fix: do not make internal secrets immutable

Author: razvan

CHANGELOG.md

@@ -6,7 +6,12 @@
 
 - Document Helm deployed RBAC permissions and remove unnecessary permissions ([#767]).
 
+### Fixed
+
+- Do not make internal secrets immutable. Immutable secrets are cached and (accidental) deletes can render the cluster unusable ([#769]).
+
 - [#767]: https://github.com/stackabletech/airflow-operator/pull/767
+- [#769]: https://github.com/stackabletech/airflow-operator/pull/769
 
 ## [26.3.0] - 2026-03-16
 

rust/operator-binary/src/crd/internal_secret.rs

@@ -73,7 +73,10 @@ pub async fn create_random_secret(
     internal_secret.insert(secret_key.to_string(), get_random_base64(secret_byte_size)?);
 
     let secret = Secret {
-        immutable: Some(true),
+        // This secret used to be immutable but immutable secrets cannot be modified
+        // as they are heavily cached by Kubernetes.
+        // Different pods with different secrets will render the cluster unusable.
+        immutable: Some(false),
         metadata: ObjectMetaBuilder::new()
             .name(secret_name)
             .namespace_opt(airflow.namespace())