fix: do not recreate immutable secrets with different values

Author: razvan

CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+### Fixed
+
+- Do not make internal secrets immutable. Immutable secrets are cached and (accidental) deletes can render the cluster unusable ([#875]).
+
+[#875]: https://github.com/stackabletech/trino-operator/pull/875
+
 ## [26.3.0] - 2026-03-16
 
 ## [26.3.0-rc1] - 2026-03-16

rust/operator-binary/src/controller.rs

@@ -1536,7 +1536,10 @@ async fn create_random_secret(
     internal_secret.insert(secret_key.to_string(), get_random_base64(secret_byte_size));
 
     let secret = Secret {
-        immutable: Some(true),
+        // This secret used to be immutable but immutable secrets cannot be modified
+        // as they are heavily cached by Kubernetes.
+        // Different pods with different secrets will render the cluster unusable.
+        immutable: Some(false),
         metadata: ObjectMetaBuilder::new()
             .name(secret_name)
             .namespace_opt(trino.namespace())