feat: add custom CA and additional volume support

[GatewayJ]

Type of Change

• New Feature
• Bug Fix
• Documentation
• Performance Improvement
• Test/CI
• Refactor
• Other:

Related Issues

Fixes #256

Summary of Changes

• Add spec.oidc.extraCaCertSecretRef for a namespaced Secret key containing
  the PEM CA bundle used by RustFS outbound OIDC HTTPS.
• Validate the OIDC Secret reference, selected key, and certificates before
  applying workloads; report actionable OidcTrustReady conditions.
• Mount the selected key at a fixed read-only directory without subPath, set
  RUSTFS_EXTRA_CA_CERT, and index the Secret reference for reconciliation.
• Add Kubernetes-native spec.additionalVolumes and
  spec.additionalVolumeMounts for arbitrary files required by the RustFS
  container in every Pool.
• Reject duplicate entries, unknown Volume references, relative paths, ..
  components, equivalent paths, and parent/child overlap with operator-managed
  data, logging, TLS, and OIDC mounts.
• Normalize additional Volume and VolumeMount ordering before rendering the
  StatefulSet Pod template, avoiding rollouts caused only by YAML list order.
• Update the pinned default RustFS server image, Console default, examples, and
  e2e defaults from rustfs/rustfs:1.0.0-beta.10 to rustfs/rustfs:1.0.0.
• Document the scope of OidcTrustReady and the combined-root CA rotation
  procedure in English and Chinese.

Checklist

• I have read and followed the CONTRIBUTING.md guidelines
• Passed make pre-commit (fmt-check + clippy + test + console-lint + console-fmt-check)
• Added/updated necessary tests
• Documentation updated (if needed)
• CHANGELOG.md updated under [Unreleased] (if user-visible change)
• CI/CD passed (if applicable)

Impact

• Breaking change (CRD/API compatibility)
• Requires doc/config/deployment update
• Other impact: Install the updated Tenant CRD before using the new fields.

Both new Tenant fields are optional and serialize only when configured.
Existing Tenant YAML, StatefulSet selectors, PVC templates, and Service
selectors remain structurally compatible when the fields are absent.

The pinned fallback image changes to rustfs/rustfs:1.0.0. A Tenant that omits
both spec.image and the Operator TENANT_RUSTFS_IMAGE override will receive a
normal StatefulSet rolling update on its next reconciliation. Tenants with an
explicit image or Operator-level image override are unchanged.

Changing an additional Volume or VolumeMount changes the StatefulSet Pod
template and starts a normal rolling update. Secret and ConfigMap content
updates are projected by Kubernetes without changing the Pod template; users
should avoid subPath when they require projected updates in running Pods.

The implementation targets RustFS GA and later images. The Operator does not
perform runtime image capability detection.

Verification

docker manifest inspect rustfs/rustfs:1.0.0
cargo test additional_volume_validation -- --nocapture
cargo test successful_status_only_reports_oidc_trust_when_configured -- --nocapture
cargo test test_statefulset_sets_security_context -- --nocapture
env -u MAKEFLAGS make -j1 pre-commit
git diff --check origin/main..HEAD

Results:

• The rustfs/rustfs:1.0.0 image manifest is available.
• 672 Operator library tests passed.
• 134 Rust-native e2e framework tests passed; live cluster suites remain opt-in.
• Rust formatting and Clippy passed for the Operator and e2e crates.
• Console tests, lint, production build, and formatting checks passed.
• The generated Tenant CRD matches the tracked chart CRD.

Additional Notes

• RustFS RUSTFS_EXTRA_CA_CERT is wired through the managed OIDC Secret path
  and remains available through spec.env plus the general Volume fields for
  custom composition.
• OidcTrustReady=True confirms that the configured Secret bundle passed the
  latest Operator validation. Kubernetes projects Secret updates independently
  to each Pod, so CA replacement uses a combined old-plus-new root bundle until
  every Pod and the OIDC provider complete the transition.
• The API follows the MinIO Operator pattern of providing a dedicated CA Secret
  field alongside Kubernetes-native additional Volumes and VolumeMounts. One
  Volume may be mounted at multiple paths; equal list lengths are not required.
• Kubernetes admission and Pod Security remain authoritative for VolumeSource
  policy. The Operator validates only composition rules it owns.
• Correctness verdict: passed; traversal, equivalent paths, parent/child
  overlap, exact managed paths, and similarly named sibling paths were tested.
• Simplicity verdict: passed; path normalization and component overlap remain
  local to workload composition, with no generic resource watcher or image
  capability subsystem.
• Test coverage verdict: passed; managed and unmanaged CA paths, invalid
  references and collisions, stable ordering, update detection, status, default
  image rendering, and generated CRD parity are covered.
• Security verdict: passed; Secret payloads never enter status or logs, managed
  mounts are read-only, traversal is rejected, and additional mounts cannot
  replace operator-managed files or directories.
• Compatibility verdict: passed with a documented rollout; the CRD change is
  additive, existing YAML remains valid, explicit images remain unchanged, and
  only fallback-image Tenants roll to the requested GA default.
• Rollback removes the new fields from Tenant resources before reverting the
  Operator and CRD. Existing PVCs and stored objects are unaffected.

---

Thank you for your contribution! Please ensure your PR follows the community standards (CODE_OF_CONDUCT.md) and sign the CLA if this is your first contribution.

[GatewayJ]

@codex

[GatewayJ]

@codex

[GatewayJ]

@codex