Cluster Security: Add Service Account authentication to the Kafka Agent

[scholzj]

Type of Change

• Task

Description

This PR continues the work on SEP-150: Cluster Security and adds Service Account authentication support for the Kafka Agent and its client.

(The system tests and docs will be delivered in a separate PRs in this stack)

Checklist

• Write tests
• Make sure all tests pass
• Try your changes inside a Kubernetes cluster, not just from unit tests
• AI assistance was used to create this PR (see the Strimzi AI policy)

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[codecov]

Codecov Report

❌ Patch coverage is 94.56522% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 80.85%. Comparing base (94c2363) to head (1855290).

Files with missing lines	Patch %	Lines
...fka/agent/ServiceAccountAuthenticationHandler.java	93.18%	1 Missing and 2 partials ⚠️
...ator/resource/DefaultKafkaAgentClientProvider.java	75.00%	1 Missing ⚠️
...or/cluster/operator/resource/KafkaAgentClient.java	96.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@                                     Coverage Diff                                      @@
##             scholzj/cs3-add-service-account-auth-to-Kafka-protocol   #13108      +/-   ##
============================================================================================
+ Coverage                                                     80.77%   80.85%   +0.08%     
- Complexity                                                     6705     6731      +26     
============================================================================================
  Files                                                           354      355       +1     
  Lines                                                         22981    23062      +81     
  Branches                                                       3139     3145       +6     
============================================================================================
+ Hits                                                          18562    18647      +85     
+ Misses                                                         3194     3187       -7     
- Partials                                                       1225     1228       +3     

Files with missing lines	Coverage Δ
...ster/auth/RequestedServiceAccountAuthIdentity.java	100.00% <100.00%> (ø)
.../cluster/model/KafkaAgentConfigurationBuilder.java	100.00% <100.00%> (ø)
...er/operator/resource/ResourceOperatorSupplier.java	91.48% <ø> (ø)
...c/main/java/io/strimzi/kafka/agent/KafkaAgent.java	59.54% <100.00%> (+1.60%)	⬆️
...ator/resource/DefaultKafkaAgentClientProvider.java	75.00% <75.00%> (+25.00%)	⬆️
...or/cluster/operator/resource/KafkaAgentClient.java	65.33% <96.00%> (+23.51%)	⬆️
...fka/agent/ServiceAccountAuthenticationHandler.java	93.18% <93.18%> (ø)

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.