Support multiple CAs in the Clients CA secret

Today, we officially support only a single Clients CA (=> since public CA in the Kafka truststore). However, sometimes, users are interested in using multiple CAs at the same time. We never designed for it. But it works when you just add multiple CRT files into the Clients CA secret. E.g. ca.crt and ca-2.crt. This of course does not work with User Operator and type: tls authentication. But it works fine for users with type: tls-external. We should consider if we want to support this officially. In that case, we should document it and add STs to make sure we keep this working. And decide if we need something more with regards to rolling etc.

One of the examples where this was discussed is #6559

[scholzj]

There is no update on this. I do not think this issue depends on the existing proposal about CA abstraction, I think it can be worked on separately as well.

[scholzj]

The start for this would be to write a proposal of how it could be implemented. You can check some of the existing proposals to see how the look like and what they contain: https://github.com/strimzi/proposals … you can basically just open the PR there with the proposal.

I would be a bit careful about mixing a custom CA with Strimzi managed CA. I think that in general increase the risks of things breaking, overwriting each other etc. I also wonder if it matches any use-cases for this. What would be the use case for the mixed CAs like that? But if you think it ia possible, then it can be of course part of the proposal.