feat(sync): Support Kerberos authentication for HDFS sync

[sw-cho]

#103

Support kerberos authentication to sync to/from HDFS.

• JuiceFS client already supports Kerberos authentication via environment variables
  • https://github.com/juicedata/juicefs/blob/main/pkg/object/hdfs_kerberos.go
• Add the kerberos related fields to SyncSinkExternal
  • krb5Keytab: Path to the keytab file.
  • krb5KeytabBase64: Base64 encoded keytab content.
  • krb5Principal: The Kerberos principal to use.
• export these values as environment variables in preparecommand
• Prevent HDFS-to-HDFS sync because kerberos envs cannot be distinguished between source and destination.

[Copilot]

Pull request overview

This PR adds Kerberos authentication support for HDFS sync operations in the JuiceFS operator. The implementation leverages existing JuiceFS client support for Kerberos via environment variables.

Changes:

• Added three new Kerberos-related fields to the SyncSinkExternal API (KRB5Keytab, KRB5KeytabBase64, KRB5Principal)
• Implemented environment variable mapping and export logic for Kerberos credentials in the sync preparation pipeline
• Added validation to prevent HDFS-to-HDFS sync operations due to environment variable collision concerns

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
api/v1/sync_types.go	Added Kerberos credential fields (KRB5Keytab, KRB5KeytabBase64, KRB5Principal) to SyncSinkExternal struct
api/v1/zz_generated.deepcopy.go	Auto-generated deep copy methods for new Kerberos fields
config/crd/bases/juicefs.io_syncs.yaml	Added CRD schema definitions for Kerberos fields in sync resources
config/crd/bases/juicefs.io_cronsyncs.yaml	Added CRD schema definitions for Kerberos fields in cronsync resources
pkg/utils/sync.go	Implemented logic to process Kerberos fields and export them as environment variables for HDFS schemes
pkg/builder/sync_secret.go	Added secret generation logic for Kerberos credential values
pkg/utils/sync_test.go	Added unit tests for HDFS sync with Kerberos authentication scenarios
internal/controller/sync_controller.go	Added validation to reject HDFS-to-HDFS sync operations

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.