refactor(openlineage): use credentialsSecretName instead of AuthenticationClass

Follows the operator-rs change: OpenLineage backend auth is a static bearer
token, so drop the AuthenticationClass resolution and read the api key from the
connection's `credentialsSecretName` Secret (key `apiKey`) directly.

See stackabletech/decisions#90

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: razvan

CHANGELOG.md

@@ -4,7 +4,7 @@
 
 ### Added
 
-- Support for emitting [OpenLineage](https://openlineage.io/) lineage events via `spec.clusterConfig.openLineage`, either with an inline connection or a reference to an `OpenLineageConnection`, with optional TLS and Static-provider API-key authentication. Requires the `apache-airflow-providers-openlineage` provider to be installed in the product image ([#XXXX]).
+- Support for emitting [OpenLineage](https://openlineage.io/) lineage events via `spec.clusterConfig.openLineage`, either with an inline connection or a reference to an `OpenLineageConnection`, with optional TLS and API-key authentication via a `credentialsSecretName` Secret. Requires the `apache-airflow-providers-openlineage` provider to be installed in the product image ([#XXXX]).
 - BREAKING: Add required CLI argument and env var to set the image repository used to construct final product image names: `IMAGE_REPOSITORY` (`--image-repository`), eg. `oci.example.org/my/namespace` ([#784]).
 - Support for passing CAs to GitSync ([#750]).
 - Support setting `clientAuthenticationMethod` for OIDC authentication. The value is passed through to the Flask-AppBuilder config as `token_endpoint_auth_method` ([#765]).

Cargo.lock

@@ -96,10 +96,9 @@ Use `verification.server.caCert.webPki` to verify against the common public CAs
 
 == Authentication
 
-If the backend requires a bearer token, reference a xref:concepts:authentication.adoc[Static AuthenticationClass].
-Only the `static` provider is supported.
-
-The referenced Secret must contain the token under the fixed key `apiKey`:
+If the backend requires a bearer token, set `credentialsSecretName` on the connection to the name of
+a Secret containing the token. The Secret must contain the token under the fixed key `apiKey` and must
+live in the same namespace as the cluster:
 
 [source,yaml]
 ----
@@ -109,16 +108,6 @@ metadata:
   name: openlineage-credentials
 stringData:
   apiKey: "<your-token>"  # <1>
----
-apiVersion: authentication.stackable.tech/v1alpha1
-kind: AuthenticationClass
-metadata:
-  name: openlineage-auth
-spec:
-  provider:
-    static:
-      userCredentialsSecret:
-        name: openlineage-credentials
 ----
 <1> The bearer token, under the fixed key `apiKey`.
 
@@ -129,9 +118,9 @@ openLineage:
     inline:
       host: marquez
       port: 5000
-      authenticationClassRef: openlineage-auth  # <1>
+      credentialsSecretName: openlineage-credentials  # <1>
 ----
-<1> Name of the cluster-scoped `AuthenticationClass`.
+<1> Name of the Secret holding the API key.
 
 The token is injected into the Airflow pods from the Secret via a `secretKeyRef` environment variable.
 It never appears in the CRD, a ConfigMap, or a plaintext environment value.

Cargo.nix

@@ -1535,12 +1535,11 @@ spec:
                               OpenLineage connection definition as a resource.
                               Learn more about [OpenLineage](https://openlineage.io/).
                             properties:
-                              authenticationClassRef:
+                              credentialsSecretName:
                                 description: |-
-                                  Name of an [`AuthenticationClass`](https://docs.stackable.tech/home/nightly/concepts/authentication) used
-                                  to authenticate against the OpenLineage backend. The `AuthenticationClass` is cluster-scoped
-                                  and referenced by name; it is resolved at runtime via
-                                  [`OpenLineageConnectionSpec::resolve_authentication_class`]. If not specified, no
+                                  Name of a Secret containing the API key used to authenticate against the OpenLineage
+                                  backend. The API key must be stored under the key `apiKey`. The Secret must be located in
+                                  the same namespace as the workload using this connection. If not specified, no
                                   authentication is used.
                                 nullable: true
                                 type: string
@@ -7849,12 +7848,11 @@ spec:
                               OpenLineage connection definition as a resource.
                               Learn more about [OpenLineage](https://openlineage.io/).
                             properties:
-                              authenticationClassRef:
+                              credentialsSecretName:
                                 description: |-
-                                  Name of an [`AuthenticationClass`](https://docs.stackable.tech/home/nightly/concepts/authentication) used
-                                  to authenticate against the OpenLineage backend. The `AuthenticationClass` is cluster-scoped
-                                  and referenced by name; it is resolved at runtime via
-                                  [`OpenLineageConnectionSpec::resolve_authentication_class`]. If not specified, no
+                                  Name of a Secret containing the API key used to authenticate against the OpenLineage
+                                  backend. The API key must be stored under the key `apiKey`. The Secret must be located in
+                                  the same namespace as the workload using this connection. If not specified, no
                                   authentication is used.
                                 nullable: true
                                 type: string
@@ -12692,12 +12690,11 @@ spec:
               OpenLineage connection definition as a resource.
               Learn more about [OpenLineage](https://openlineage.io/).
             properties:
-              authenticationClassRef:
+              credentialsSecretName:
                 description: |-
-                  Name of an [`AuthenticationClass`](https://docs.stackable.tech/home/nightly/concepts/authentication) used
-                  to authenticate against the OpenLineage backend. The `AuthenticationClass` is cluster-scoped
-                  and referenced by name; it is resolved at runtime via
-                  [`OpenLineageConnectionSpec::resolve_authentication_class`]. If not specified, no
+                  Name of a Secret containing the API key used to authenticate against the OpenLineage
+                  backend. The API key must be stored under the key `apiKey`. The Secret must be located in
+                  the same namespace as the workload using this connection. If not specified, no
                   authentication is used.
                 nullable: true
                 type: string