As a platform operator, I want to extend the CSIDriverConfigSpec in openshift/api to support secret rotation configuration fields, so that cluster administrators can configure rotation behavior declaratively via the operator CR.

Acceptance Criteria

• CSIDriverConfigSpec extended in openshift/api repo with SecretsStore driver-specific configuration
• New driver-specific struct: SSCSIDriverConfigSpec containing:
  • SecretRotation struct with:
    • Enabled (bool) - enable/disable automatic secret rotation
    • PollingInterval (string) - rotation polling interval (duration format)
  • TokenRequests ([]TokenRequest) - for WIF configuration
• Pattern follows existing driver-specific configurations (e.g., AWS EBS, GCP PD)
• API changes follow OpenShift API conventions and versioning
• Generated client code updated (deepcopy, defaulting, validation)
• Backward compatibility maintained (new fields optional)

Technical Details

• File to modify: https://github.com/openshift/api/blob/3f584b29ee4a4faeb1a733e97c5ba16a1e5ee4f8/operator/v1/types_csi_cluster_driver.go#L131
• Add SecretsStore field to CSIDriverConfigSpec struct at line 131
• Create new SSCSIDriverConfigSpec struct with rotation configuration
• Add OpenAPI schema markers for validation
• Run make update to regenerate client code
• Add defaulting logic if needed (e.g., default Enabled: true)

Example API Addition

// In CSIDriverConfigSpec struct (line 131)
type CSIDriverConfigSpec struct {
    // ... existing fields (AWS, GCE, Azure, etc.) ...
    
    // SecretsStore configures the Secrets Store CSI driver
    // +optional
    SecretsStore *SSCSIDriverConfigSpec `json:"secretsStore,omitempty"`
}

// New driver-specific configuration
type SSCSIDriverConfigSpec struct {
    // SecretRotation configures automatic secret rotation behavior
    // +optional
    SecretRotation *SecretRotationConfig `json:"secretRotation,omitempty"`
    
    // TokenRequests configures service account token projection for WIF
    // +optional
    TokenRequests []TokenRequest `json:"tokenRequests,omitempty"`
}

type SecretRotationConfig struct {
    // Enabled controls whether automatic secret rotation is enabled
    // Default: true
    // +optional
    Enabled bool `json:"enabled"`
    
    // PollingInterval specifies how often to poll for secret updates
    // Format: duration string (e.g., "2m", "30s")
    // +optional
    PollingInterval string `json:"pollingInterval,omitempty"`
}

Definition of Done

• PR merged to openshift/api repo with API changes
• API documentation generated
• Client code regenerated successfully
• Unit tests validate new fields
• API changes reviewed by API reviewers