feat: Enable Kubernetes Secret sourcing for credential fields #321

What would you like to be added?

Add optional *SecretRefNSKey fields to six structs in hlf_types.go to enable Kubernetes Secret sourcing for sensitive credential fields instead of requiring inline strings.

Specifically, add the following fields:

• EnrollsecretSecretRef *SecretRefNSKey to Component struct (after Enrollsecret string)
• EnrollsecretSecretRef *SecretRefNSKey to TLSComponent struct (after Enrollsecret string)
• PasswordSecretRef *SecretRefNSKey to FabricPeerCouchDB struct (after Password string)
• DatasourceSecretRef *SecretRefNSKey to FabricCADatabase struct (after Datasource string)
• PasswordSecretRef *SecretRefNSKey to FabricOperationsConsoleCouchDB struct (after Password string)
• PasswordSecretRef *SecretRefNSKey to FabricOperationsConsoleAuth struct (after Password string)

Each new field must:

• Be of type *SecretRefNSKey (pointer to allow nil/unset distinction)
• Include // +optional and // +nullable kubebuilder markers
• Include omitempty in the JSON struct tag
• Be placed immediately after the corresponding string field it supplements
• Not remove or modify any existing fields

Why is this needed?

Currently, sensitive fields like passwords, enrollment secrets, and datasources must be specified as inline strings in the CRD spec. This creates security risks as these values may be exposed in logs, manifests, or CLI history.

By adding optional SecretRef fields that reference Kubernetes Secrets:

• Users can store sensitive values securely in Kubernetes Secrets
• The operator can fetch these values at runtime without exposing them in the CR
• Maintains backward compatibility - existing inline string fields continue to work
• Follows Kubernetes best practices for handling sensitive data
• Enables integration with secret management tools like Vault, Sealed Secrets, etc.

The SecretRefNSKey struct already exists in the same file and is used elsewhere in the codebase, so no new type definition is needed. This enhancement simply exposes the existing pattern to additional credential fields.

Implementation approach:

1. Add the six new SecretRef fields to hlf_types.go
2. Update controller reconciliation logic to check SecretRef first, fall back to inline value
3. Regenerate deepcopy/zz_generated files
4. Run full build verification