for disabling encryption and authentication - Kafka nodes

[scholzj]

Type of change

• Enhancement / new feature

Description

This PR provides the ability to disable encryption and authentication for the nodes of the Kafka cluster (controllers and brokers). It does so by providing the NONE encryption and authentication type and handling them in the configurations of the various components. This is part of the SEP-150 Configurable Cluster Security implementation.

It does not do it for the other components of the Kafka cluster, system tests and docs. Those will be done in separate PRs.

Checklist

• Write tests
• Make sure all tests pass
• Try your changes inside a Kubernetes cluster, not just from unit tests
• AI assistance was used to create this PR (see the Strimzi AI policy)

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[codecov]

Codecov Report

❌ Patch coverage is 95.32164% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 80.55%. Comparing base (88e86e0) to head (37feef9).

Files with missing lines	Patch %	Lines
...c/main/java/io/strimzi/kafka/agent/KafkaAgent.java	89.28%	3 Missing ⚠️
...tor/cluster/model/KafkaClusterSecurityContext.java	94.59%	0 Missing and 2 partials ⚠️
...erator/cluster/operator/assembly/CaReconciler.java	60.00%	0 Missing and 2 partials ⚠️
...or/cluster/operator/resource/KafkaAgentClient.java	0.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main   #13018      +/-   ##
============================================
+ Coverage     80.33%   80.55%   +0.22%     
- Complexity     6522     6569      +47     
============================================
  Files           343      344       +1     
  Lines         22695    22768      +73     
  Branches       3079     3101      +22     
============================================
+ Hits          18231    18340     +109     
+ Misses         3250     3206      -44     
- Partials       1214     1222       +8     

Files with missing lines	Coverage Δ
.../cluster/model/KafkaAgentConfigurationBuilder.java	100.00% <100.00%> (ø)
...cluster/model/KafkaBrokerConfigurationBuilder.java	94.29% <100.00%> (+0.47%)	⬆️
...o/strimzi/operator/cluster/model/KafkaCluster.java	94.34% <100.00%> (+0.04%)	⬆️
...uster/operator/assembly/KafkaAssemblyOperator.java	84.47% <100.00%> (ø)
...cluster/operator/assembly/KafkaClusterCreator.java	94.73% <100.00%> (ø)
...tor/cluster/operator/assembly/KafkaReconciler.java	95.22% <100.00%> (ø)
...tor/cluster/operator/assembly/ReconcilerUtils.java	82.28% <100.00%> (ø)
...or/cluster/operator/resource/KafkaAgentClient.java	41.81% <0.00%> (+11.81%)	⬆️
...tor/cluster/model/KafkaClusterSecurityContext.java	96.49% <94.59%> (-3.51%)	⬇️
...erator/cluster/operator/assembly/CaReconciler.java	96.13% <60.00%> (-1.05%)	⬇️
... and 1 more

... and 5 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[scholzj]

/gha run pipeline=regression

[github-actions]

⏳ System test verification started: link

The following 6 job(s) will be executed:

• regression-brokers-and-security-amd64 (cncf-ubuntu-8-32-x86)
• regression-operators-amd64 (cncf-ubuntu-8-32-x86)
• regression-operands-amd64 (cncf-ubuntu-8-32-x86)
• regression-brokers-and-security-arm64 (cncf-ubuntu-8-32-arm)
• regression-operators-arm64 (cncf-ubuntu-8-32-arm)
• regression-operands-arm64 (cncf-ubuntu-8-32-arm)

Tests will start after successful build completion.

[github-actions]

🎉 System test verification passed: link

[ppatierno]

I had a first pass but planned to come back to it again.

[tinaselenge]

KafkaAgentClient always uses https in the URI when connecting to the agent. I guess if the agent is configured to serve plain HTTP when TLS is disabled, it needs to be updated to use http instead?

[scholzj]

@ppatierno @tinaselenge Your comments should be incorporated or replied to now. Thanks.

[tinaselenge]

Do we not need an entry in the changelog?

[scholzj]

Do we not need an entry in the changelog?

@tinaselenge Changelog (and documentation) are in one of the PRs higher in the PR stack: #13041

[ppatierno]

I left a few more nits, but we are almost there :-)

[ppatierno]

LGTM. Thanks!

[tinaselenge]

Thanks. LGTM now.