feat: add custom CA and additional volume support

CHANGELOG.md

@@ -24,6 +24,10 @@ All notable changes to RustFS Operator are documented in this file. The format i
 
 ### Added
 
+- Tenant `spec.oidc.extraCaCertSecretRef` for validated, reloadable custom CA trust used by
+  RustFS OIDC outbound connections.
+- Tenant `spec.additionalVolumes` and `spec.additionalVolumeMounts` for Kubernetes-native file
+  injection into every RustFS Pool workload.
 - Tenant `spec.network` for Service IP families and IPv6 listen addresses, plus dual-stack binds
   for operator observability, STS, and Console sockets.
 - Tenant `spec.hostUsers` and OpenShift `hostUsers: false` defaults for `restricted-v3`.
@@ -38,6 +42,7 @@ All notable changes to RustFS Operator are documented in this file. The format i
 ### Fixed
 
 - Reject multi-pool Tenants containing a single-node single-disk pool before applying pool workloads, matching RustFS startup constraints.
+- Reject additional volume mounts that overlap operator-managed data, logging, TLS, or OIDC paths.
 
 - Explicit private bucket access now removes operator-managed policies, and primary Service IP
   family changes recreate managed Services instead of repeatedly failing immutable-field updates.
@@ -46,6 +51,8 @@ All notable changes to RustFS Operator are documented in this file. The format i
 
 ### Changed
 
+- Updated the default RustFS server image from `rustfs/rustfs:1.0.0-beta.10` to
+  `rustfs/rustfs:1.0.0`.
 - Documented that distinct-physical-disk erasure failures and a separate data-plane operator are
   outside this controller's scope.
 - Refreshed the Console dashboard and tenant navigation with semantic status colors, clearer primary

console-web/app/(dashboard)/tenants/new/page.tsx

@@ -20,7 +20,7 @@ import { ApiError } from "@/lib/api-client"
 
 type CreateMode = "form" | "yaml"
 
-const DEFAULT_RUSTFS_IMAGE = "rustfs/rustfs:1.0.0-beta.10"
+const DEFAULT_RUSTFS_IMAGE = "rustfs/rustfs:1.0.0"
 
 const defaultPool: CreatePoolRequest = {
   name: "pool-0",
@@ -209,7 +209,7 @@ export default function TenantCreatePage() {
                     required
                     value={image}
                     onChange={(e) => setImage(e.target.value)}
-                    placeholder="rustfs/rustfs:1.0.0-beta.10"
+                    placeholder="rustfs/rustfs:1.0.0"
                   />
                   <p className="text-xs text-muted-foreground">
                     {t(

deploy/rustfs-operator/README.md

@@ -220,6 +220,82 @@ is omitted, the operator does not set
 `RUSTFS_RPC_SECRET`, RustFS resolves it from its own credential configuration,
 and the operator does not report `RpcAuthReady` for that unmanaged value.
 
+### Tenant OIDC Custom CA Trust
+
+Use `spec.oidc.extraCaCertSecretRef` when RustFS must trust a private CA for
+outbound OIDC connections:
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: oidc-extra-ca
+  namespace: storage
+type: Opaque
+stringData:
+  ca.crt: |
+    -----BEGIN CERTIFICATE-----
+    ...
+    -----END CERTIFICATE-----
+---
+apiVersion: rustfs.com/v1alpha1
+kind: Tenant
+metadata:
+  name: rustfs-a
+  namespace: storage
+spec:
+  image: rustfs/rustfs:1.0.0
+  oidc:
+    extraCaCertSecretRef:
+      name: oidc-extra-ca
+```
+
+The key defaults to `ca.crt`. The operator validates the PEM certificates,
+mounts the selected key at `/var/run/rustfs/oidc-extra-ca/ca.pem` without a
+`subPath`, and sets `RUSTFS_EXTRA_CA_CERT` to that path. Secret updates enqueue
+referencing Tenants without forcing a Pod rollout. This feature targets RustFS
+GA and later images. This OIDC-only trust is separate from process-wide
+`spec.tls.caTrust`.
+
+`OidcTrustReady=True` confirms that the configured Secret key contained a valid
+CA bundle during the latest reconciliation. Kubernetes projects Secret updates
+to each Pod independently, so the condition does not confirm that every Pod has
+observed the same version. For CA rotation, publish both the current and
+replacement roots, wait for every Pod to observe the combined bundle, verify
+OIDC discovery and login, switch the provider certificate, and remove the old
+root only after every Pod trusts the replacement.
+
+### Additional RustFS Files
+
+Use `spec.additionalVolumes` and `spec.additionalVolumeMounts` to provide files
+that do not have a dedicated Tenant field. Both fields use the Kubernetes
+`Volume` and `VolumeMount` schemas and apply to the RustFS container in every
+Pool. For example, the following configuration provides an unmanaged CA bundle
+to `RUSTFS_EXTRA_CA_CERT`:
+
+```yaml
+spec:
+  env:
+    - name: RUSTFS_EXTRA_CA_CERT
+      value: /etc/rustfs/custom-ca/ca.crt
+  additionalVolumes:
+    - name: custom-ca
+      secret:
+        secretName: custom-ca
+  additionalVolumeMounts:
+    - name: custom-ca
+      mountPath: /etc/rustfs/custom-ca
+      readOnly: true
+```
+
+Every additional mount must reference an additional volume. Volume names and
+mount paths must not conflict with operator-managed storage, logging, TLS, or
+OIDC mounts. Relative paths, `..` components, equivalent paths, and parent or
+child relationships with managed mounts are rejected. Kubernetes validates the
+selected volume source and projects Secret and ConfigMap updates. Avoid
+`subPath` when projected updates must reach running Pods. Changing either Tenant
+field updates the StatefulSet Pod template and starts a rolling update.
+
 ### Tenant Provisioning
 
 Tenants can declare RustFS canned policies, regular users, and buckets directly in `spec.policies`, `spec.users`, and `spec.buckets`. Provisioning starts only after the Tenant workload is ready, uses `spec.credsSecret` as the RustFS admin credential source, and reports progress under `status.provisioning`.
@@ -495,7 +571,7 @@ and a multi-replica Tenant temporarily runs with reduced capacity. Verify every
 Tenant image first. Known incompatible images are blocked before rollout, and
 mutable tags, digest references, or custom repositories are blocked under an
 effective `RuntimeDefault` profile unless the Tenant carries an image-bound
-acknowledgement. Before upgrade, either pin a verified RustFS beta.9-or-later
+acknowledgement. Before upgrade, either pin a verified RustFS 1.0.0 or later
 release tag, or verify the effective image and set
 `operator.rustfs.com/runtime-default-image-ack` to that exact image reference:
 
@@ -524,7 +600,7 @@ verifying that exact digest, acknowledge the complete reference. Mutable tags ca
 change content without changing the annotation, so prefer an immutable digest
 in production.
 
-The built-in RustFS image fallback also changes from the mutable `latest` tag to
+The built-in RustFS image fallback is now `rustfs/rustfs:1.0.0`, replacing
 `rustfs/rustfs:1.0.0-beta.10`. Tenants without `spec.image` and without a
 `TENANT_RUSTFS_IMAGE` Operator environment override roll to that pinned release
 on reconciliation. Set `spec.image` explicitly to control future server upgrades.