OK Janez. I want to once again stress that you should be using the -streams docker image instead of the -kafka one. Sorry for the confusion on that. It's marked as deprecated but I realize that might not be readily apparent!
Once you switch to the Streams image, you should be able to configure it using Environment Variables:
These are environment variables used by the operator (streams):
QUARKUS_PROFILE = prod
KAFKA_BOOTSTRAP_SERVERS = [Provided by Strimzi, URL with TLS support]
APPLICATION_SERVER_HOST = [Pod IP]
APPLICATION_SERVER_PORT =9000
APPLICATION_ID = example-apicurioregistry
REGISTRY_PROPERTIES_PREFIX = REGISTRY_
REGISTRY_STREAMS_TOPOLOGY_SECURITY_PROTOCOL = SSL
REGISTRY_STREAMS_TOPOLOGY_SSL_KEYSTORE_TYPE = PKCS12
REGISTRY_STREAMS_TOPOLOGY_SSL_KEYSTORE_LOCATION = [Provided by Strimzi, mounted secret]
REGISTRY_STREAMS_TOPOLOGY_SSL_KEYSTORE_PASSWORD = [Provided by Strimzi, secret]
REGISTRY_STREAMS_TOPOLOGY_SSL_TRUSTSTORE_TYPE = PKCS12
REGISTRY_STREAMS_TOPOLOGY_SSL_TRUSTSTORE_LOCATION =[Provided by Strimzi, mounted secret]
REGISTRY_STREAMS_TOPOLOGY_SSL_TRUSTSTORE_PASSWORD [Provided by Strimzi, secret]
REGISTRY_STREAMS_STORAGE-PRODUCER_SECURITY_PROTOCOL = SSL
REGISTRY_STREAMS_STORAGE-PRODUCER_SSL_KEYSTORE_TYPE = PKCS12
REGISTRY_STREAMS_STORAGE-PRODUCER_SSL_KEYSTORE_LOCATION = [Provided by Strimzi, mounted secret]
REGISTRY_STREAMS_STORAGE-PRODUCER_SSL_KEYSTORE_PASSWORD = [Provided by Strimzi, secret]
REGISTRY_STREAMS_STORAGE-PRODUCER_SSL_TRUSTSTORE_TYPE = PKCS12
REGISTRY_STREAMS_STORAGE-PRODUCER_SSL_TRUSTSTORE_LOCATION = [Provided by Strimzi, mounted secret]
REGISTRY_STREAMS_STORAGE-PRODUCER_SSL_TRUSTSTORE_PASSWORD = [Provided by Strimzi, secret]
Hope this helps, I think it can be transformed into Java parameters if needed, but I think for docker ENV vars are probably fine/better.