refactor(openlineage): replace authenticationClassRef with credentialsSecretName

AuthenticationClass is a server-side identity abstraction and does not fit
outbound OpenLineage client->backend authentication, which is a static bearer
token. Replace `authentication_class_ref` on OpenLineageConnectionSpec with an
optional `credentials_secret_name` (a Secret holding the api key under `apiKey`)
and drop `resolve_authentication_class`.

See stackabletech/decisions#90

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: razvan

crates/stackable-operator/crds/OpenLineageConnection.yaml

@@ -24,12 +24,11 @@ spec:
               OpenLineage connection definition as a resource.
               Learn more about [OpenLineage](https://openlineage.io/).
             properties:
-              authenticationClassRef:
+              credentialsSecretName:
                 description: |-
-                  Name of an [`AuthenticationClass`](https://docs.stackable.tech/home/nightly/concepts/authentication) used
-                  to authenticate against the OpenLineage backend. The `AuthenticationClass` is cluster-scoped
-                  and referenced by name; it is resolved at runtime via
-                  [`OpenLineageConnectionSpec::resolve_authentication_class`]. If not specified, no
+                  Name of a Secret containing the API key used to authenticate against the OpenLineage
+                  backend. The API key must be stored under the key `apiKey`. The Secret must be located in
+                  the same namespace as the workload using this connection. If not specified, no
                   authentication is used.
                 nullable: true
                 type: string

crates/stackable-operator/src/crd/openlineage/mod.rs

@@ -47,13 +47,12 @@ pub mod versioned {
         #[serde(flatten)]
         pub tls: TlsClientDetails,
 
-        /// Name of an [`AuthenticationClass`](DOCS_BASE_URL_PLACEHOLDER/concepts/authentication) used
-        /// to authenticate against the OpenLineage backend. The `AuthenticationClass` is cluster-scoped
-        /// and referenced by name; it is resolved at runtime via
-        /// [`OpenLineageConnectionSpec::resolve_authentication_class`]. If not specified, no
+        /// Name of a Secret containing the API key used to authenticate against the OpenLineage
+        /// backend. The API key must be stored under the key `apiKey`. The Secret must be located in
+        /// the same namespace as the workload using this connection. If not specified, no
         /// authentication is used.
         #[serde(default, skip_serializing_if = "Option::is_none")]
-        pub authentication_class_ref: Option<String>,
+        pub credentials_secret_name: Option<String>,
     }
 
     /// An OpenLineage connection, either inlined or referenced by the name of an
@@ -108,7 +107,7 @@ impl stackable_versioned::test_utils::RoundtripTestData for v1alpha1::OpenLineag
                       secretClass: openlineage-cert
             - host: marquez
               port: 5000
-              authenticationClassRef: openlineage-auth
+              credentialsSecretName: openlineage-credentials
         "})
         .expect("Failed to parse OpenLineageConnectionSpec YAML")
     }
@@ -129,7 +128,7 @@ mod tests {
             host: "marquez".to_string(),
             port: 5000,
             tls: TlsClientDetails { tls: None },
-            authentication_class_ref: None,
+            credentials_secret_name: None,
         };
 
         assert_eq!(connection.transport_url(), "http://marquez:5000");
@@ -147,7 +146,7 @@ mod tests {
                     }),
                 }),
             },
-            authentication_class_ref: None,
+            credentials_secret_name: None,
         };
 
         assert_eq!(connection.transport_url(), "https://marquez:5000");
@@ -163,7 +162,7 @@ mod tests {
                     verification: TlsVerification::None {},
                 }),
             },
-            authentication_class_ref: None,
+            credentials_secret_name: None,
         };
 
         assert_eq!(connection.transport_url(), "http://marquez:5000");

crates/stackable-operator/src/crd/openlineage/v1alpha1_impl.rs

@@ -2,14 +2,9 @@ use snafu::{ResultExt as _, Snafu};
 
 use crate::{
     client::Client,
-    crd::{
-        authentication::core::v1alpha1::AuthenticationClass,
-        openlineage::{
-            ResolvedOpenLineageConnection,
-            v1alpha1::{
-                InlineConnectionOrReference, OpenLineageConnection, OpenLineageConnectionSpec,
-            },
-        },
+    crd::openlineage::{
+        ResolvedOpenLineageConnection,
+        v1alpha1::{InlineConnectionOrReference, OpenLineageConnection, OpenLineageConnectionSpec},
     },
 };
 
@@ -21,13 +16,6 @@ pub enum OpenLineageError {
         source: Box<crate::client::Error>,
         open_lineage_connection: String,
     },
-
-    #[snafu(display("failed to retrieve AuthenticationClass '{authentication_class}'"))]
-    RetrieveAuthenticationClass {
-        #[snafu(source(from(crate::client::Error, Box::new)))]
-        source: Box<crate::client::Error>,
-        authentication_class: String,
-    },
 }
 
 impl OpenLineageConnectionSpec {
@@ -48,27 +36,6 @@ impl OpenLineageConnectionSpec {
             port = self.port
         )
     }
-
-    /// Resolves the [`AuthenticationClass`] referenced by this connection, if any.
-    ///
-    /// Returns `Ok(None)` when no `authenticationClassRef` is configured. The `AuthenticationClass`
-    /// is cluster-scoped, so no namespace is required.
-    pub async fn resolve_authentication_class(
-        &self,
-        client: &Client,
-    ) -> Result<Option<AuthenticationClass>, OpenLineageError> {
-        let Some(authentication_class_ref) = &self.authentication_class_ref else {
-            return Ok(None);
-        };
-
-        let resolved = AuthenticationClass::resolve(client, authentication_class_ref)
-            .await
-            .context(RetrieveAuthenticationClassSnafu {
-                authentication_class: authentication_class_ref.clone(),
-            })?;
-
-        Ok(Some(resolved))
-    }
 }
 
 impl InlineConnectionOrReference {