fix: Place internal secrets in mutable Kubernetes Secrets (#876)

* fix: Place internal secrets in mutable Kubernetes Secrets

* changelog

* Improve docs

* use op-rs version of internal secrets

* remove unused error variants

* Update rust/operator-binary/src/controller.rs

Co-authored-by: Sebastian Bernauer <sebastian.bernauer@stackable.de>

* rename error variant

---------

Co-authored-by: Razvan-Daniel Mihai <84674+razvan@users.noreply.github.com>

Author: sbernauer

CHANGELOG.md

@@ -9,6 +9,14 @@ All notable changes to this project will be documented in this file.
 - Bump stackable-operator to 0.109.0 ([#877]).
 - Warn when an unsupported OIDC client authentication method is configured ([#877]).
 
+### Fixed
+
+- Previously, the shared secret as well as the client spooling secret have been placed in immutable Kubernetes Secrets.
+  This caused problems, as they have been cached by Kubernetes, so re-creations of the mentioned Secrets (e.g. by deleting and re-creating the stacklet)
+  could cause Trino Pods to have different shared secrets, causing workers failing to join the coordinator.
+  This fix places the secrets in mutable Kubernetes Secrets going forward and migrates existing immutable Secrets to mutable by re-creating them ([#876]).
+
+[#876]: https://github.com/stackabletech/trino-operator/pull/876
 [#877]: https://github.com/stackabletech/trino-operator/pull/877
 
 ## [26.3.0] - 2026-03-16

Cargo.lock

@@ -20,7 +20,6 @@ clap = "4.5"
 const_format = "0.2"
 futures = { version = "0.3", features = ["compat"] }
 indoc = "2.0"
-openssl = "0.10"
 rstest = "0.26"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"

Cargo.nix

@@ -19,7 +19,6 @@ clap.workspace = true
 const_format.workspace = true
 futures.workspace = true
 indoc.workspace = true
-openssl.workspace = true
 snafu.workspace = true
 strum.workspace = true
 tokio.workspace = true