feat(stackable-operator): Support gitsync via SSH

[adwk67]

Description

Prerequisite for stackabletech/airflow-operator#382.
Tested with stackabletech/airflow-operator#718.
The gitsync test in Nifi was also successfully tested with this PR.

CRD Change

See https://github.com/stackabletech/decisions/issues/68

Definition of Done Checklist

• Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
• Please make sure all these things are done and tick the boxes

Author

• Changes are OpenShift compatible
• CRD changes approved
• CRD documentation for all fields, following the style guide.
• Integration tests passed (for non trivial changes)
• Changes need to be "offline" compatible

Reviewer

• Code contains useful comments
• Code contains useful logging statements
• (Integration-)Test cases added
• Documentation added or updated. Follows the style guide.
• Changelog updated
• Cargo.toml only contains references to git tags (not specific commits or branches)

Acceptance

• Feature Tracker has been updated
• Proper release label has been added

[sbernauer]

Only really looked at the CRD change (as the decision was accepted) and left a suggestion.
IIRC we wanted to try CRD versioning for this, sadly that will be another beast to tackle
Pls fee free to ping @Techassi, @NickLarsenNZ (or me if they are absent) if you need any help with that!

Because we should have CRD versioning in place before merging this (as otherwise it breaks v1alpha1)

edit: Oh sorry, I thought this was Waiting for review, my fault!

[sbernauer]

Can you please mark this as breaking change?
Ideally you also mention that downstream operators need to point this out as user-facing breaking change

[sbernauer]

Seems like a leftover

Suggested change

	#[snafu(display("failed to declare unique credentials"))]
	MultipleCredentials,

[sbernauer]

I personally find that easier to read, no macros and stuff ;) (same below)

Suggested change

	if matches!(git_sync.credentials, Some(Credentials::Ssh { .. })) {
	if let Some(Credentials::Ssh { .. }) = git_sync.credentials {

[sbernauer]

Your PR is still using the problematic untagged feature, which allows users to specify both things at the same time, with the one in Rust code being first taking precedence ;)
(you can see this in the CRD at)

                  credentials:
                    anyOf:
                    - required:
                      - basicAuthSecretName
                    - required:
                      - sshPrivateKeySecretName

It needs to be oneOf for it to properly work

We should use something like this

    #[derive(strum::Display, Clone, Debug, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
    #[serde(rename_all = "camelCase")]
    #[schemars(rename_all = "camelCase")]
    pub enum Credentials {
        /// The name of the Secret used to access the repository via Basic Authentication if it is not public.
        ///
        /// The referenced Secret must include two fields: `user` and `password`.
        /// The `password` field can either be an actual password (not recommended) or a GitHub token,
        /// as described in the git-sync [documentation].
        ///
        /// [documentation]: https://github.com/kubernetes/git-sync/tree/v4.2.4?tab=readme-ov-file#manual
        BasicAuthSecretName(String),

        /// The name of the Secret used for SSH access to the repository.
        ///
        /// The referenced Secret must include two fields: `key` and `knownHosts`.
        ///
        /// [documentation]: https://github.com/kubernetes/git-sync/tree/v4.2.4?tab=readme-ov-file#manual
        SshPrivateKeySecretName(String),
    }

which correctly produces

                  credentials:
                    description: An optional secret used for git access.
                    nullable: true
                    oneOf:
                    - required:
                      - basicAuthSecretName
                    - required:
                      - sshPrivateKeySecretName