fix merge conflicts

Author: adwk67

CHANGELOG.md

@@ -11,9 +11,13 @@ All notable changes to this project will be documented in this file.
 ### Changed
 
 - Document Helm deployed RBAC permissions and remove unnecessary permissions ([#916]).
+- BREAKING: `configOverrides` now only accepts `bootstrap.conf`, `nifi.properties` and `security.properties`.
+  Previously, arbitrary keys were silently accepted but ignored ([#921]).
+- Bump `stackable-operator` to 0.110.1 and `kube` to 3.1.0 ([#921]).
 
 [#903]: https://github.com/stackabletech/nifi-operator/pull/903
 [#916]: https://github.com/stackabletech/nifi-operator/pull/916
+[#921]: https://github.com/stackabletech/nifi-operator/pull/921
 
 ## [26.3.0] - 2026-03-16
 

Cargo.lock

@@ -196,13 +196,16 @@ pub mod versioned {
     #[derive(Clone, Debug, Default, Deserialize, JsonSchema, PartialEq, Serialize)]
     #[serde(rename_all = "camelCase")]
     pub struct NifiConfigOverrides {
-        #[serde(rename = "bootstrap.conf")]
+        #[serde(rename = "bootstrap.conf", skip_serializing_if = "Option::is_none")]
         pub bootstrap_conf: Option<KeyValueConfigOverrides>,
 
-        #[serde(rename = "nifi.properties")]
+        #[serde(rename = "nifi.properties", skip_serializing_if = "Option::is_none")]
         pub nifi_properties: Option<KeyValueConfigOverrides>,
 
-        #[serde(rename = "security.properties")]
+        #[serde(
+            rename = "security.properties",
+            skip_serializing_if = "Option::is_none"
+        )]
         pub security_properties: Option<KeyValueConfigOverrides>,
     }
 }

Cargo.nix

@@ -243,6 +243,7 @@ impl ResolvedNifiAuthorizationConfig {
                     .ephemeral(
                         SecretOperatorVolumeSourceBuilder::new(
                             secret_class,
+                            // NiFi needs the public CA certificate to verify the OPA server's cert.
                             SecretClassVolumeProvisionParts::Public,
                         )
                         .build()

rust/operator-binary/src/crd/mod.rs

@@ -30,10 +30,10 @@ pub(crate) fn build_tls_volume(
     requested_secret_lifetime: &Duration,
     listener_scope: Option<&str>,
 ) -> Result<Volume> {
-    // NiFi serves its own TLS endpoints, so the Pod needs both the public
-    // certificate and the private key.
     let mut secret_volume_source_builder = SecretOperatorVolumeSourceBuilder::new(
         nifi.server_tls_secret_class(),
+        // NiFi serves its own TLS endpoints, so the Pod needs both the public
+        // certificate and the private key.
         SecretClassVolumeProvisionParts::PublicPrivate,
     );