From c4c298f24c9f31fe7865917e0986dee452b5a15c Mon Sep 17 00:00:00 2001
From: Malte Sander <malte.sander.it@gmail.com>
Date: Wed, 3 Jun 2026 14:28:24 +0200
Subject: [PATCH 01/21] chore: switch to smooth-operator branch and vendor the
 config writer

Activate the operator-rs smooth-operator patch (matching trino/hdfs) and add a
vendored Hadoop XML / Java-properties writer copied from hdfs-operator, so the
operator no longer needs product-config for rendering. Reroute discovery and the
controller to the vendored writer.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 Cargo.lock                                   | 643 +++++++++----------
 Cargo.toml                                   |   6 +-
 rust/operator-binary/Cargo.toml              |   2 +
 rust/operator-binary/src/config/mod.rs       |   1 +
 rust/operator-binary/src/config/writer.rs    | 145 +++++
 rust/operator-binary/src/discovery.rs        |   2 +-
 rust/operator-binary/src/hbase_controller.rs |  15 +-
 7 files changed, 456 insertions(+), 358 deletions(-)
 create mode 100644 rust/operator-binary/src/config/writer.rs

diff --git a/Cargo.lock b/Cargo.lock
index 3d1d136e..18141326 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -47,9 +47,9 @@ dependencies = [
 
 [[package]]
 name = "anstream"
-version = "0.6.21"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43d5b281e737544384e969a5ccad3f1cdd24b48086a0fc1b2a5262a26b8f4f4a"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
 dependencies = [
  "anstyle",
  "anstyle-parse",
@@ -62,15 +62,15 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.13"
+version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5192cca8006f1fd4f7237516f40fa183bb07f8fbdfedaa0036de5ea9b0b45e78"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.7"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
 dependencies = [
  "utf8parse",
 ]
@@ -103,9 +103,9 @@ checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
 
 [[package]]
 name = "arc-swap"
-version = "1.8.2"
+version = "1.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9f3647c145568cec02c42054e07bdf9a5a698e15b466fb2341bfc393cd24aa5"
+checksum = "6a3a1fd6f75306b68087b831f025c712524bcb19aad54e557b1129cfa0a2b207"
 dependencies = [
  "rustversion",
 ]
@@ -163,15 +163,15 @@ checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
 [[package]]
 name = "autocfg"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "axum"
-version = "0.8.8"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b52af3cb4058c895d37317bb27508dccc8e5f2d39454016b297bf4a400597b8"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
 dependencies = [
  "axum-core",
  "bytes",
@@ -265,9 +265,9 @@ checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
 
 [[package]]
 name = "bitflags"
-version = "2.11.0"
+version = "2.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af"
+checksum = "84d7ced0ae9557296835c32bf1b1e02b44c746701f898460fb000d7eaa84f00a"
 
 [[package]]
 name = "block-buffer"
@@ -280,9 +280,9 @@ dependencies = [
 
 [[package]]
 name = "built"
-version = "0.8.0"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4ad8f11f288f48ca24471bbd51ac257aaeaaa07adae295591266b792902ae64"
+checksum = "5c0e531d93d39c34eef561e929e8a7f86d77a5af08aac4f6d6e39976c51858e9"
 dependencies = [
  "chrono",
  "git2",
@@ -290,9 +290,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.20.2"
+version = "3.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 
 [[package]]
 name = "bytes"
@@ -302,9 +302,9 @@ checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 
 [[package]]
 name = "cc"
-version = "1.2.56"
+version = "1.2.63"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aebf35691d1bfb0ac386a69bac2fde4dd276fb618cf8bf4f5318fe285e821bb2"
+checksum = "556e016178bb5662a08681bbe0f00f8e17631781a4dfc8c45e466e4b185ec27f"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -331,9 +331,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.60"
+version = "4.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2797f34da339ce31042b27d23607e051786132987f595b02ba4f6a6dffb7030a"
+checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -341,9 +341,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.60"
+version = "4.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24a241312cea5059b13574bb9b3861cabf758b879c15190b37b6d6fd63ab6876"
+checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
 dependencies = [
  "anstream",
  "anstyle",
@@ -353,9 +353,9 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.5.55"
+version = "4.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a92793da1a46a5f2a02a6f4c46c6496b28c43638adea8306fcb0caa1634f24e5"
+checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -365,15 +365,15 @@ dependencies = [
 
 [[package]]
 name = "clap_lex"
-version = "1.0.0"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a822ea5bc7590f9d40f1ba12c0dc3c2760f3482c6984db1573ad11031420831"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
 
 [[package]]
 name = "colorchoice"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
 
 [[package]]
 name = "concurrent-queue"
@@ -392,11 +392,12 @@ checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 
 [[package]]
 name = "const_format"
-version = "0.2.35"
+version = "0.2.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7faa7469a93a566e9ccc1c73fe783b4a65c274c5ace346038dca9c39fe0030ad"
+checksum = "4481a617ad9a412be3b97c5d403fef8ed023103368908b9c50af598ff467cc1e"
 dependencies = [
  "const_format_proc_macros",
+ "konst",
 ]
 
 [[package]]
@@ -612,9 +613,9 @@ dependencies = [
 
 [[package]]
 name = "displaydoc"
-version = "0.2.5"
+version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -675,9 +676,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.15.0"
+version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
 
 [[package]]
 name = "elliptic-curve"
@@ -787,9 +788,9 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.3.0"
+version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
 
 [[package]]
 name = "ff"
@@ -923,9 +924,9 @@ checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
 
 [[package]]
 name = "futures-timer"
-version = "3.0.3"
+version = "3.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f288b0a4f20f9a56b5d1da57e2227c661b7b16168e2f72365f57b63326e29b24"
+checksum = "af43fadb8a98512d547e37b4e92e0ced13e205c061b87b4623eff01d918d6968"
 
 [[package]]
 name = "futures-util"
@@ -982,15 +983,14 @@ dependencies = [
 
 [[package]]
 name = "git2"
-version = "0.20.4"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b88256088d75a56f8ecfa070513a775dd9107f6530ef14919dac831af9cfe2b"
+checksum = "ddddbf932745a6be37109b6112d3ee09696106f848449069d3a57bba937ab82e"
 dependencies = [
  "bitflags",
  "libc",
  "libgit2-sys",
  "log",
- "url",
 ]
 
 [[package]]
@@ -1024,9 +1024,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.13"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
+checksum = "171fefbc92fe4a4de27e0698d6a5b392d6a0e333506bc49133760b3bcf948733"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -1052,6 +1052,12 @@ dependencies = [
  "foldhash",
 ]
 
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
 [[package]]
 name = "heck"
 version = "0.5.0"
@@ -1080,9 +1086,9 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "1.4.0"
+version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
+checksum = "8be7462df143984c4598a256ef469b251d7d7f9e271135073e78fc535414f3d0"
 dependencies = [
  "bytes",
  "itoa",
@@ -1131,9 +1137,9 @@ checksum = "135b12329e5e3ce057a9f972339ea52bc954fe1e9358ef27f95e89716fbc5424"
 
 [[package]]
 name = "hyper"
-version = "1.8.1"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ab2d4f250c3d7b1c9fcdff1cece94ea4e2dfbec68614f7b87cb205f24ca9d11"
+checksum = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -1146,7 +1152,6 @@ dependencies = [
  "httpdate",
  "itoa",
  "pin-project-lite",
- "pin-utils",
  "smallvec",
  "tokio",
  "want",
@@ -1154,9 +1159,9 @@ dependencies = [
 
 [[package]]
 name = "hyper-rustls"
-version = "0.27.7"
+version = "0.27.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
+checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
 dependencies = [
  "http",
  "hyper",
@@ -1164,7 +1169,6 @@ dependencies = [
  "log",
  "rustls",
  "rustls-native-certs",
- "rustls-pki-types",
  "tokio",
  "tokio-rustls",
  "tower-service",
@@ -1232,12 +1236,13 @@ dependencies = [
 
 [[package]]
 name = "icu_collections"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c6b649701667bbe825c3b7e6388cb521c23d88644678e83c0c4d0a621a34b43"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
 dependencies = [
  "displaydoc",
  "potential_utf",
+ "utf8_iter",
  "yoke",
  "zerofrom",
  "zerovec",
@@ -1245,9 +1250,9 @@ dependencies = [
 
 [[package]]
 name = "icu_locale_core"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edba7861004dd3714265b4db54a3c390e880ab658fec5f7db895fae2046b5bb6"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
 dependencies = [
  "displaydoc",
  "litemap",
@@ -1258,9 +1263,9 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f6c8828b67bf8908d82127b2054ea1b4427ff0230ee9141c54251934ab1b599"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
 dependencies = [
  "icu_collections",
  "icu_normalizer_data",
@@ -1272,15 +1277,15 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer_data"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7aedcccd01fc5fe81e6b489c15b247b8b0690feb23304303a9e560f37efc560a"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
 
 [[package]]
 name = "icu_properties"
-version = "2.1.2"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "020bfc02fe870ec3a66d93e677ccca0562506e5872c650f893269e08615d74ec"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
 dependencies = [
  "icu_collections",
  "icu_locale_core",
@@ -1292,15 +1297,15 @@ dependencies = [
 
 [[package]]
 name = "icu_properties_data"
-version = "2.1.2"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "616c294cf8d725c6afcd8f55abc17c56464ef6211f9ed59cccffe534129c77af"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
 
 [[package]]
 name = "icu_provider"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85962cf0ce02e1e0a629cc34e7ca3e373ce20dda4c4d7294bbd0bf1fdb59e614"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
@@ -1330,9 +1335,9 @@ dependencies = [
 
 [[package]]
 name = "idna_adapter"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
 dependencies = [
  "icu_normalizer",
  "icu_properties",
@@ -1340,12 +1345,12 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.13.0"
+version = "2.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7714e70437a7dc3ac8eb7e6f8df75fd8eb422675fc7678aff7364301092b1017"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
- "hashbrown",
+ "hashbrown 0.17.1",
 ]
 
 [[package]]
@@ -1359,19 +1364,9 @@ dependencies = [
 
 [[package]]
 name = "ipnet"
-version = "2.11.0"
+version = "2.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130"
-
-[[package]]
-name = "iri-string"
-version = "0.7.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c91338f0783edbd6195decb37bae672fd3b165faffb89bf7b9e6942f8b1a731a"
-dependencies = [
- "memchr",
- "serde",
-]
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
 
 [[package]]
 name = "is_terminal_polyfill"
@@ -1390,9 +1385,9 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.17"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "java-properties"
@@ -1407,9 +1402,9 @@ dependencies = [
 
 [[package]]
 name = "jiff"
-version = "0.2.21"
+version = "0.2.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3e3d65f018c6ae946ab16e80944b97096ed73c35b221d1c478a6c81d8f57940"
+checksum = "4603d3033e49e2b0e31229fcab20a5d40089c607d975cd9c80551dc69eed9102"
 dependencies = [
  "jiff-static",
  "jiff-tzdb-platform",
@@ -1417,14 +1412,14 @@ dependencies = [
  "portable-atomic",
  "portable-atomic-util",
  "serde_core",
- "windows-sys 0.61.2",
+ "windows-link",
 ]
 
 [[package]]
 name = "jiff-static"
-version = "0.2.21"
+version = "0.2.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a17c2b211d863c7fde02cbea8a3c1a439b98e109286554f2860bdded7ff83818"
+checksum = "782d32378dddf207193ac91cefb848ad41abb58195c95168e1291227a0832b47"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1433,9 +1428,9 @@ dependencies = [
 
 [[package]]
 name = "jiff-tzdb"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68971ebff725b9e2ca27a601c5eb38a4c5d64422c4cbab0c535f248087eda5c2"
+checksum = "c900ef84826f1338a557697dc8fc601df9ca9af4ac137c7fb61d4c6f2dfd3076"
 
 [[package]]
 name = "jiff-tzdb-platform"
@@ -1458,24 +1453,27 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.90"
+version = "0.3.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14dc6f6450b3f6d4ed5b16327f38fed626d375a886159ca555bd7822c0c3a5a6"
+checksum = "142bc4740e452c1e57ade0cbc129f139c9093e354346f0872ef985f4f5cf5f11"
 dependencies = [
+ "cfg-if",
+ "futures-util",
  "once_cell",
  "wasm-bindgen",
 ]
 
 [[package]]
 name = "json-patch"
-version = "4.1.0"
+version = "4.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f300e415e2134745ef75f04562dd0145405c2f7fd92065db029ac4b16b57fe90"
+checksum = "7421438de105a0827e44fadd05377727847d717c80ce29a229f85fd04c427b72"
 dependencies = [
  "jsonptr",
+ "schemars",
  "serde",
  "serde_json",
- "thiserror 1.0.69",
+ "thiserror 2.0.18",
 ]
 
 [[package]]
@@ -1503,9 +1501,9 @@ dependencies = [
 
 [[package]]
 name = "k8s-openapi"
-version = "0.27.0"
+version = "0.27.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05a6d6f3611ad1d21732adbd7a2e921f598af6c92d71ae6e2620da4b67ee1f0d"
+checksum = "51b326f5219dd55872a72c1b6ddd1b830b8334996c667449c29391d657d78d5e"
 dependencies = [
  "base64",
  "jiff",
@@ -1517,13 +1515,28 @@ dependencies = [
 [[package]]
 name = "k8s-version"
 version = "0.1.3"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.111.1#7a5f0c3fbcd091340214a23f0607fcd4b4fcc152"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#a31cd2514445b251038fc4ea7abc28c57b2a6ad9"
 dependencies = [
  "darling",
  "regex",
- "snafu 0.9.0",
+ "snafu 0.9.1",
+]
+
+[[package]]
+name = "konst"
+version = "0.2.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "128133ed7824fcd73d6e7b17957c5eb7bacb885649bd8c69708b2331a10bcefb"
+dependencies = [
+ "konst_macro_rules",
 ]
 
+[[package]]
+name = "konst_macro_rules"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4933f3f57a8e9d9da04db23fb153356ecaf00cbd14aee46279c33dc80925c37"
+
 [[package]]
 name = "kube"
 version = "3.1.0"
@@ -1617,7 +1630,7 @@ dependencies = [
  "backon",
  "educe",
  "futures 0.3.32",
- "hashbrown",
+ "hashbrown 0.16.1",
  "hostname",
  "json-patch",
  "k8s-openapi",
@@ -1643,15 +1656,15 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.182"
+version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6800badb6cb2082ffd7b6a67e6125bb39f18782f793520caee8cb8846be06112"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 
 [[package]]
 name = "libgit2-sys"
-version = "0.18.3+1.9.2"
+version = "0.18.5+1.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9b3acc4b91781bb0b3386669d325163746af5f6e4f73e6d2d630e09a35f3487"
+checksum = "005d6ae6eac1912906073e069f7db60b1fa98e052a68227824afe3e3a1c59ca2"
 dependencies = [
  "cc",
  "libc",
@@ -1667,9 +1680,9 @@ checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 
 [[package]]
 name = "libz-sys"
-version = "1.1.24"
+version = "1.1.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4735e9cbde5aac84a5ce588f6b23a90b9b0b528f6c5a8db8a4aff300463a0839"
+checksum = "85bc9657773828b90eeb625adff10eeac83cc21bbfd8e23a03eaa8a33c9e28d9"
 dependencies = [
  "cc",
  "libc",
@@ -1679,9 +1692,9 @@ dependencies = [
 
 [[package]]
 name = "litemap"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6373607a59f0be73a39b6fe456b8192fcc3585f602af20751600e974dd455e77"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
 
 [[package]]
 name = "lock_api"
@@ -1694,9 +1707,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.29"
+version = "0.4.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+checksum = "113b30b4cd05f7c06868fdb2854f66a7b9fece9a48425351cd532e810d74024f"
 
 [[package]]
 name = "matchers"
@@ -1715,9 +1728,9 @@ checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
 
 [[package]]
 name = "memchr"
-version = "2.8.0"
+version = "2.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
+checksum = "6b947ae49db0d222b1dbc6b113ce7248a3fc3a6ca21b696717bfc000ba4484d8"
 
 [[package]]
 name = "mime"
@@ -1737,9 +1750,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.1.1"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a69bcab0ad47271a0234d9422b131806bf3968021e5dc9328caf2d4cd58557fc"
+checksum = "02bd0af71c67b473010cbbc60715ee815645a4dc942899111f494b4b737d6fda"
 dependencies = [
  "libc",
  "wasi",
@@ -1766,16 +1779,16 @@ dependencies = [
  "num-integer",
  "num-iter",
  "num-traits",
- "rand 0.8.5",
+ "rand 0.8.6",
  "smallvec",
  "zeroize",
 ]
 
 [[package]]
 name = "num-conv"
-version = "0.2.0"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf97ec579c3c42f953ef76dbf8d55ac91fb219dde70e49aa4a6b7d74e9919050"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
 
 [[package]]
 name = "num-integer"
@@ -1809,9 +1822,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.21.3"
+version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
 [[package]]
 name = "once_cell_polyfill"
@@ -1866,9 +1879,9 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry-otlp"
-version = "0.31.0"
+version = "0.31.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2366db2dca4d2ad033cad11e6ee42844fd727007af5ad04a1730f4cb8163bf"
+checksum = "1f69cd6acbb9af919df949cd1ec9e5e7fdc2ef15d234b6b795aaa525cc02f71f"
 dependencies = [
  "http",
  "opentelemetry",
@@ -1913,7 +1926,7 @@ dependencies = [
  "futures-util",
  "opentelemetry",
  "percent-encoding",
- "rand 0.9.2",
+ "rand 0.9.4",
  "thiserror 2.0.18",
  "tokio",
  "tokio-stream",
@@ -2039,18 +2052,18 @@ dependencies = [
 
 [[package]]
 name = "pin-project"
-version = "1.1.10"
+version = "1.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "677f1add503faace112b9f1373e43e9e054bfdd22ff1a63c1bc485eaec6a6a8a"
+checksum = "2466b2336ed02bcdca6b294417127b90ec92038d1d5c4fbeac971a922e0e0924"
 dependencies = [
  "pin-project-internal",
 ]
 
 [[package]]
 name = "pin-project-internal"
-version = "1.1.10"
+version = "1.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e918e4ff8c4549eb882f14b3a4bc8c8bc93de829416eacf579f1207a8fbf861"
+checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2059,15 +2072,9 @@ dependencies = [
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
-
-[[package]]
-name = "pin-utils"
-version = "0.1.0"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
 [[package]]
 name = "pkcs1"
@@ -2092,9 +2099,9 @@ dependencies = [
 
 [[package]]
 name = "pkg-config"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
 
 [[package]]
 name = "portable-atomic"
@@ -2104,18 +2111,18 @@ checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
 
 [[package]]
 name = "portable-atomic-util"
-version = "0.2.5"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a9db96d7fa8782dd8c15ce32ffe8680bbd1e978a43bf51a34d39483540495f5"
+checksum = "c2a106d1259c23fac8e543272398ae0e3c0b8d33c88ed73d0cc71b0f1d902618"
 dependencies = [
  "portable-atomic",
 ]
 
 [[package]]
 name = "potential_utf"
-version = "0.1.4"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b73949432f5e2a09657003c25bca5e19a0e9c84f8058ca374f49e0ebe605af77"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
 dependencies = [
  "zerovec",
 ]
@@ -2146,9 +2153,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro-crate"
-version = "3.4.0"
+version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "219cb19e96be00ab2e37d6e299658a0cfa83e52429179969b0f0121b4ac46983"
+checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
 dependencies = [
  "toml_edit",
 ]
@@ -2203,9 +2210,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.44"
+version = "1.0.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21b2ebcf727b7760c461f091f9f0f539b77b8e87f2fd88131e7f1b433b3cece4"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
 dependencies = [
  "proc-macro2",
 ]
@@ -2218,9 +2225,9 @@ checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 
 [[package]]
 name = "rand"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
 dependencies = [
  "rand_chacha 0.3.1",
  "rand_core 0.6.4",
@@ -2228,9 +2235,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.9.2"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
 dependencies = [
  "rand_chacha 0.9.0",
  "rand_core 0.9.5",
@@ -2457,9 +2464,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.37"
+version = "0.23.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "758025cb5fccfd3bc2fd74708fd4682be41d99e5dff73c377c0646c6012c73a4"
+checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
 dependencies = [
  "log",
  "once_cell",
@@ -2472,9 +2479,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-native-certs"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "612460d5f7bea540c490b2b6395d8e34a953e52b491accd6c86c8164c5932a63"
+checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
 dependencies = [
  "openssl-probe",
  "rustls-pki-types",
@@ -2484,9 +2491,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.14.0"
+version = "1.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be040f8b0a225e40375822a563fa9524378b9d63112f53e19ffff34df5d33fdd"
+checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9"
 dependencies = [
  "zeroize",
 ]
@@ -2516,9 +2523,9 @@ checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
 [[package]]
 name = "schannel"
-version = "0.1.28"
+version = "0.1.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "891d81b926048e76efe18581bf793546b4c0eaf8448d72be8de2bbee5fd166e1"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
 dependencies = [
  "windows-sys 0.61.2",
 ]
@@ -2603,9 +2610,9 @@ dependencies = [
 
 [[package]]
 name = "semver"
-version = "1.0.27"
+version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
 
 [[package]]
 name = "serde"
@@ -2660,9 +2667,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.149"
+version = "1.0.150"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
 dependencies = [
  "itoa",
  "memchr",
@@ -2746,9 +2753,9 @@ checksum = "45bb67a18fa91266cc7807181f62f9178a6873bfad7dc788c42e6430db40184f"
 
 [[package]]
 name = "shlex"
-version = "1.3.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
 [[package]]
 name = "signal-hook-registry"
@@ -2772,9 +2779,9 @@ dependencies = [
 
 [[package]]
 name = "simd-adler32"
-version = "0.3.8"
+version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e320a6c5ad31d271ad523dcf3ad13e2767ad8b1cb8f047f75a8aeaf8da139da2"
+checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
 
 [[package]]
 name = "slab"
@@ -2809,11 +2816,11 @@ dependencies = [
 
 [[package]]
 name = "snafu"
-version = "0.9.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1d4bced6a69f90b2056c03dcff2c4737f98d6fb9e0853493996e1d253ca29c6"
+checksum = "d1a012328be2e3f5d5f6f3218147ca02588cea4cb865e876849ab6debcf36522"
 dependencies = [
- "snafu-derive 0.9.0",
+ "snafu-derive 0.9.1",
 ]
 
 [[package]]
@@ -2841,9 +2848,9 @@ dependencies = [
 
 [[package]]
 name = "snafu-derive"
-version = "0.9.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54254b8531cafa275c5e096f62d48c81435d1015405a91198ddb11e967301d40"
+checksum = "5f103c50866b8743da9429b8a581d81a27c2d3a9c4ac7df8f8571c1dd7896eda"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -2853,12 +2860,12 @@ dependencies = [
 
 [[package]]
 name = "socket2"
-version = "0.6.2"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86f4aa3ad99f2088c990dfa82d367e19cb29268ed67c574d10d0a4bfe71f07e0"
+checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51"
 dependencies = [
  "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2886,19 +2893,19 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 [[package]]
 name = "stackable-certs"
 version = "0.4.0"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.111.1#7a5f0c3fbcd091340214a23f0607fcd4b4fcc152"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#a31cd2514445b251038fc4ea7abc28c57b2a6ad9"
 dependencies = [
  "const-oid",
  "ecdsa",
  "k8s-openapi",
  "kube",
  "p256",
- "rand 0.9.2",
+ "rand 0.9.4",
  "rand_core 0.6.4",
  "rsa",
  "sha2",
  "signature",
- "snafu 0.9.0",
+ "snafu 0.9.1",
  "stackable-shared",
  "tokio",
  "tokio-rustls",
@@ -2918,23 +2925,25 @@ dependencies = [
  "fnv",
  "futures 0.3.32",
  "indoc",
+ "java-properties",
  "product-config",
  "rstest",
  "serde",
  "serde_json",
  "serde_yaml",
  "shell-escape",
- "snafu 0.9.0",
+ "snafu 0.9.1",
  "stackable-operator",
  "strum",
  "tokio",
  "tracing",
+ "xml",
 ]
 
 [[package]]
 name = "stackable-operator"
 version = "0.111.1"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.111.1#7a5f0c3fbcd091340214a23f0607fcd4b4fcc152"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#a31cd2514445b251038fc4ea7abc28c57b2a6ad9"
 dependencies = [
  "base64",
  "clap",
@@ -2951,14 +2960,14 @@ dependencies = [
  "k8s-openapi",
  "kube",
  "product-config",
- "rand 0.9.2",
+ "rand 0.9.4",
  "regex",
  "schemars",
  "semver",
  "serde",
  "serde_json",
  "serde_yaml",
- "snafu 0.9.0",
+ "snafu 0.9.1",
  "stackable-operator-derive",
  "stackable-shared",
  "stackable-telemetry",
@@ -2970,12 +2979,13 @@ dependencies = [
  "tracing-appender",
  "tracing-subscriber",
  "url",
+ "uuid",
 ]
 
 [[package]]
 name = "stackable-operator-derive"
 version = "0.3.1"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.111.1#7a5f0c3fbcd091340214a23f0607fcd4b4fcc152"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#a31cd2514445b251038fc4ea7abc28c57b2a6ad9"
 dependencies = [
  "darling",
  "proc-macro2",
@@ -2986,7 +2996,7 @@ dependencies = [
 [[package]]
 name = "stackable-shared"
 version = "0.1.0"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.111.1#7a5f0c3fbcd091340214a23f0607fcd4b4fcc152"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#a31cd2514445b251038fc4ea7abc28c57b2a6ad9"
 dependencies = [
  "jiff",
  "k8s-openapi",
@@ -2995,7 +3005,7 @@ dependencies = [
  "semver",
  "serde",
  "serde_yaml",
- "snafu 0.9.0",
+ "snafu 0.9.1",
  "strum",
  "time",
 ]
@@ -3003,7 +3013,7 @@ dependencies = [
 [[package]]
 name = "stackable-telemetry"
 version = "0.6.3"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.111.1#7a5f0c3fbcd091340214a23f0607fcd4b4fcc152"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#a31cd2514445b251038fc4ea7abc28c57b2a6ad9"
 dependencies = [
  "axum",
  "clap",
@@ -3014,7 +3024,7 @@ dependencies = [
  "opentelemetry-semantic-conventions",
  "opentelemetry_sdk",
  "pin-project",
- "snafu 0.9.0",
+ "snafu 0.9.1",
  "strum",
  "tokio",
  "tower",
@@ -3027,21 +3037,21 @@ dependencies = [
 [[package]]
 name = "stackable-versioned"
 version = "0.10.0"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.111.1#7a5f0c3fbcd091340214a23f0607fcd4b4fcc152"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#a31cd2514445b251038fc4ea7abc28c57b2a6ad9"
 dependencies = [
  "kube",
  "schemars",
  "serde",
  "serde_json",
  "serde_yaml",
- "snafu 0.9.0",
+ "snafu 0.9.1",
  "stackable-versioned-macros",
 ]
 
 [[package]]
 name = "stackable-versioned-macros"
 version = "0.10.0"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.111.1#7a5f0c3fbcd091340214a23f0607fcd4b4fcc152"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#a31cd2514445b251038fc4ea7abc28c57b2a6ad9"
 dependencies = [
  "convert_case",
  "convert_case_extras",
@@ -3059,7 +3069,7 @@ dependencies = [
 [[package]]
 name = "stackable-webhook"
 version = "0.9.1"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.111.1#7a5f0c3fbcd091340214a23f0607fcd4b4fcc152"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#a31cd2514445b251038fc4ea7abc28c57b2a6ad9"
 dependencies = [
  "arc-swap",
  "async-trait",
@@ -3072,10 +3082,10 @@ dependencies = [
  "kube",
  "opentelemetry",
  "opentelemetry-semantic-conventions",
- "rand 0.9.2",
+ "rand 0.9.4",
  "serde",
  "serde_json",
- "snafu 0.9.0",
+ "snafu 0.9.1",
  "stackable-certs",
  "stackable-shared",
  "stackable-telemetry",
@@ -3121,6 +3131,12 @@ version = "2.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
+[[package]]
+name = "symlink"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7973cce6668464ea31f176d85b13c7ab3bba2cb3b77a2ed26abd7801688010a"
+
 [[package]]
 name = "syn"
 version = "1.0.109"
@@ -3245,9 +3261,9 @@ dependencies = [
 
 [[package]]
 name = "tinystr"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42d3e9c45c09de15d06dd8acf5f4e0e399e85927b7f00711024eb7ae10fa4869"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
 dependencies = [
  "displaydoc",
  "zerovec",
@@ -3276,9 +3292,9 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.49.0"
+version = "1.52.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72a2903cd7736441aac9df9d7688bd0ce48edccaadf181c3b90be801e81d3d86"
+checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
 dependencies = [
  "bytes",
  "libc",
@@ -3293,9 +3309,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-macros"
-version = "2.6.0"
+version = "2.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
+checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3339,18 +3355,18 @@ dependencies = [
 
 [[package]]
 name = "toml_datetime"
-version = "0.7.5+spec-1.1.0"
+version = "1.1.1+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
 dependencies = [
  "serde_core",
 ]
 
 [[package]]
 name = "toml_edit"
-version = "0.23.10+spec-1.0.0"
+version = "0.25.12+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84c8b9f757e028cee9fa244aea147aab2a9ec09d5325a9b01e0a49730c2b5269"
+checksum = "d2153edc6955a6c354fad8f5efd38b6a8769bdccf9fe50f8e1329f81b0baa5d7"
 dependencies = [
  "indexmap",
  "toml_datetime",
@@ -3360,18 +3376,18 @@ dependencies = [
 
 [[package]]
 name = "toml_parser"
-version = "1.0.9+spec-1.1.0"
+version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "702d4415e08923e7e1ef96cd5727c0dfed80b4d2fa25db9647fe5eb6f7c5a4c4"
+checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
 dependencies = [
  "winnow",
 ]
 
 [[package]]
 name = "tonic"
-version = "0.14.5"
+version = "0.14.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fec7c61a0695dc1887c1b53952990f3ad2e3a31453e1f49f10e75424943a93ec"
+checksum = "ac2a5518c70fa84342385732db33fb3f44bc4cc748936eb5833d2df34d6445ef"
 dependencies = [
  "async-trait",
  "base64",
@@ -3396,9 +3412,9 @@ dependencies = [
 
 [[package]]
 name = "tonic-prost"
-version = "0.14.5"
+version = "0.14.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a55376a0bbaa4975a3f10d009ad763d8f4108f067c7c2e74f3001fb49778d309"
+checksum = "50849f68853be452acf590cde0b146665b8d507b3b8af17261df47e02c209ea0"
 dependencies = [
  "bytes",
  "prost",
@@ -3426,9 +3442,9 @@ dependencies = [
 
 [[package]]
 name = "tower-http"
-version = "0.6.8"
+version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
 dependencies = [
  "base64",
  "bitflags",
@@ -3436,13 +3452,13 @@ dependencies = [
  "futures-util",
  "http",
  "http-body",
- "iri-string",
  "mime",
  "pin-project-lite",
  "tower",
  "tower-layer",
  "tower-service",
  "tracing",
+ "url",
 ]
 
 [[package]]
@@ -3471,11 +3487,12 @@ dependencies = [
 
 [[package]]
 name = "tracing-appender"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "786d480bce6247ab75f005b14ae1624ad978d3029d9113f0a22fa1ac773faeaf"
+checksum = "050686193eb999b4bb3bc2acfa891a13da00f79734704c4b8b4ef1a10b368a3c"
 dependencies = [
  "crossbeam-channel",
+ "symlink",
  "thiserror 2.0.18",
  "time",
  "tracing-subscriber",
@@ -3541,9 +3558,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-subscriber"
-version = "0.3.22"
+version = "0.3.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f30143827ddab0d256fd843b7a66d164e9f271cfa0dde49142c5ca0ca291f1e"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
 dependencies = [
  "matchers",
  "nu-ansi-term",
@@ -3568,9 +3585,9 @@ checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
 [[package]]
 name = "typenum"
-version = "1.19.0"
+version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
 [[package]]
 name = "ucd-trie"
@@ -3586,9 +3603,9 @@ checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
 [[package]]
 name = "unicode-segmentation"
-version = "1.12.0"
+version = "1.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
 
 [[package]]
 name = "unicode-xid"
@@ -3633,6 +3650,16 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
+[[package]]
+name = "uuid"
+version = "1.23.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d258b83ceec21034727ecee8c382cfa6c3e133699b0742c64571814fb420c9f7"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "valuable"
 version = "0.1.1"
@@ -3668,18 +3695,18 @@ checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
 name = "wasip2"
-version = "1.0.2+wasi-0.2.9"
+version = "1.0.3+wasi-0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
+checksum = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6"
 dependencies = [
  "wit-bindgen",
 ]
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.113"
+version = "0.2.122"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60722a937f594b7fde9adb894d7c092fc1bb6612897c46368d18e7a20208eff2"
+checksum = "3ed04576f974d2b2fba0f38c51dbc5518011e38c36bf1143164be765528fd409"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -3690,23 +3717,19 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.63"
+version = "0.4.72"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a89f4650b770e4521aa6573724e2aed4704372151bd0de9d16a3bbabb87441a"
+checksum = "9473dbd2991ae90b6291c3c32c30c6187ac49aa32f9905d1cce280ec1e110b0f"
 dependencies = [
- "cfg-if",
- "futures-util",
  "js-sys",
- "once_cell",
  "wasm-bindgen",
- "web-sys",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.113"
+version = "0.2.122"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fac8c6395094b6b91c4af293f4c79371c163f9a6f56184d2c9a85f5a95f3950"
+checksum = "916151b09da36bd82f6615cbf3a419e2f0ba23a03c6160e8e92eb6bd4aa1dec6"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -3714,9 +3737,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.113"
+version = "0.2.122"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab3fabce6159dc20728033842636887e4877688ae94382766e00b180abac9d60"
+checksum = "299047362ccbfce148b67ab7e73349f77748e00c8296f9542adfad2ad82c5c5e"
 dependencies = [
  "bumpalo",
  "proc-macro2",
@@ -3727,18 +3750,18 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.113"
+version = "0.2.122"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de0e091bdb824da87dc01d967388880d017a0a9bc4f3bdc0d86ee9f9336e3bb5"
+checksum = "9a929b2c61f11ba3e9bc35b50c1f25cb38e0e892c0c231ae2b8cf78d5dad4437"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "web-sys"
-version = "0.3.90"
+version = "0.3.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "705eceb4ce901230f8625bd1d665128056ccbe4b7408faa625eec1ba80f59a97"
+checksum = "6d621441cfc37b84979402712047321980c178f299193a3589d05b99e8763436"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -3819,16 +3842,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.6",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
-dependencies = [
- "windows-targets 0.53.5",
+ "windows-targets",
 ]
 
 [[package]]
@@ -3846,31 +3860,14 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.6",
- "windows_aarch64_msvc 0.52.6",
- "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
- "windows_i686_msvc 0.52.6",
- "windows_x86_64_gnu 0.52.6",
- "windows_x86_64_gnullvm 0.52.6",
- "windows_x86_64_msvc 0.52.6",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.53.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
-dependencies = [
- "windows-link",
- "windows_aarch64_gnullvm 0.53.1",
- "windows_aarch64_msvc 0.53.1",
- "windows_i686_gnu 0.53.1",
- "windows_i686_gnullvm 0.53.1",
- "windows_i686_msvc 0.53.1",
- "windows_x86_64_gnu 0.53.1",
- "windows_x86_64_gnullvm 0.53.1",
- "windows_x86_64_msvc 0.53.1",
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
 ]
 
 [[package]]
@@ -3879,116 +3876,68 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
-
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
-
 [[package]]
 name = "winnow"
-version = "0.7.14"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a5364e9d77fcdeeaa6062ced926ee3381faa2ee02d3eb83a5c27a8825540829"
+checksum = "0592e1c9d151f854e6fd382574c3a0855250e1d9b2f99d9281c6e6391af352f1"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
 name = "wit-bindgen"
-version = "0.51.0"
+version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
 [[package]]
 name = "writeable"
-version = "0.6.2"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
 
 [[package]]
 name = "x509-cert"
@@ -4006,15 +3955,15 @@ dependencies = [
 
 [[package]]
 name = "xml"
-version = "1.2.1"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8aa498d22c9bbaf482329839bc5620c46be275a19a812e9a22a2b07529a642a"
+checksum = "636f85e5ca6488e96401b61eb7de54f4e44755c988af0f52cf90230c312a1a89"
 
 [[package]]
 name = "yoke"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72d6e5c6afb84d73944e5cedb052c4680d5657337201555f9f2a16b7406d4954"
+checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca"
 dependencies = [
  "stable_deref_trait",
  "yoke-derive",
@@ -4023,9 +3972,9 @@ dependencies = [
 
 [[package]]
 name = "yoke-derive"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b659052874eb698efe5b9e8cf382204678a0086ebf46982b79d6ca3182927e5d"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4035,18 +3984,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.40"
+version = "0.8.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a789c6e490b576db9f7e6b6d661bcc9799f7c0ac8352f56ea20193b2681532e5"
+checksum = "3b065d4f0e55f82fae73202e189638116a87c55ab6b8e6c2721e13dd9d854ad1"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.40"
+version = "0.8.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f65c489a7071a749c849713807783f70672b28094011623e200cb86dcb835953"
+checksum = "0b631b19d36a892ab55420c92dbc83ccd79274f25be714855d3074aa71cab639"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4055,18 +4004,18 @@ dependencies = [
 
 [[package]]
 name = "zerofrom"
-version = "0.1.6"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
 dependencies = [
  "zerofrom-derive",
 ]
 
 [[package]]
 name = "zerofrom-derive"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4096,9 +4045,9 @@ dependencies = [
 
 [[package]]
 name = "zerotrie"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a59c17a5562d507e4b54960e8569ebee33bee890c70aa3fe7b97e85a9fd7851"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
 dependencies = [
  "displaydoc",
  "yoke",
@@ -4107,9 +4056,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec"
-version = "0.11.5"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c28719294829477f525be0186d13efa9a3c602f7ec202ca9e353d310fb9a002"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
 dependencies = [
  "yoke",
  "zerofrom",
@@ -4118,9 +4067,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec-derive"
-version = "0.11.2"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eadce39539ca5cb3985590102671f2567e659fca9666581ad3411d59207951f3"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/Cargo.toml b/Cargo.toml
index 0375c93e..c2e49e69 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -20,6 +20,7 @@ const_format = "0.2"
 fnv = "1.0"
 futures = { version = "0.3", features = ["compat"] }
 indoc = "2.0"
+java-properties = "2.0"
 rstest = "0.26"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
@@ -29,7 +30,8 @@ snafu = "0.9"
 strum = { version = "0.28", features = ["derive"] }
 tokio = { version = "1.40", features = ["full"] }
 tracing = "0.1"
+xml = "1.3"
 
-# [patch."https://github.com/stackabletech/operator-rs.git"]
-# stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "main" }
+[patch."https://github.com/stackabletech/operator-rs.git"]
+stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "smooth-operator" }
 # stackable-operator = { path = "../operator-rs/crates/stackable-operator" }
diff --git a/rust/operator-binary/Cargo.toml b/rust/operator-binary/Cargo.toml
index 3472b246..336c050d 100644
--- a/rust/operator-binary/Cargo.toml
+++ b/rust/operator-binary/Cargo.toml
@@ -18,6 +18,7 @@ const_format.workspace = true
 fnv.workspace = true
 futures.workspace = true
 indoc.workspace = true
+java-properties.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 shell-escape.workspace = true
@@ -25,6 +26,7 @@ snafu.workspace = true
 strum.workspace = true
 tokio.workspace = true
 tracing.workspace = true
+xml.workspace = true
 
 [build-dependencies]
 built.workspace = true
diff --git a/rust/operator-binary/src/config/mod.rs b/rust/operator-binary/src/config/mod.rs
index 271c6d99..cb7d7920 100644
--- a/rust/operator-binary/src/config/mod.rs
+++ b/rust/operator-binary/src/config/mod.rs
@@ -1 +1,2 @@
 pub mod jvm;
+pub mod writer;
diff --git a/rust/operator-binary/src/config/writer.rs b/rust/operator-binary/src/config/writer.rs
new file mode 100644
index 00000000..08250f9f
--- /dev/null
+++ b/rust/operator-binary/src/config/writer.rs
@@ -0,0 +1,145 @@
+//! Writers for Hadoop XML config files and Java `.properties` files.
+//!
+//! Vendored from the `product-config` crate's `writer` module so the operator no
+//! longer depends on `product-config` for rendering.
+
+use std::io::Write;
+
+use java_properties::{PropertiesError, PropertiesWriter};
+use snafu::{ResultExt, Snafu};
+use xml::escape::escape_str_attribute;
+
+#[derive(Debug, Snafu)]
+pub enum PropertiesWriterError {
+    #[snafu(display("failed to create properties file"))]
+    Properties { source: PropertiesError },
+
+    #[snafu(display("failed to convert properties file byte array to UTF-8"))]
+    FromUtf8 { source: std::string::FromUtf8Error },
+}
+
+/// Creates a common Java properties file string in the format:
+/// `property_1=value_1\nproperty_2=value_2\n`.
+pub fn to_java_properties_string<'a, T>(properties: T) -> Result<String, PropertiesWriterError>
+where
+    T: Iterator<Item = (&'a String, &'a Option<String>)>,
+{
+    let mut output = Vec::new();
+    write_java_properties(&mut output, properties)?;
+    String::from_utf8(output).context(FromUtf8Snafu)
+}
+
+/// Writes Java properties to the given writer. A `None` value is written as an
+/// empty value (`key=`).
+fn write_java_properties<'a, W, T>(writer: W, properties: T) -> Result<(), PropertiesWriterError>
+where
+    W: Write,
+    T: Iterator<Item = (&'a String, &'a Option<String>)>,
+{
+    let mut writer = PropertiesWriter::new(writer);
+    for (k, v) in properties {
+        let property_value = v.as_deref().unwrap_or_default();
+        writer.write(k, property_value).context(PropertiesSnafu)?;
+    }
+    writer.flush().context(PropertiesSnafu)?;
+    Ok(())
+}
+
+/// Converts properties into a Hadoop configuration XML, including the wrapping
+/// `<configuration>...</configuration>` elements. Properties with a `None` value
+/// are skipped. Keys and values are XML-escaped.
+pub fn to_hadoop_xml<'a, T>(properties: T) -> String
+where
+    T: Iterator<Item = (&'a String, &'a Option<String>)>,
+{
+    let mut snippet = String::new();
+    for (k, v) in properties {
+        let escaped_value = match v {
+            Some(value) => escape_str_attribute(value),
+            None => continue,
+        };
+        let escaped_key = escape_str_attribute(k);
+        snippet.push_str(&format!(
+            "  <property>\n    <name>{escaped_key}</name>\n    <value>{escaped_value}</value>\n  </property>\n"
+        ));
+    }
+    format!("<?xml version=\"1.0\"?>\n<configuration>\n{snippet}</configuration>")
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeMap;
+
+    use super::*;
+
+    fn xml(pairs: &[(&str, Option<&str>)]) -> String {
+        let map: BTreeMap<String, Option<String>> = pairs
+            .iter()
+            .map(|(k, v)| (k.to_string(), v.map(str::to_string)))
+            .collect();
+        to_hadoop_xml(map.iter())
+    }
+
+    fn props(pairs: &[(&str, Option<&str>)]) -> String {
+        let map: BTreeMap<String, Option<String>> = pairs
+            .iter()
+            .map(|(k, v)| (k.to_string(), v.map(str::to_string)))
+            .collect();
+        to_java_properties_string(map.iter()).unwrap()
+    }
+
+    #[test]
+    fn hadoop_xml_wraps_empty_configuration() {
+        assert_eq!(
+            xml(&[]),
+            "<?xml version=\"1.0\"?>\n<configuration>\n</configuration>"
+        );
+    }
+
+    #[test]
+    fn hadoop_xml_renders_single_property() {
+        assert_eq!(
+            xml(&[("fs.defaultFS", Some("hdfs://hdfs/"))]),
+            "<?xml version=\"1.0\"?>\n<configuration>\n  \
+             <property>\n    <name>fs.defaultFS</name>\n    \
+             <value>hdfs://hdfs/</value>\n  </property>\n</configuration>"
+        );
+    }
+
+    #[test]
+    fn hadoop_xml_skips_none_values() {
+        assert_eq!(
+            xml(&[("kept", Some("1")), ("dropped", None)]),
+            "<?xml version=\"1.0\"?>\n<configuration>\n  \
+             <property>\n    <name>kept</name>\n    \
+             <value>1</value>\n  </property>\n</configuration>"
+        );
+    }
+
+    #[test]
+    fn hadoop_xml_escapes_special_characters() {
+        let rendered = xml(&[("k", Some("<a>&b"))]);
+        assert!(
+            rendered.contains("<value>&lt;a&gt;&amp;b</value>"),
+            "{rendered}"
+        );
+    }
+
+    #[test]
+    fn java_properties_renders_key_value() {
+        assert_eq!(props(&[("a", Some("1")), ("b", Some("2"))]), "a=1\nb=2\n");
+    }
+
+    #[test]
+    fn java_properties_renders_none_as_empty() {
+        assert_eq!(props(&[("none", None)]), "none=\n");
+    }
+
+    #[test]
+    fn java_properties_escapes_colon_in_value() {
+        assert_eq!(
+            props(&[("url", Some("file://this/location/file.abc"))]),
+            "url=file\\://this/location/file.abc\n"
+        );
+    }
+}
diff --git a/rust/operator-binary/src/discovery.rs b/rust/operator-binary/src/discovery.rs
index 543204fc..4023085b 100644
--- a/rust/operator-binary/src/discovery.rs
+++ b/rust/operator-binary/src/discovery.rs
@@ -1,6 +1,6 @@
 use std::collections::BTreeMap;
 
-use product_config::writer::to_hadoop_xml;
+use crate::config::writer::to_hadoop_xml;
 use snafu::{ResultExt, Snafu};
 use stackable_operator::{
     builder::{configmap::ConfigMapBuilder, meta::ObjectMetaBuilder},
diff --git a/rust/operator-binary/src/hbase_controller.rs b/rust/operator-binary/src/hbase_controller.rs
index 87de79be..23000822 100644
--- a/rust/operator-binary/src/hbase_controller.rs
+++ b/rust/operator-binary/src/hbase_controller.rs
@@ -8,11 +8,7 @@ use std::{
 
 use const_format::concatcp;
 use indoc::formatdoc;
-use product_config::{
-    ProductConfigManager,
-    types::PropertyNameKind,
-    writer::{PropertiesWriterError, to_hadoop_xml, to_java_properties_string},
-};
+use product_config::{ProductConfigManager, types::PropertyNameKind};
 use snafu::{OptionExt, ResultExt, Snafu};
 use stackable_operator::{
     builder::{
@@ -66,9 +62,12 @@ use strum::{EnumDiscriminants, IntoStaticStr, ParseError};
 
 use crate::{
     OPERATOR_NAME,
-    config::jvm::{
-        construct_global_jvm_args, construct_hbase_heapsize_env,
-        construct_role_specific_non_heap_jvm_args,
+    config::{
+        jvm::{
+            construct_global_jvm_args, construct_hbase_heapsize_env,
+            construct_role_specific_non_heap_jvm_args,
+        },
+        writer::{PropertiesWriterError, to_hadoop_xml, to_java_properties_string},
     },
     crd::{
         APP_NAME, AnyServiceConfig, Container, HBASE_ENV_SH, HBASE_MASTER_PORT,

From 7304fd9d5b4eb90f8fc8d3e0421bfeedc4b02526 Mon Sep 17 00:00:00 2001
From: Malte Sander <malte.sander.it@gmail.com>
Date: Wed, 3 Jun 2026 14:58:19 +0200
Subject: [PATCH 02/21] refactor: reshape ValidatedCluster toward the v2
 framework

Add name (ClusterName) and a ValidatedClusterConfig, rename role_groups to
role_group_configs, and add merged config_overrides/env_overrides per role group.
The product_config_properties map is kept temporarily so the existing config-map
path still compiles.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../src/controller/validate.rs                | 136 +++++++++++++++++-
 rust/operator-binary/src/crd/mod.rs           |  72 ++++------
 rust/operator-binary/src/hbase_controller.rs  |  42 ++++--
 3 files changed, 189 insertions(+), 61 deletions(-)

diff --git a/rust/operator-binary/src/controller/validate.rs b/rust/operator-binary/src/controller/validate.rs
index 67abc63a..36d7620e 100644
--- a/rust/operator-binary/src/controller/validate.rs
+++ b/rust/operator-binary/src/controller/validate.rs
@@ -4,15 +4,19 @@ use product_config::ProductConfigManager;
 use snafu::{ResultExt, Snafu};
 use stackable_operator::{
     commons::product_image_selection::{self},
+    config::merge::Merge,
+    kube::ResourceExt,
     product_config_utils::{transform_all_roles_to_config, validate_all_roles_and_groups_config},
     role_utils::GenericRoleConfig,
+    v2::types::operator::ClusterName,
 };
 
 use crate::{
     controller::dereference::DereferencedObjects,
     crd::{HbaseRole, v1alpha1},
     hbase_controller::{
-        CONTAINER_IMAGE_BASE_NAME, ValidatedCluster, ValidatedRoleConfig, ValidatedRoleGroupConfig,
+        CONTAINER_IMAGE_BASE_NAME, ValidatedCluster, ValidatedClusterConfig, ValidatedRoleConfig,
+        ValidatedRoleGroupConfig,
     },
 };
 
@@ -23,6 +27,11 @@ pub enum Error {
         source: product_image_selection::Error,
     },
 
+    #[snafu(display("invalid cluster name"))]
+    InvalidClusterName {
+        source: stackable_operator::v2::macros::attributed_string_type::Error,
+    },
+
     #[snafu(display("invalid role properties"))]
     RoleProperties { source: crate::crd::Error },
 
@@ -104,6 +113,8 @@ pub fn validate_cluster(
                 rolegroup_name.clone(),
                 ValidatedRoleGroupConfig {
                     merged_config,
+                    config_overrides: merged_config_overrides(hbase, &hbase_role, rolegroup_name),
+                    env_overrides: merged_env_overrides(hbase, &hbase_role, rolegroup_name),
                     product_config_properties: rolegroup_config.clone(),
                 },
             );
@@ -113,10 +124,127 @@ pub fn validate_cluster(
     }
 
     Ok(ValidatedCluster {
+        name: ClusterName::from_str(&hbase.name_any()).context(InvalidClusterNameSnafu)?,
         image: resolved_product_image,
-        role_groups,
+        cluster_config: ValidatedClusterConfig {
+            zookeeper_connection_information: dereferenced_objects
+                .zookeeper_connection_information,
+            hbase_opa_config: dereferenced_objects.hbase_opa_config,
+            kerberos_enabled: hbase.has_kerberos_enabled(),
+        },
+        role_group_configs: role_groups,
         role_configs,
-        zookeeper_connection_information: dereferenced_objects.zookeeper_connection_information,
-        hbase_opa_config: dereferenced_objects.hbase_opa_config,
     })
 }
+
+/// Merge role-level then role-group-level `configOverrides` (role group wins).
+fn merged_config_overrides(
+    hbase: &v1alpha1::HbaseCluster,
+    role: &HbaseRole,
+    role_group: &str,
+) -> v1alpha1::HbaseConfigOverrides {
+    let (role_overrides, role_group_overrides) = match role {
+        HbaseRole::Master => (
+            hbase
+                .spec
+                .masters
+                .as_ref()
+                .map(|r| r.config.config_overrides.clone()),
+            hbase
+                .spec
+                .masters
+                .as_ref()
+                .and_then(|r| r.role_groups.get(role_group))
+                .map(|rg| rg.config.config_overrides.clone()),
+        ),
+        HbaseRole::RegionServer => (
+            hbase
+                .spec
+                .region_servers
+                .as_ref()
+                .map(|r| r.config.config_overrides.clone()),
+            hbase
+                .spec
+                .region_servers
+                .as_ref()
+                .and_then(|r| r.role_groups.get(role_group))
+                .map(|rg| rg.config.config_overrides.clone()),
+        ),
+        HbaseRole::RestServer => (
+            hbase
+                .spec
+                .rest_servers
+                .as_ref()
+                .map(|r| r.config.config_overrides.clone()),
+            hbase
+                .spec
+                .rest_servers
+                .as_ref()
+                .and_then(|r| r.role_groups.get(role_group))
+                .map(|rg| rg.config.config_overrides.clone()),
+        ),
+    };
+
+    let role_overrides = role_overrides.unwrap_or_default();
+    let mut merged = role_group_overrides.unwrap_or_default();
+    merged.merge(&role_overrides);
+    merged
+}
+
+/// Merge role-level then role-group-level `envOverrides` (role group wins).
+fn merged_env_overrides(
+    hbase: &v1alpha1::HbaseCluster,
+    role: &HbaseRole,
+    role_group: &str,
+) -> BTreeMap<String, String> {
+    let (role_overrides, role_group_overrides) = match role {
+        HbaseRole::Master => (
+            hbase
+                .spec
+                .masters
+                .as_ref()
+                .map(|r| r.config.env_overrides.clone()),
+            hbase
+                .spec
+                .masters
+                .as_ref()
+                .and_then(|r| r.role_groups.get(role_group))
+                .map(|rg| rg.config.env_overrides.clone()),
+        ),
+        HbaseRole::RegionServer => (
+            hbase
+                .spec
+                .region_servers
+                .as_ref()
+                .map(|r| r.config.env_overrides.clone()),
+            hbase
+                .spec
+                .region_servers
+                .as_ref()
+                .and_then(|r| r.role_groups.get(role_group))
+                .map(|rg| rg.config.env_overrides.clone()),
+        ),
+        HbaseRole::RestServer => (
+            hbase
+                .spec
+                .rest_servers
+                .as_ref()
+                .map(|r| r.config.env_overrides.clone()),
+            hbase
+                .spec
+                .rest_servers
+                .as_ref()
+                .and_then(|r| r.role_groups.get(role_group))
+                .map(|rg| rg.config.env_overrides.clone()),
+        ),
+    };
+
+    let mut env_overrides = BTreeMap::new();
+    if let Some(role_overrides) = role_overrides {
+        env_overrides.extend(role_overrides);
+    }
+    if let Some(role_group_overrides) = role_group_overrides {
+        env_overrides.extend(role_group_overrides);
+    }
+    env_overrides
+}
diff --git a/rust/operator-binary/src/crd/mod.rs b/rust/operator-binary/src/crd/mod.rs
index 80b0707a..a04386d3 100644
--- a/rust/operator-binary/src/crd/mod.rs
+++ b/rust/operator-binary/src/crd/mod.rs
@@ -23,7 +23,7 @@ use stackable_operator::{
         fragment::{self, Fragment, ValidationError},
         merge::{Atomic, Merge},
     },
-    config_overrides::{KeyValueConfigOverrides, KeyValueOverridesProvider},
+    config_overrides::KeyValueOverridesProvider,
     deep_merger::ObjectOverrides,
     k8s_openapi::{
         DeepMerge,
@@ -38,6 +38,7 @@ use stackable_operator::{
     schemars::{self, JsonSchema},
     shared::time::Duration,
     status::condition::{ClusterCondition, HasStatusCondition},
+    v2::config_overrides::KeyValueConfigOverrides,
     versioned::versioned,
 };
 use strum::{Display, EnumIter, EnumString};
@@ -233,43 +234,23 @@ pub mod versioned {
         pub authorization: Option<AuthorizationConfig>,
     }
 
-    #[derive(Clone, Debug, Default, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
+    #[derive(Clone, Debug, Default, Deserialize, Eq, JsonSchema, Merge, PartialEq, Serialize)]
     #[serde(rename_all = "camelCase")]
     pub struct HbaseConfigOverrides {
-        #[serde(
-            default,
-            rename = "hbase-site.xml",
-            skip_serializing_if = "Option::is_none"
-        )]
-        pub hbase_site_xml: Option<KeyValueConfigOverrides>,
-
-        #[serde(
-            default,
-            rename = "hbase-env.sh",
-            skip_serializing_if = "Option::is_none"
-        )]
-        pub hbase_env_sh: Option<KeyValueConfigOverrides>,
-
-        #[serde(
-            default,
-            rename = "ssl-server.xml",
-            skip_serializing_if = "Option::is_none"
-        )]
-        pub ssl_server_xml: Option<KeyValueConfigOverrides>,
-
-        #[serde(
-            default,
-            rename = "ssl-client.xml",
-            skip_serializing_if = "Option::is_none"
-        )]
-        pub ssl_client_xml: Option<KeyValueConfigOverrides>,
-
-        #[serde(
-            default,
-            rename = "security.properties",
-            skip_serializing_if = "Option::is_none"
-        )]
-        pub security_properties: Option<KeyValueConfigOverrides>,
+        #[serde(default, rename = "hbase-site.xml")]
+        pub hbase_site_xml: KeyValueConfigOverrides,
+
+        #[serde(default, rename = "hbase-env.sh")]
+        pub hbase_env_sh: KeyValueConfigOverrides,
+
+        #[serde(default, rename = "ssl-server.xml")]
+        pub ssl_server_xml: KeyValueConfigOverrides,
+
+        #[serde(default, rename = "ssl-client.xml")]
+        pub ssl_client_xml: KeyValueConfigOverrides,
+
+        #[serde(default, rename = "security.properties")]
+        pub security_properties: KeyValueConfigOverrides,
     }
 }
 
@@ -584,17 +565,14 @@ impl v1alpha1::HbaseCluster {
 
 impl KeyValueOverridesProvider for v1alpha1::HbaseConfigOverrides {
     fn get_key_value_overrides(&self, file: &str) -> BTreeMap<String, Option<String>> {
-        let field = match file {
-            HBASE_SITE_XML => self.hbase_site_xml.as_ref(),
-            HBASE_ENV_SH => self.hbase_env_sh.as_ref(),
-            SSL_SERVER_XML => self.ssl_server_xml.as_ref(),
-            SSL_CLIENT_XML => self.ssl_client_xml.as_ref(),
-            JVM_SECURITY_PROPERTIES_FILE => self.security_properties.as_ref(),
-            _ => None,
-        };
-        field
-            .map(KeyValueConfigOverrides::as_product_config_overrides)
-            .unwrap_or_default()
+        match file {
+            HBASE_SITE_XML => self.hbase_site_xml.overrides.clone(),
+            HBASE_ENV_SH => self.hbase_env_sh.overrides.clone(),
+            SSL_SERVER_XML => self.ssl_server_xml.overrides.clone(),
+            SSL_CLIENT_XML => self.ssl_client_xml.overrides.clone(),
+            JVM_SECURITY_PROPERTIES_FILE => self.security_properties.overrides.clone(),
+            _ => BTreeMap::new(),
+        }
     }
 }
 
diff --git a/rust/operator-binary/src/hbase_controller.rs b/rust/operator-binary/src/hbase_controller.rs
index 23000822..c2331b12 100644
--- a/rust/operator-binary/src/hbase_controller.rs
+++ b/rust/operator-binary/src/hbase_controller.rs
@@ -57,6 +57,7 @@ use stackable_operator::{
         statefulset::StatefulSetConditionBuilder,
     },
     utils::cluster_info::KubernetesClusterInfo,
+    v2::types::operator::ClusterName,
 };
 use strum::{EnumDiscriminants, IntoStaticStr, ParseError};
 
@@ -109,17 +110,28 @@ pub struct Ctx {
     pub operator_environment: OperatorEnvironmentOptions,
 }
 
-/// The validated cluster: proves that product-config validation and config merging
-/// succeeded for every role and role group before any resources are created.
-/// Placed in the controller so that subsequent steps that reference this struct
-/// only depend on the controller.
+/// The validated cluster: proves that config merging and validation succeeded for
+/// every role and role group before any resources are created.
 #[derive(Clone, Debug)]
 pub struct ValidatedCluster {
+    /// The logical (and Kubernetes object) name of the cluster.
+    // Populated now; consumed by the new build path in a later commit.
+    #[allow(dead_code)]
+    pub name: ClusterName,
     pub image: ResolvedProductImage,
-    pub role_groups: BTreeMap<HbaseRole, BTreeMap<String, ValidatedRoleGroupConfig>>,
+    pub cluster_config: ValidatedClusterConfig,
+    pub role_group_configs: BTreeMap<HbaseRole, BTreeMap<String, ValidatedRoleGroupConfig>>,
     pub role_configs: BTreeMap<HbaseRole, ValidatedRoleConfig>,
+}
+
+/// Cluster-wide settings resolved once during validation.
+#[derive(Clone, Debug)]
+pub struct ValidatedClusterConfig {
     pub zookeeper_connection_information: ZookeeperConnectionInformation,
     pub hbase_opa_config: Option<HbaseOpaConfig>,
+    // Populated now; consumed by the new build path in a later commit.
+    #[allow(dead_code)]
+    pub kerberos_enabled: bool,
 }
 
 /// Per-role configuration extracted during validation.
@@ -128,10 +140,20 @@ pub struct ValidatedRoleConfig {
     pub pdb: stackable_operator::commons::pdb::PdbConfig,
 }
 
-/// Per-rolegroup configuration: the merged CRD config plus the product-config properties.
+/// Per-rolegroup configuration: the merged CRD config plus the merged
+/// (role <- role group) `configOverrides` and `envOverrides`.
+///
+/// `product_config_properties` is retained temporarily so the existing controller
+/// path keeps compiling; it is removed in a later commit.
 #[derive(Clone, Debug)]
 pub struct ValidatedRoleGroupConfig {
     pub merged_config: AnyServiceConfig,
+    // Populated now; consumed by the new build path in a later commit.
+    #[allow(dead_code)]
+    pub config_overrides: v1alpha1::HbaseConfigOverrides,
+    // Populated now; consumed by the new build path in a later commit.
+    #[allow(dead_code)]
+    pub env_overrides: BTreeMap<String, String>,
     pub product_config_properties: HashMap<PropertyNameKind, BTreeMap<String, String>>,
 }
 
@@ -363,7 +385,7 @@ pub async fn reconcile_hbase(
 
     let mut ss_cond_builder = StatefulSetConditionBuilder::default();
 
-    for (hbase_role, role_group_configs) in &validated.role_groups {
+    for (hbase_role, role_group_configs) in &validated.role_group_configs {
         for (rolegroup_name, validated_rg_config) in role_group_configs {
             let rolegroup = hbase.server_rolegroup_ref(hbase_role.to_string(), rolegroup_name);
 
@@ -379,10 +401,10 @@ pub async fn reconcile_hbase(
                 &client.kubernetes_cluster_info,
                 &rolegroup,
                 &validated_rg_config.product_config_properties,
-                &validated.zookeeper_connection_information,
+                &validated.cluster_config.zookeeper_connection_information,
                 &validated_rg_config.merged_config,
                 &validated.image,
-                validated.hbase_opa_config.as_ref(),
+                validated.cluster_config.hbase_opa_config.as_ref(),
             )?;
             let rg_statefulset = build_rolegroup_statefulset(
                 hbase,
@@ -443,7 +465,7 @@ pub async fn reconcile_hbase(
     let discovery_cm = build_discovery_configmap(
         hbase,
         &client.kubernetes_cluster_info,
-        &validated.zookeeper_connection_information,
+        &validated.cluster_config.zookeeper_connection_information,
         &validated.image,
     )
     .context(BuildDiscoveryConfigMapSnafu)?;

From 8f116c06b481b6860d9473fc48a7ccda9d3bca0d Mon Sep 17 00:00:00 2001
From: Malte Sander <malte.sander.it@gmail.com>
Date: Wed, 3 Jun 2026 15:40:39 +0200
Subject: [PATCH 03/21] feat: add controller/build config-map module without
 product-config

Add per-file builders (hbase-site, hbase-env, ssl-server, ssl-client,
security.properties) and a config_map orchestrator that render from the validated
cluster, plus unit tests. Defaults previously sourced from properties.yaml (cluster
distributed, role-specific DNS TTLs, HBASE_MANAGES_ZK) are now in code. Not yet wired
into reconcile.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../src/controller/build/config_map.rs        | 155 +++++++++++
 .../src/controller/build/mod.rs               |   2 +
 .../controller/build/properties/hbase_env.rs  | 146 ++++++++++
 .../controller/build/properties/hbase_site.rs | 254 ++++++++++++++++++
 .../src/controller/build/properties/mod.rs    | 118 ++++++++
 .../build/properties/security_properties.rs   |  86 ++++++
 .../controller/build/properties/ssl_client.rs |  47 ++++
 .../controller/build/properties/ssl_server.rs |  47 ++++
 rust/operator-binary/src/controller/mod.rs    |   1 +
 .../src/controller/validate.rs                |   1 -
 rust/operator-binary/src/crd/mod.rs           |  10 +
 rust/operator-binary/src/hbase_controller.rs  |   5 -
 12 files changed, 866 insertions(+), 6 deletions(-)
 create mode 100644 rust/operator-binary/src/controller/build/config_map.rs
 create mode 100644 rust/operator-binary/src/controller/build/mod.rs
 create mode 100644 rust/operator-binary/src/controller/build/properties/hbase_env.rs
 create mode 100644 rust/operator-binary/src/controller/build/properties/hbase_site.rs
 create mode 100644 rust/operator-binary/src/controller/build/properties/mod.rs
 create mode 100644 rust/operator-binary/src/controller/build/properties/security_properties.rs
 create mode 100644 rust/operator-binary/src/controller/build/properties/ssl_client.rs
 create mode 100644 rust/operator-binary/src/controller/build/properties/ssl_server.rs

diff --git a/rust/operator-binary/src/controller/build/config_map.rs b/rust/operator-binary/src/controller/build/config_map.rs
new file mode 100644
index 00000000..c5586691
--- /dev/null
+++ b/rust/operator-binary/src/controller/build/config_map.rs
@@ -0,0 +1,155 @@
+//! Build the per-rolegroup `ConfigMap` for the HbaseCluster.
+
+use snafu::{OptionExt, ResultExt, Snafu};
+use stackable_operator::{
+    builder::{configmap::ConfigMapBuilder, meta::ObjectMetaBuilder},
+    k8s_openapi::api::core::v1::ConfigMap,
+    role_utils::RoleGroupRef,
+    utils::cluster_info::KubernetesClusterInfo,
+};
+
+use crate::{
+    config::writer::PropertiesWriterError,
+    controller::build::properties::{
+        ConfigFileName, hbase_env, hbase_site, security_properties, ssl_client, ssl_server,
+    },
+    crd::{HbaseRole, v1alpha1},
+    hbase_controller::{ValidatedCluster, build_recommended_labels},
+    product_logging::extend_role_group_config_map,
+};
+
+#[derive(Snafu, Debug)]
+pub enum Error {
+    #[snafu(display("the validated cluster has no role group {role_group:?} for role {role:?}"))]
+    MissingRoleGroup { role: String, role_group: String },
+
+    #[snafu(display("failed to build hbase-site.xml"))]
+    BuildHbaseSite { source: hbase_site::Error },
+
+    #[snafu(display("failed to build hbase-env.sh"))]
+    BuildHbaseEnv { source: hbase_env::Error },
+
+    #[snafu(display("failed to serialize {} for {role_group}", ConfigFileName::Security))]
+    JvmSecurityProperties {
+        source: PropertiesWriterError,
+        role_group: String,
+    },
+
+    #[snafu(display("object is missing metadata to build owner reference"))]
+    ObjectMissingMetadataForOwnerRef {
+        source: stackable_operator::builder::meta::Error,
+    },
+
+    #[snafu(display("failed to build object meta data"))]
+    ObjectMeta {
+        source: stackable_operator::builder::meta::Error,
+    },
+
+    #[snafu(display("failed to add the logging configuration to the ConfigMap {cm_name:?}"))]
+    InvalidLoggingConfig {
+        source: crate::product_logging::Error,
+        cm_name: String,
+    },
+
+    #[snafu(display("cannot build config map for role {role:?} and role group {role_group:?}"))]
+    Assemble {
+        source: stackable_operator::builder::configmap::Error,
+        role: String,
+        role_group: String,
+    },
+}
+
+type Result<T, E = Error> = std::result::Result<T, E>;
+
+#[allow(dead_code)]
+pub fn build_rolegroup_config_map(
+    hbase: &v1alpha1::HbaseCluster,
+    cluster: &ValidatedCluster,
+    role: &HbaseRole,
+    cluster_info: &KubernetesClusterInfo,
+    rolegroup_ref: &RoleGroupRef<v1alpha1::HbaseCluster>,
+) -> Result<ConfigMap> {
+    tracing::info!("Setting up ConfigMap for {:?}", rolegroup_ref);
+
+    let rg = cluster
+        .role_group_configs
+        .get(role)
+        .and_then(|groups| groups.get(&rolegroup_ref.role_group))
+        .with_context(|| MissingRoleGroupSnafu {
+            role: rolegroup_ref.role.clone(),
+            role_group: rolegroup_ref.role_group.clone(),
+        })?;
+
+    let cluster_config = &cluster.cluster_config;
+    let overrides = &rg.config_overrides;
+
+    let hbase_site_xml = hbase_site::build(
+        hbase,
+        role,
+        cluster_info,
+        &rg.merged_config,
+        cluster_config
+            .zookeeper_connection_information
+            .as_hbase_settings(),
+        cluster_config.hbase_opa_config.as_ref(),
+        overrides.hbase_site_xml.clone(),
+    )
+    .context(BuildHbaseSiteSnafu)?;
+
+    let hbase_env_sh = hbase_env::build(
+        hbase,
+        &rg.merged_config,
+        role,
+        &rolegroup_ref.role_group,
+        overrides.hbase_env_sh.clone(),
+    )
+    .context(BuildHbaseEnvSnafu)?;
+
+    let ssl_server_xml = ssl_server::build(hbase, overrides.ssl_server_xml.clone());
+    let ssl_client_xml = ssl_client::build(hbase, overrides.ssl_client_xml.clone());
+
+    let security_properties = security_properties::build(role, overrides.security_properties.clone())
+        .with_context(|_| JvmSecurityPropertiesSnafu {
+            role_group: rolegroup_ref.role_group.clone(),
+        })?;
+
+    let cm_metadata = ObjectMetaBuilder::new()
+        .name_and_namespace(hbase)
+        .name(rolegroup_ref.object_name())
+        .ownerreference_from_resource(hbase, None, Some(true))
+        .context(ObjectMissingMetadataForOwnerRefSnafu)?
+        .with_recommended_labels(&build_recommended_labels(
+            hbase,
+            &cluster.image.app_version_label_value,
+            &rolegroup_ref.role,
+            &rolegroup_ref.role_group,
+        ))
+        .context(ObjectMetaSnafu)?
+        .build();
+
+    let mut builder = ConfigMapBuilder::new();
+    builder
+        .metadata(cm_metadata)
+        .add_data(ConfigFileName::HbaseSite.to_string(), hbase_site_xml)
+        .add_data(ConfigFileName::HbaseEnv.to_string(), hbase_env_sh)
+        .add_data(ConfigFileName::Security.to_string(), security_properties);
+
+    // HBase does not like empty config files:
+    // Caused by: com.ctc.wstx.exc.WstxEOFException: Unexpected EOF in prolog at [row,col,system-id]: [1,0,"file:/stackable/conf/ssl-server.xml"]
+    if !ssl_server_xml.is_empty() {
+        builder.add_data(ConfigFileName::SslServer.to_string(), ssl_server_xml);
+    }
+    if !ssl_client_xml.is_empty() {
+        builder.add_data(ConfigFileName::SslClient.to_string(), ssl_client_xml);
+    }
+
+    extend_role_group_config_map(rolegroup_ref, rg.merged_config.logging(), &mut builder)
+        .context(InvalidLoggingConfigSnafu {
+            cm_name: rolegroup_ref.object_name(),
+        })?;
+
+    builder.build().with_context(|_| AssembleSnafu {
+        role: rolegroup_ref.role.clone(),
+        role_group: rolegroup_ref.role_group.clone(),
+    })
+}
diff --git a/rust/operator-binary/src/controller/build/mod.rs b/rust/operator-binary/src/controller/build/mod.rs
new file mode 100644
index 00000000..933a20b9
--- /dev/null
+++ b/rust/operator-binary/src/controller/build/mod.rs
@@ -0,0 +1,2 @@
+pub mod config_map;
+pub mod properties;
diff --git a/rust/operator-binary/src/controller/build/properties/hbase_env.rs b/rust/operator-binary/src/controller/build/properties/hbase_env.rs
new file mode 100644
index 00000000..a3fbe0c2
--- /dev/null
+++ b/rust/operator-binary/src/controller/build/properties/hbase_env.rs
@@ -0,0 +1,146 @@
+//! Builds the `hbase-env.sh` config file: JVM heap/options env vars + overrides.
+
+use std::{collections::BTreeMap, fmt::Write};
+
+use snafu::{ResultExt, Snafu};
+use stackable_operator::v2::config_overrides::KeyValueConfigOverrides;
+
+use crate::{
+    config::jvm::{
+        self, construct_global_jvm_args, construct_hbase_heapsize_env,
+        construct_role_specific_non_heap_jvm_args,
+    },
+    controller::build::properties::resolved_overrides,
+    crd::{AnyServiceConfig, HbaseRole, v1alpha1},
+};
+
+#[derive(Snafu, Debug)]
+pub enum Error {
+    #[snafu(display("failed to construct the HBASE_HEAPSIZE env variable"))]
+    ConstructHbaseHeapsizeEnv { source: jvm::Error },
+
+    #[snafu(display("failed to construct the JVM arguments"))]
+    ConstructJvmArgument { source: jvm::Error },
+}
+
+/// Renders `hbase-env.sh` as `export VAR="VALUE"` lines.
+pub fn build(
+    hbase: &v1alpha1::HbaseCluster,
+    merged_config: &AnyServiceConfig,
+    role: &HbaseRole,
+    role_group: &str,
+    overrides: KeyValueConfigOverrides,
+) -> Result<String, Error> {
+    let mut env: BTreeMap<String, String> = BTreeMap::new();
+
+    env.insert("HBASE_MANAGES_ZK".to_string(), "false".to_string());
+    env.insert(
+        "HBASE_HEAPSIZE".to_string(),
+        construct_hbase_heapsize_env(merged_config).context(ConstructHbaseHeapsizeEnvSnafu)?,
+    );
+    env.insert(
+        "HBASE_OPTS".to_string(),
+        construct_global_jvm_args(hbase.has_kerberos_enabled()),
+    );
+
+    let role_specific_non_heap_jvm_args =
+        construct_role_specific_non_heap_jvm_args(hbase, role, role_group)
+            .context(ConstructJvmArgumentSnafu)?;
+    match role {
+        HbaseRole::Master => {
+            env.insert(
+                "HBASE_MASTER_OPTS".to_string(),
+                role_specific_non_heap_jvm_args,
+            );
+        }
+        HbaseRole::RegionServer => {
+            env.insert(
+                "HBASE_REGIONSERVER_OPTS".to_string(),
+                role_specific_non_heap_jvm_args,
+            );
+        }
+        HbaseRole::RestServer => {
+            env.insert(
+                "HBASE_REST_OPTS".to_string(),
+                role_specific_non_heap_jvm_args,
+            );
+        }
+    }
+
+    // configOverride come last
+    env.extend(resolved_overrides(overrides));
+
+    Ok(env
+        .iter()
+        .fold(String::new(), |mut output, (variable, value)| {
+            let _ = writeln!(output, "export {variable}=\"{value}\"");
+            output
+        }))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::controller::build::properties::test_support::{config_overrides, minimal_hbase};
+
+    fn master_merged_config(hbase: &v1alpha1::HbaseCluster) -> AnyServiceConfig {
+        hbase
+            .merged_config(&HbaseRole::Master, "default", "simple-hdfs")
+            .expect("merged config for the minimal master group")
+    }
+
+    fn region_server_merged_config(hbase: &v1alpha1::HbaseCluster) -> AnyServiceConfig {
+        hbase
+            .merged_config(&HbaseRole::RegionServer, "default", "simple-hdfs")
+            .expect("merged config for the minimal region server group")
+    }
+
+    #[test]
+    fn renders_operator_defaults() {
+        let hbase = minimal_hbase();
+        let merged = master_merged_config(&hbase);
+        let env = build(
+            &hbase,
+            &merged,
+            &HbaseRole::Master,
+            "default",
+            config_overrides(&[]),
+        )
+        .unwrap();
+        assert!(env.contains("export HBASE_MANAGES_ZK=\"false\""), "{env}");
+        assert!(env.contains("export HBASE_MASTER_OPTS="), "{env}");
+    }
+
+    #[test]
+    fn renders_region_server_opts() {
+        let hbase = minimal_hbase();
+        let merged = region_server_merged_config(&hbase);
+        let env = build(
+            &hbase,
+            &merged,
+            &HbaseRole::RegionServer,
+            "default",
+            config_overrides(&[]),
+        )
+        .unwrap();
+        assert!(env.contains("export HBASE_REGIONSERVER_OPTS="), "{env}");
+    }
+
+    #[test]
+    fn user_override_appears() {
+        let hbase = minimal_hbase();
+        let merged = master_merged_config(&hbase);
+        let env = build(
+            &hbase,
+            &merged,
+            &HbaseRole::Master,
+            "default",
+            config_overrides(&[("CUSTOM_VAR", "custom_value")]),
+        )
+        .unwrap();
+        assert!(
+            env.contains("export CUSTOM_VAR=\"custom_value\""),
+            "{env}"
+        );
+    }
+}
diff --git a/rust/operator-binary/src/controller/build/properties/hbase_site.rs b/rust/operator-binary/src/controller/build/properties/hbase_site.rs
new file mode 100644
index 00000000..f97a1b2d
--- /dev/null
+++ b/rust/operator-binary/src/controller/build/properties/hbase_site.rs
@@ -0,0 +1,254 @@
+//! Builds the `hbase-site.xml` config file: operator defaults, ZooKeeper wiring,
+//! kerberos/OPA security config, role-specific bind settings, with user
+//! `configOverrides` applied last.
+
+use std::collections::BTreeMap;
+
+use snafu::{ResultExt, Snafu};
+use stackable_operator::{
+    utils::cluster_info::KubernetesClusterInfo, v2::config_overrides::KeyValueConfigOverrides,
+};
+
+use crate::{
+    config::writer::to_hadoop_xml,
+    controller::build::properties::resolved_overrides,
+    crd::{
+        AnyServiceConfig, HBASE_CLUSTER_DISTRIBUTED, HBASE_MASTER_PORT, HBASE_MASTER_UI_PORT,
+        HBASE_REGIONSERVER_PORT, HBASE_REGIONSERVER_UI_PORT, HBASE_ROOTDIR, HbaseRole, v1alpha1,
+    },
+    kerberos::{self, kerberos_config_properties},
+    security::opa::HbaseOpaConfig,
+};
+
+#[derive(Snafu, Debug)]
+pub enum Error {
+    #[snafu(display("failed to add the kerberos configuration"))]
+    AddKerberosConfig { source: kerberos::Error },
+}
+
+/// Renders `hbase-site.xml`.
+#[allow(clippy::too_many_arguments)]
+pub fn build(
+    hbase: &v1alpha1::HbaseCluster,
+    role: &HbaseRole,
+    cluster_info: &KubernetesClusterInfo,
+    merged_config: &AnyServiceConfig,
+    zookeeper_config: BTreeMap<String, String>,
+    opa_config: Option<&HbaseOpaConfig>,
+    overrides: KeyValueConfigOverrides,
+) -> Result<String, Error> {
+    let mut config: BTreeMap<String, String> = BTreeMap::new();
+
+    // Defaults previously injected by product-config's `compute_files`.
+    config.insert(HBASE_CLUSTER_DISTRIBUTED.to_string(), "true".to_string());
+    if let Some(rootdir) = merged_config.hbase_rootdir() {
+        config.insert(HBASE_ROOTDIR.to_string(), rootdir);
+    }
+
+    config.extend(zookeeper_config);
+    config.extend(kerberos_config_properties(hbase, cluster_info).context(AddKerberosConfigSnafu)?);
+    config.extend(opa_config.map_or(vec![], |config| config.hbase_site_config()));
+
+    // Set flag to override default behaviour, which is that the
+    // RPC client should bind the client address (forcing outgoing
+    // RPC traffic to happen from the same network interface that
+    // the RPC server is bound on).
+    config.insert(
+        "hbase.client.rpc.bind.address".to_string(),
+        "false".to_string(),
+    );
+
+    match role {
+        HbaseRole::Master => {
+            config.insert(
+                "hbase.master.ipc.address".to_string(),
+                "0.0.0.0".to_string(),
+            );
+            config.insert(
+                "hbase.master.ipc.port".to_string(),
+                HBASE_MASTER_PORT.to_string(),
+            );
+            config.insert(
+                "hbase.master.hostname".to_string(),
+                "${env:HBASE_SERVICE_HOST}".to_string(),
+            );
+            config.insert(
+                "hbase.master.port".to_string(),
+                "${env:HBASE_SERVICE_PORT}".to_string(),
+            );
+            config.insert(
+                "hbase.master.info.port".to_string(),
+                "${env:HBASE_INFO_PORT}".to_string(),
+            );
+            config.insert(
+                "hbase.master.bound.info.port".to_string(),
+                HBASE_MASTER_UI_PORT.to_string(),
+            );
+        }
+        HbaseRole::RegionServer => {
+            config.insert(
+                "hbase.regionserver.ipc.address".to_string(),
+                "0.0.0.0".to_string(),
+            );
+            config.insert(
+                "hbase.regionserver.ipc.port".to_string(),
+                HBASE_REGIONSERVER_PORT.to_string(),
+            );
+            config.insert(
+                "hbase.unsafe.regionserver.hostname".to_string(),
+                "${env:HBASE_SERVICE_HOST}".to_string(),
+            );
+            config.insert(
+                "hbase.regionserver.port".to_string(),
+                "${env:HBASE_SERVICE_PORT}".to_string(),
+            );
+            config.insert(
+                "hbase.regionserver.info.port".to_string(),
+                "${env:HBASE_INFO_PORT}".to_string(),
+            );
+            config.insert(
+                "hbase.regionserver.bound.info.port".to_string(),
+                HBASE_REGIONSERVER_UI_PORT.to_string(),
+            );
+        }
+        HbaseRole::RestServer => {
+            config.insert(
+                // N.B. a custom tag, so as not to interfere with HBase internals.
+                // The other roles use a patch to correctly resolve host/port.
+                "hbase.rest.endpoint".to_string(),
+                "${env:HBASE_SERVICE_HOST}:${env:HBASE_SERVICE_PORT}".to_string(),
+            );
+        }
+    };
+
+    // configOverride come last
+    config.extend(resolved_overrides(overrides));
+
+    Ok(to_hadoop_xml(
+        config
+            .into_iter()
+            .map(|(k, v)| (k, Some(v)))
+            .collect::<BTreeMap<_, _>>()
+            .iter(),
+    ))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::controller::build::properties::test_support::{
+        cluster_info, config_overrides, minimal_hbase,
+    };
+
+    fn master_merged_config(hbase: &v1alpha1::HbaseCluster) -> AnyServiceConfig {
+        hbase
+            .merged_config(&HbaseRole::Master, "default", "simple-hdfs")
+            .expect("merged config for the minimal master group")
+    }
+
+    fn region_server_merged_config(hbase: &v1alpha1::HbaseCluster) -> AnyServiceConfig {
+        hbase
+            .merged_config(&HbaseRole::RegionServer, "default", "simple-hdfs")
+            .expect("merged config for the minimal region server group")
+    }
+
+    fn rest_server_merged_config(hbase: &v1alpha1::HbaseCluster) -> AnyServiceConfig {
+        hbase
+            .merged_config(&HbaseRole::RestServer, "default", "simple-hdfs")
+            .expect("merged config for the minimal rest server group")
+    }
+
+    #[test]
+    fn renders_operator_defaults() {
+        let hbase = minimal_hbase();
+        let merged = master_merged_config(&hbase);
+        let xml = build(
+            &hbase,
+            &HbaseRole::Master,
+            &cluster_info(),
+            &merged,
+            BTreeMap::new(),
+            None,
+            config_overrides(&[]),
+        )
+        .unwrap();
+        assert!(
+            xml.contains("<name>hbase.cluster.distributed</name>\n    <value>true</value>"),
+            "{xml}"
+        );
+        assert!(
+            xml.contains("<name>hbase.master.ipc.address</name>\n    <value>0.0.0.0</value>"),
+            "{xml}"
+        );
+    }
+
+    #[test]
+    fn renders_region_server_bind_settings() {
+        let hbase = minimal_hbase();
+        let merged = region_server_merged_config(&hbase);
+        let xml = build(
+            &hbase,
+            &HbaseRole::RegionServer,
+            &cluster_info(),
+            &merged,
+            BTreeMap::new(),
+            None,
+            config_overrides(&[]),
+        )
+        .unwrap();
+        assert!(
+            xml.contains(
+                "<name>hbase.regionserver.ipc.address</name>\n    <value>0.0.0.0</value>"
+            ),
+            "{xml}"
+        );
+        assert!(
+            xml.contains(
+                "<name>hbase.unsafe.regionserver.hostname</name>\n    <value>${env:HBASE_SERVICE_HOST}</value>"
+            ),
+            "{xml}"
+        );
+    }
+
+    #[test]
+    fn renders_rest_server_endpoint() {
+        let hbase = minimal_hbase();
+        let merged = rest_server_merged_config(&hbase);
+        let xml = build(
+            &hbase,
+            &HbaseRole::RestServer,
+            &cluster_info(),
+            &merged,
+            BTreeMap::new(),
+            None,
+            config_overrides(&[]),
+        )
+        .unwrap();
+        assert!(
+            xml.contains(
+                "<name>hbase.rest.endpoint</name>\n    <value>${env:HBASE_SERVICE_HOST}:${env:HBASE_SERVICE_PORT}</value>"
+            ),
+            "{xml}"
+        );
+    }
+
+    #[test]
+    fn user_override_wins() {
+        let hbase = minimal_hbase();
+        let merged = master_merged_config(&hbase);
+        let xml = build(
+            &hbase,
+            &HbaseRole::Master,
+            &cluster_info(),
+            &merged,
+            BTreeMap::new(),
+            None,
+            config_overrides(&[("hbase.cluster.distributed", "false")]),
+        )
+        .unwrap();
+        assert!(
+            xml.contains("<name>hbase.cluster.distributed</name>\n    <value>false</value>"),
+            "{xml}"
+        );
+    }
+}
diff --git a/rust/operator-binary/src/controller/build/properties/mod.rs b/rust/operator-binary/src/controller/build/properties/mod.rs
new file mode 100644
index 00000000..5fb54649
--- /dev/null
+++ b/rust/operator-binary/src/controller/build/properties/mod.rs
@@ -0,0 +1,118 @@
+//! Per-file builders for the HBase config files assembled into the rolegroup
+//! `ConfigMap`. Each `<file>.rs` module produces the rendered content for one
+//! config file; the shared [`crate::config::writer`] module serializes maps to
+//! the Hadoop-XML / Java-properties on-wire format.
+
+use std::collections::BTreeMap;
+
+use stackable_operator::v2::config_overrides::KeyValueConfigOverrides;
+
+pub mod hbase_env;
+pub mod hbase_site;
+pub mod security_properties;
+pub mod ssl_client;
+pub mod ssl_server;
+
+/// Keep only the set (`Some`) entries of a `key -> optional value` map, as `(key, value)` pairs.
+fn defined_entries(
+    entries: BTreeMap<String, Option<String>>,
+) -> impl Iterator<Item = (String, String)> {
+    entries
+        .into_iter()
+        .filter_map(|(key, value)| value.map(|value| (key, value)))
+}
+
+/// Resolve user-provided [`KeyValueConfigOverrides`] into the key/value pairs to merge
+/// into a config file, dropping entries whose value is unset (`None`).
+fn resolved_overrides(
+    overrides: KeyValueConfigOverrides,
+) -> impl Iterator<Item = (String, String)> {
+    defined_entries(overrides.overrides)
+}
+
+/// The names of the HBase config files assembled into the rolegroup `ConfigMap`.
+#[derive(Clone, Copy, Debug, strum::Display)]
+pub enum ConfigFileName {
+    #[strum(serialize = "hbase-site.xml")]
+    HbaseSite,
+    #[strum(serialize = "hbase-env.sh")]
+    HbaseEnv,
+    #[strum(serialize = "ssl-server.xml")]
+    SslServer,
+    #[strum(serialize = "ssl-client.xml")]
+    SslClient,
+    #[strum(serialize = "security.properties")]
+    Security,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn file_names_match_the_hbase_on_disk_names() {
+        assert_eq!(ConfigFileName::HbaseSite.to_string(), "hbase-site.xml");
+        assert_eq!(ConfigFileName::HbaseEnv.to_string(), "hbase-env.sh");
+        assert_eq!(ConfigFileName::SslServer.to_string(), "ssl-server.xml");
+        assert_eq!(ConfigFileName::SslClient.to_string(), "ssl-client.xml");
+        assert_eq!(ConfigFileName::Security.to_string(), "security.properties");
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod test_support {
+    use stackable_operator::{
+        commons::networking::DomainName, utils::cluster_info::KubernetesClusterInfo,
+        v2::config_overrides::KeyValueConfigOverrides,
+    };
+
+    use crate::crd::v1alpha1;
+
+    /// Builds a [`KeyValueConfigOverrides`] from `(key, value)` pairs for tests.
+    pub fn config_overrides(pairs: &[(&str, &str)]) -> KeyValueConfigOverrides {
+        KeyValueConfigOverrides {
+            overrides: pairs
+                .iter()
+                .map(|(k, v)| (k.to_string(), Some(v.to_string())))
+                .collect(),
+        }
+    }
+
+    /// A minimal three-role HbaseCluster used to drive the per-file builder tests.
+    pub const MINIMAL_HBASE_YAML: &str = r#"
+---
+apiVersion: hbase.stackable.tech/v1alpha1
+kind: HbaseCluster
+metadata:
+  name: hbase
+  namespace: default
+spec:
+  image:
+    productVersion: 2.6.3
+  clusterConfig:
+    hdfsConfigMapName: simple-hdfs
+    zookeeperConfigMapName: simple-znode
+  masters:
+    roleGroups:
+      default:
+        replicas: 1
+  regionServers:
+    roleGroups:
+      default:
+        replicas: 1
+  restServers:
+    roleGroups:
+      default:
+        replicas: 1
+"#;
+
+    pub fn minimal_hbase() -> v1alpha1::HbaseCluster {
+        serde_yaml::from_str(MINIMAL_HBASE_YAML).expect("invalid test HbaseCluster YAML")
+    }
+
+    pub fn cluster_info() -> KubernetesClusterInfo {
+        KubernetesClusterInfo {
+            cluster_domain: DomainName::try_from("cluster.local").unwrap(),
+        }
+    }
+}
diff --git a/rust/operator-binary/src/controller/build/properties/security_properties.rs b/rust/operator-binary/src/controller/build/properties/security_properties.rs
new file mode 100644
index 00000000..421f925f
--- /dev/null
+++ b/rust/operator-binary/src/controller/build/properties/security_properties.rs
@@ -0,0 +1,86 @@
+//! Builds the `security.properties` (JVM security) config file.
+//!
+//! The operator injects role-specific JVM DNS cache TTLs (preserving the
+//! behaviour previously defined in `properties.yaml`). User `configOverrides`
+//! are applied on top.
+
+use std::collections::BTreeMap;
+
+use stackable_operator::v2::config_overrides::KeyValueConfigOverrides;
+
+use crate::{
+    config::writer::{PropertiesWriterError, to_java_properties_string},
+    controller::build::properties::resolved_overrides,
+    crd::HbaseRole,
+};
+
+/// Renders `security.properties`: role-specific DNS cache TTLs plus user overrides.
+pub fn build(
+    role: &HbaseRole,
+    overrides: KeyValueConfigOverrides,
+) -> Result<String, PropertiesWriterError> {
+    // Role-specific positive DNS cache TTLs. Caching forever (the JVM default for
+    // successful lookups) breaks failover when a peer's IP changes, so cap the
+    // positive cache and disable the negative cache.
+    let positive_ttl = match role {
+        HbaseRole::Master => "5",
+        HbaseRole::RegionServer => "10",
+        HbaseRole::RestServer => "30",
+    };
+
+    let mut config: BTreeMap<String, Option<String>> = BTreeMap::from([
+        (
+            "networkaddress.cache.ttl".to_string(),
+            Some(positive_ttl.to_string()),
+        ),
+        (
+            "networkaddress.cache.negative.ttl".to_string(),
+            Some("0".to_string()),
+        ),
+    ]);
+    // Overrides applied last so users win.
+    config.extend(resolved_overrides(overrides).map(|(key, value)| (key, Some(value))));
+    to_java_properties_string(config.iter())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::controller::build::properties::test_support::config_overrides;
+
+    #[test]
+    fn injects_master_dns_cache_ttl() {
+        assert_eq!(
+            build(&HbaseRole::Master, config_overrides(&[])).unwrap(),
+            "networkaddress.cache.negative.ttl=0\nnetworkaddress.cache.ttl=5\n"
+        );
+    }
+
+    #[test]
+    fn injects_regionserver_dns_cache_ttl() {
+        assert_eq!(
+            build(&HbaseRole::RegionServer, config_overrides(&[])).unwrap(),
+            "networkaddress.cache.negative.ttl=0\nnetworkaddress.cache.ttl=10\n"
+        );
+    }
+
+    #[test]
+    fn injects_restserver_dns_cache_ttl() {
+        assert_eq!(
+            build(&HbaseRole::RestServer, config_overrides(&[])).unwrap(),
+            "networkaddress.cache.negative.ttl=0\nnetworkaddress.cache.ttl=30\n"
+        );
+    }
+
+    #[test]
+    fn user_overrides_win_over_injected_defaults() {
+        assert_eq!(
+            build(
+                &HbaseRole::Master,
+                config_overrides(&[("networkaddress.cache.ttl", "60")])
+            )
+            .unwrap(),
+            "networkaddress.cache.negative.ttl=0\nnetworkaddress.cache.ttl=60\n"
+        );
+    }
+}
diff --git a/rust/operator-binary/src/controller/build/properties/ssl_client.rs b/rust/operator-binary/src/controller/build/properties/ssl_client.rs
new file mode 100644
index 00000000..fdfac797
--- /dev/null
+++ b/rust/operator-binary/src/controller/build/properties/ssl_client.rs
@@ -0,0 +1,47 @@
+//! Builds the `ssl-client.xml` config file: kerberos/TLS client settings + overrides.
+use std::collections::BTreeMap;
+
+use stackable_operator::v2::config_overrides::KeyValueConfigOverrides;
+
+use crate::{
+    config::writer::to_hadoop_xml, controller::build::properties::resolved_overrides,
+    crd::v1alpha1, kerberos::kerberos_ssl_client_settings,
+};
+
+/// Renders `ssl-client.xml`. Returns "" (HBase rejects empty XML files) when empty.
+pub fn build(hbase: &v1alpha1::HbaseCluster, overrides: KeyValueConfigOverrides) -> String {
+    let mut config: BTreeMap<String, Option<String>> = BTreeMap::new();
+    config.extend(
+        kerberos_ssl_client_settings(hbase)
+            .into_iter()
+            .map(|(k, v)| (k, Some(v))),
+    );
+    config.extend(resolved_overrides(overrides).map(|(k, v)| (k, Some(v))));
+    if config.is_empty() {
+        return String::new();
+    }
+    to_hadoop_xml(config.iter())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::controller::build::properties::test_support::{config_overrides, minimal_hbase};
+
+    #[test]
+    fn non_kerberos_without_overrides_renders_empty_string() {
+        assert_eq!(build(&minimal_hbase(), config_overrides(&[])), "");
+    }
+
+    #[test]
+    fn user_override_appears_in_xml() {
+        let xml = build(
+            &minimal_hbase(),
+            config_overrides(&[("ssl.client.keystore.type", "jks")]),
+        );
+        assert!(
+            xml.contains("<name>ssl.client.keystore.type</name>\n    <value>jks</value>"),
+            "{xml}"
+        );
+    }
+}
diff --git a/rust/operator-binary/src/controller/build/properties/ssl_server.rs b/rust/operator-binary/src/controller/build/properties/ssl_server.rs
new file mode 100644
index 00000000..f2d6a91c
--- /dev/null
+++ b/rust/operator-binary/src/controller/build/properties/ssl_server.rs
@@ -0,0 +1,47 @@
+//! Builds the `ssl-server.xml` config file: kerberos/TLS server settings + overrides.
+use std::collections::BTreeMap;
+
+use stackable_operator::v2::config_overrides::KeyValueConfigOverrides;
+
+use crate::{
+    config::writer::to_hadoop_xml, controller::build::properties::resolved_overrides,
+    crd::v1alpha1, kerberos::kerberos_ssl_server_settings,
+};
+
+/// Renders `ssl-server.xml`. Returns "" (HBase rejects empty XML files) when empty.
+pub fn build(hbase: &v1alpha1::HbaseCluster, overrides: KeyValueConfigOverrides) -> String {
+    let mut config: BTreeMap<String, Option<String>> = BTreeMap::new();
+    config.extend(
+        kerberos_ssl_server_settings(hbase)
+            .into_iter()
+            .map(|(k, v)| (k, Some(v))),
+    );
+    config.extend(resolved_overrides(overrides).map(|(k, v)| (k, Some(v))));
+    if config.is_empty() {
+        return String::new();
+    }
+    to_hadoop_xml(config.iter())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::controller::build::properties::test_support::{config_overrides, minimal_hbase};
+
+    #[test]
+    fn non_kerberos_without_overrides_renders_empty_string() {
+        assert_eq!(build(&minimal_hbase(), config_overrides(&[])), "");
+    }
+
+    #[test]
+    fn user_override_appears_in_xml() {
+        let xml = build(
+            &minimal_hbase(),
+            config_overrides(&[("ssl.server.keystore.type", "jks")]),
+        );
+        assert!(
+            xml.contains("<name>ssl.server.keystore.type</name>\n    <value>jks</value>"),
+            "{xml}"
+        );
+    }
+}
diff --git a/rust/operator-binary/src/controller/mod.rs b/rust/operator-binary/src/controller/mod.rs
index 1b261dfe..a1196d5d 100644
--- a/rust/operator-binary/src/controller/mod.rs
+++ b/rust/operator-binary/src/controller/mod.rs
@@ -1,2 +1,3 @@
+pub mod build;
 pub mod dereference;
 pub mod validate;
diff --git a/rust/operator-binary/src/controller/validate.rs b/rust/operator-binary/src/controller/validate.rs
index 36d7620e..d2aa20b4 100644
--- a/rust/operator-binary/src/controller/validate.rs
+++ b/rust/operator-binary/src/controller/validate.rs
@@ -130,7 +130,6 @@ pub fn validate_cluster(
             zookeeper_connection_information: dereferenced_objects
                 .zookeeper_connection_information,
             hbase_opa_config: dereferenced_objects.hbase_opa_config,
-            kerberos_enabled: hbase.has_kerberos_enabled(),
         },
         role_group_configs: role_groups,
         role_configs,
diff --git a/rust/operator-binary/src/crd/mod.rs b/rust/operator-binary/src/crd/mod.rs
index a04386d3..13144611 100644
--- a/rust/operator-binary/src/crd/mod.rs
+++ b/rust/operator-binary/src/crd/mod.rs
@@ -1289,6 +1289,16 @@ impl AnyServiceConfig {
         }
     }
 
+    /// The configured `hbase.rootdir`, if any. Previously injected into
+    /// `hbase-site.xml` via product-config's `compute_files`.
+    pub fn hbase_rootdir(&self) -> Option<String> {
+        match self {
+            AnyServiceConfig::Master(config) => config.hbase_rootdir.clone(),
+            AnyServiceConfig::RegionServer(config) => config.hbase_rootdir.clone(),
+            AnyServiceConfig::RestServer(config) => config.hbase_rootdir.clone(),
+        }
+    }
+
     /// Returns command line arguments to pass on to the region mover tool.
     /// The following arguments are excluded because they are already part of the
     /// hbase-entrypoint.sh script.
diff --git a/rust/operator-binary/src/hbase_controller.rs b/rust/operator-binary/src/hbase_controller.rs
index c2331b12..3710541a 100644
--- a/rust/operator-binary/src/hbase_controller.rs
+++ b/rust/operator-binary/src/hbase_controller.rs
@@ -129,9 +129,6 @@ pub struct ValidatedCluster {
 pub struct ValidatedClusterConfig {
     pub zookeeper_connection_information: ZookeeperConnectionInformation,
     pub hbase_opa_config: Option<HbaseOpaConfig>,
-    // Populated now; consumed by the new build path in a later commit.
-    #[allow(dead_code)]
-    pub kerberos_enabled: bool,
 }
 
 /// Per-role configuration extracted during validation.
@@ -148,8 +145,6 @@ pub struct ValidatedRoleConfig {
 #[derive(Clone, Debug)]
 pub struct ValidatedRoleGroupConfig {
     pub merged_config: AnyServiceConfig,
-    // Populated now; consumed by the new build path in a later commit.
-    #[allow(dead_code)]
     pub config_overrides: v1alpha1::HbaseConfigOverrides,
     // Populated now; consumed by the new build path in a later commit.
     #[allow(dead_code)]

From a793c48e26c8dbb85c9022d0470d67d1167ab096 Mon Sep 17 00:00:00 2001
From: Malte Sander <malte.sander.it@gmail.com>
Date: Wed, 3 Jun 2026 16:01:55 +0200
Subject: [PATCH 04/21] refactor: build rolegroup ConfigMap from the validated
 cluster

Wire reconcile to the new controller/build config_map orchestrator, build container
env from validated env_overrides instead of the product-config Env map, and delete the
old PropertyNameKind-based config-map and hbase-env.sh builders.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../src/controller/build/config_map.rs        |   1 -
 rust/operator-binary/src/crd/mod.rs           |  29 +-
 rust/operator-binary/src/hbase_controller.rs  | 353 ++----------------
 3 files changed, 37 insertions(+), 346 deletions(-)

diff --git a/rust/operator-binary/src/controller/build/config_map.rs b/rust/operator-binary/src/controller/build/config_map.rs
index c5586691..741d23a0 100644
--- a/rust/operator-binary/src/controller/build/config_map.rs
+++ b/rust/operator-binary/src/controller/build/config_map.rs
@@ -61,7 +61,6 @@ pub enum Error {
 
 type Result<T, E = Error> = std::result::Result<T, E>;
 
-#[allow(dead_code)]
 pub fn build_rolegroup_config_map(
     hbase: &v1alpha1::HbaseCluster,
     cluster: &ValidatedCluster,
diff --git a/rust/operator-binary/src/crd/mod.rs b/rust/operator-binary/src/crd/mod.rs
index 13144611..4b1a6328 100644
--- a/rust/operator-binary/src/crd/mod.rs
+++ b/rust/operator-binary/src/crd/mod.rs
@@ -576,20 +576,15 @@ impl KeyValueOverridesProvider for v1alpha1::HbaseConfigOverrides {
     }
 }
 
-pub fn merged_env(rolegroup_config: Option<&BTreeMap<String, String>>) -> Vec<EnvVar> {
-    let merged_env: Vec<EnvVar> = if let Some(rolegroup_config) = rolegroup_config {
-        rolegroup_config
-            .iter()
-            .map(|(env_name, env_value)| EnvVar {
-                name: env_name.clone(),
-                value: Some(env_value.to_owned()),
-                value_from: None,
-            })
-            .collect()
-    } else {
-        vec![]
-    };
-    merged_env
+pub fn merged_env(rolegroup_config: &BTreeMap<String, String>) -> Vec<EnvVar> {
+    rolegroup_config
+        .iter()
+        .map(|(env_name, env_value)| EnvVar {
+            name: env_name.clone(),
+            value: Some(env_value.to_owned()),
+            value_from: None,
+        })
+        .collect()
 }
 
 #[derive(
@@ -1443,8 +1438,10 @@ spec:
             .unwrap()
             .get("default")
             .unwrap()
-            .get(&PropertyNameKind::Env);
-        let merged_env = merged_env(rolegroup_config);
+            .get(&PropertyNameKind::Env)
+            .cloned()
+            .unwrap_or_default();
+        let merged_env = merged_env(&rolegroup_config);
 
         let env_map: BTreeMap<&str, Option<String>> = merged_env
             .iter()
diff --git a/rust/operator-binary/src/hbase_controller.rs b/rust/operator-binary/src/hbase_controller.rs
index 3710541a..90fe9c8e 100644
--- a/rust/operator-binary/src/hbase_controller.rs
+++ b/rust/operator-binary/src/hbase_controller.rs
@@ -2,7 +2,6 @@
 
 use std::{
     collections::{BTreeMap, HashMap},
-    fmt::Write,
     sync::Arc,
 };
 
@@ -13,7 +12,6 @@ use snafu::{OptionExt, ResultExt, Snafu};
 use stackable_operator::{
     builder::{
         self,
-        configmap::ConfigMapBuilder,
         meta::ObjectMetaBuilder,
         pod::{
             PodBuilder, container::ContainerBuilder, resources::ResourceRequirementsBuilder,
@@ -28,8 +26,8 @@ use stackable_operator::{
         api::{
             apps::v1::{StatefulSet, StatefulSetSpec},
             core::v1::{
-                ConfigMap, ConfigMapVolumeSource, ContainerPort, EnvVar, Probe, Service,
-                ServiceAccount, ServicePort, ServiceSpec, TCPSocketAction, Volume,
+                ConfigMapVolumeSource, ContainerPort, EnvVar, Probe, Service, ServiceAccount,
+                ServicePort, ServiceSpec, TCPSocketAction, Volume,
             },
         },
         apimachinery::pkg::{apis::meta::v1::LabelSelector, util::intstr::IntOrString},
@@ -56,35 +54,20 @@ use stackable_operator::{
         compute_conditions, operations::ClusterOperationsConditionBuilder,
         statefulset::StatefulSetConditionBuilder,
     },
-    utils::cluster_info::KubernetesClusterInfo,
     v2::types::operator::ClusterName,
 };
 use strum::{EnumDiscriminants, IntoStaticStr, ParseError};
 
 use crate::{
     OPERATOR_NAME,
-    config::{
-        jvm::{
-            construct_global_jvm_args, construct_hbase_heapsize_env,
-            construct_role_specific_non_heap_jvm_args,
-        },
-        writer::{PropertiesWriterError, to_hadoop_xml, to_java_properties_string},
-    },
     crd::{
-        APP_NAME, AnyServiceConfig, Container, HBASE_ENV_SH, HBASE_MASTER_PORT,
-        HBASE_MASTER_UI_PORT, HBASE_REGIONSERVER_PORT, HBASE_REGIONSERVER_UI_PORT, HBASE_SITE_XML,
-        HbaseClusterStatus, HbaseRole, JVM_SECURITY_PROPERTIES_FILE, LISTENER_VOLUME_DIR,
-        LISTENER_VOLUME_NAME, SSL_CLIENT_XML, SSL_SERVER_XML, merged_env, v1alpha1,
+        APP_NAME, AnyServiceConfig, CONFIG_DIR_NAME, Container, HbaseClusterStatus, HbaseRole,
+        LISTENER_VOLUME_DIR, LISTENER_VOLUME_NAME, merged_env, v1alpha1,
     },
     discovery::build_discovery_configmap,
-    kerberos::{
-        self, add_kerberos_pod_config, kerberos_config_properties, kerberos_ssl_client_settings,
-        kerberos_ssl_server_settings,
-    },
+    kerberos::{self, add_kerberos_pod_config},
     operations::{graceful_shutdown::add_graceful_shutdown_config, pdb::add_pdbs},
-    product_logging::{
-        CONTAINERDEBUG_LOG_DIRECTORY, STACKABLE_LOG_DIR, extend_role_group_config_map,
-    },
+    product_logging::{CONTAINERDEBUG_LOG_DIRECTORY, STACKABLE_LOG_DIR},
     security::opa::HbaseOpaConfig,
     zookeeper::ZookeeperConnectionInformation,
 };
@@ -146,9 +129,9 @@ pub struct ValidatedRoleConfig {
 pub struct ValidatedRoleGroupConfig {
     pub merged_config: AnyServiceConfig,
     pub config_overrides: v1alpha1::HbaseConfigOverrides,
-    // Populated now; consumed by the new build path in a later commit.
-    #[allow(dead_code)]
     pub env_overrides: BTreeMap<String, String>,
+    // Retained until the product-config path is fully removed in a later commit.
+    #[allow(dead_code)]
     pub product_config_properties: HashMap<PropertyNameKind, BTreeMap<String, String>>,
 }
 
@@ -182,10 +165,9 @@ pub enum Error {
     #[snafu(display("failed to build discovery configmap"))]
     BuildDiscoveryConfigMap { source: super::discovery::Error },
 
-    #[snafu(display("failed to build ConfigMap for {}", rolegroup))]
-    BuildRoleGroupConfig {
-        source: stackable_operator::builder::configmap::Error,
-        rolegroup: RoleGroupRef<v1alpha1::HbaseCluster>,
+    #[snafu(display("failed to build rolegroup ConfigMap"))]
+    BuildRolegroupConfigMap {
+        source: crate::controller::build::config_map::Error,
     },
 
     #[snafu(display("failed to apply ConfigMap for {}", rolegroup))]
@@ -224,12 +206,6 @@ pub enum Error {
     #[snafu(display("vector agent is enabled but vector aggregator ConfigMap is missing"))]
     VectorAggregatorConfigMapMissing,
 
-    #[snafu(display("failed to add the logging configuration to the ConfigMap [{cm_name}]"))]
-    InvalidLoggingConfig {
-        source: crate::product_logging::Error,
-        cm_name: String,
-    },
-
     #[snafu(display("failed to add kerberos config"))]
     AddKerberosConfig { source: kerberos::Error },
 
@@ -243,15 +219,6 @@ pub enum Error {
         source: stackable_operator::commons::rbac::Error,
     },
 
-    #[snafu(display(
-        "failed to serialize [{JVM_SECURITY_PROPERTIES_FILE}] for {}",
-        rolegroup
-    ))]
-    SerializeJvmSecurity {
-        source: PropertiesWriterError,
-        rolegroup: RoleGroupRef<v1alpha1::HbaseCluster>,
-    },
-
     #[snafu(display("failed to create PodDisruptionBudget"))]
     FailedToCreatePdb {
         source: crate::operations::pdb::Error,
@@ -289,12 +256,6 @@ pub enum Error {
         source: error_boundary::InvalidObject,
     },
 
-    #[snafu(display("failed to construct HBASE_HEAPSIZE env variable"))]
-    ConstructHbaseHeapsizeEnv { source: crate::config::jvm::Error },
-
-    #[snafu(display("failed to construct JVM arguments"))]
-    ConstructJvmArgument { source: crate::config::jvm::Error },
-
     #[snafu(display("failed to build Labels"))]
     LabelBuild {
         source: stackable_operator::kvp::LabelError,
@@ -390,23 +351,19 @@ pub async fn reconcile_hbase(
             let rg_metrics_service =
                 build_rolegroup_metrics_service(hbase, hbase_role, &rolegroup, &validated.image)?;
 
-            let rg_configmap = build_rolegroup_config_map(
+            let rg_configmap = crate::controller::build::config_map::build_rolegroup_config_map(
                 hbase,
+                &validated,
                 hbase_role,
                 &client.kubernetes_cluster_info,
                 &rolegroup,
-                &validated_rg_config.product_config_properties,
-                &validated.cluster_config.zookeeper_connection_information,
-                &validated_rg_config.merged_config,
-                &validated.image,
-                validated.cluster_config.hbase_opa_config.as_ref(),
-            )?;
+            )
+            .context(BuildRolegroupConfigMapSnafu)?;
             let rg_statefulset = build_rolegroup_statefulset(
                 hbase,
                 hbase_role,
                 &rolegroup,
-                &validated_rg_config.product_config_properties,
-                &validated_rg_config.merged_config,
+                validated_rg_config,
                 &validated.image,
                 &rbac_sa,
             )?;
@@ -488,216 +445,6 @@ pub async fn reconcile_hbase(
     Ok(Action::await_change())
 }
 
-/// The rolegroup [`ConfigMap`] configures the rolegroup based on the configuration given by the administrator
-#[allow(clippy::too_many_arguments)]
-fn build_rolegroup_config_map(
-    hbase: &v1alpha1::HbaseCluster,
-    hbase_role: &HbaseRole,
-    cluster_info: &KubernetesClusterInfo,
-    rolegroup: &RoleGroupRef<v1alpha1::HbaseCluster>,
-    rolegroup_config: &HashMap<PropertyNameKind, BTreeMap<String, String>>,
-    zookeeper_connection_information: &ZookeeperConnectionInformation,
-    merged_config: &AnyServiceConfig,
-    resolved_product_image: &ResolvedProductImage,
-    hbase_opa_config: Option<&HbaseOpaConfig>,
-) -> Result<ConfigMap, Error> {
-    let mut hbase_site_xml = String::new();
-    let mut hbase_env_sh = String::new();
-    let mut ssl_server_xml = String::new();
-    let mut ssl_client_xml = String::new();
-
-    for (property_name_kind, config) in rolegroup_config {
-        match property_name_kind {
-            PropertyNameKind::File(file_name) if file_name == HBASE_SITE_XML => {
-                let mut hbase_site_config = BTreeMap::new();
-                hbase_site_config.extend(zookeeper_connection_information.as_hbase_settings());
-                hbase_site_config.extend(
-                    kerberos_config_properties(hbase, cluster_info)
-                        .context(AddKerberosConfigSnafu)?,
-                );
-                hbase_site_config
-                    .extend(hbase_opa_config.map_or(vec![], |config| config.hbase_site_config()));
-
-                // Set flag to override default behaviour, which is that the
-                // RPC client should bind the client address (forcing outgoing
-                // RPC traffic to happen from the same network interface that
-                // the RPC server is bound on).
-                hbase_site_config.insert(
-                    "hbase.client.rpc.bind.address".to_string(),
-                    "false".to_string(),
-                );
-
-                match hbase_role {
-                    HbaseRole::Master => {
-                        hbase_site_config.insert(
-                            "hbase.master.ipc.address".to_string(),
-                            "0.0.0.0".to_string(),
-                        );
-                        hbase_site_config.insert(
-                            "hbase.master.ipc.port".to_string(),
-                            HBASE_MASTER_PORT.to_string(),
-                        );
-                        hbase_site_config.insert(
-                            "hbase.master.hostname".to_string(),
-                            "${env:HBASE_SERVICE_HOST}".to_string(),
-                        );
-                        hbase_site_config.insert(
-                            "hbase.master.port".to_string(),
-                            "${env:HBASE_SERVICE_PORT}".to_string(),
-                        );
-                        hbase_site_config.insert(
-                            "hbase.master.info.port".to_string(),
-                            "${env:HBASE_INFO_PORT}".to_string(),
-                        );
-                        hbase_site_config.insert(
-                            "hbase.master.bound.info.port".to_string(),
-                            HBASE_MASTER_UI_PORT.to_string(),
-                        );
-                    }
-                    HbaseRole::RegionServer => {
-                        hbase_site_config.insert(
-                            "hbase.regionserver.ipc.address".to_string(),
-                            "0.0.0.0".to_string(),
-                        );
-                        hbase_site_config.insert(
-                            "hbase.regionserver.ipc.port".to_string(),
-                            HBASE_REGIONSERVER_PORT.to_string(),
-                        );
-                        hbase_site_config.insert(
-                            "hbase.unsafe.regionserver.hostname".to_string(),
-                            "${env:HBASE_SERVICE_HOST}".to_string(),
-                        );
-                        hbase_site_config.insert(
-                            "hbase.regionserver.port".to_string(),
-                            "${env:HBASE_SERVICE_PORT}".to_string(),
-                        );
-                        hbase_site_config.insert(
-                            "hbase.regionserver.info.port".to_string(),
-                            "${env:HBASE_INFO_PORT}".to_string(),
-                        );
-                        hbase_site_config.insert(
-                            "hbase.regionserver.bound.info.port".to_string(),
-                            HBASE_REGIONSERVER_UI_PORT.to_string(),
-                        );
-                    }
-                    HbaseRole::RestServer => {
-                        hbase_site_config.insert(
-                            // N.B. a custom tag, so as not to interfere with HBase internals.
-                            // The other roles use a patch to correctly resolve host/port.
-                            "hbase.rest.endpoint".to_string(),
-                            "${env:HBASE_SERVICE_HOST}:${env:HBASE_SERVICE_PORT}".to_string(),
-                        );
-                    }
-                };
-
-                // configOverride come last
-                hbase_site_config.extend(config.clone());
-                hbase_site_xml = to_hadoop_xml(
-                    hbase_site_config
-                        .into_iter()
-                        .map(|(k, v)| (k, Some(v)))
-                        .collect::<BTreeMap<_, _>>()
-                        .iter(),
-                );
-            }
-            PropertyNameKind::File(file_name) if file_name == HBASE_ENV_SH => {
-                let mut hbase_env_config =
-                    build_hbase_env_sh(hbase, merged_config, hbase_role, &rolegroup.role_group)?;
-
-                // configOverride come last
-                hbase_env_config.extend(config.clone());
-                hbase_env_sh = write_hbase_env_sh(hbase_env_config.iter());
-            }
-            PropertyNameKind::File(file_name) if file_name == SSL_SERVER_XML => {
-                let mut config_opts = BTreeMap::new();
-                config_opts.extend(kerberos_ssl_server_settings(hbase));
-
-                // configOverride come last
-                config_opts.extend(config.clone());
-                ssl_server_xml = to_hadoop_xml(
-                    config_opts
-                        .into_iter()
-                        .map(|(k, v)| (k, Some(v)))
-                        .collect::<BTreeMap<_, _>>()
-                        .iter(),
-                );
-            }
-            PropertyNameKind::File(file_name) if file_name == SSL_CLIENT_XML => {
-                let mut config_opts = BTreeMap::new();
-                config_opts.extend(kerberos_ssl_client_settings(hbase));
-
-                // configOverride come last
-                config_opts.extend(config.clone());
-                ssl_client_xml = to_hadoop_xml(
-                    config_opts
-                        .into_iter()
-                        .map(|(k, v)| (k, Some(v)))
-                        .collect::<BTreeMap<_, _>>()
-                        .iter(),
-                );
-            }
-            _ => {}
-        }
-    }
-
-    let jvm_sec_props: BTreeMap<String, Option<String>> = rolegroup_config
-        .get(&PropertyNameKind::File(
-            JVM_SECURITY_PROPERTIES_FILE.to_string(),
-        ))
-        .cloned()
-        .unwrap_or_default()
-        .into_iter()
-        .map(|(k, v)| (k, Some(v)))
-        .collect();
-    let jvm_sec_props = to_java_properties_string(jvm_sec_props.iter()).with_context(|_| {
-        SerializeJvmSecuritySnafu {
-            rolegroup: rolegroup.clone(),
-        }
-    })?;
-
-    let mut builder = ConfigMapBuilder::new();
-
-    let cm_metadata = ObjectMetaBuilder::new()
-        .name_and_namespace(hbase)
-        .name(rolegroup.object_name())
-        .ownerreference_from_resource(hbase, None, Some(true))
-        .context(ObjectMissingMetadataForOwnerRefSnafu)?
-        .with_recommended_labels(&build_recommended_labels(
-            hbase,
-            &resolved_product_image.app_version_label_value,
-            &rolegroup.role,
-            &rolegroup.role_group,
-        ))
-        .context(ObjectMetaSnafu)?
-        .build();
-
-    builder
-        .metadata(cm_metadata)
-        .add_data(HBASE_SITE_XML, hbase_site_xml)
-        .add_data(HBASE_ENV_SH, hbase_env_sh)
-        .add_data(JVM_SECURITY_PROPERTIES_FILE, jvm_sec_props);
-
-    // HBase does not like empty config files:
-    // Caused by: com.ctc.wstx.exc.WstxEOFException: Unexpected EOF in prolog at [row,col,system-id]: [1,0,"file:/stackable/conf/ssl-server.xml"]
-    if !ssl_server_xml.is_empty() {
-        builder.add_data(SSL_SERVER_XML, ssl_server_xml);
-    }
-    if !ssl_client_xml.is_empty() {
-        builder.add_data(SSL_CLIENT_XML, ssl_client_xml);
-    }
-
-    extend_role_group_config_map(rolegroup, merged_config.logging(), &mut builder).context(
-        InvalidLoggingConfigSnafu {
-            cm_name: rolegroup.object_name(),
-        },
-    )?;
-
-    builder.build().map_err(|e| Error::BuildRoleGroupConfig {
-        source: e,
-        rolegroup: rolegroup.clone(),
-    })
-}
-
 /// The rolegroup [`Service`] is a headless service that allows direct access to the instances of a certain rolegroup
 ///
 /// This is mostly useful for internal communication between peers, or for clients that perform client-side load balancing.
@@ -833,11 +580,11 @@ fn build_rolegroup_statefulset(
     hbase: &v1alpha1::HbaseCluster,
     hbase_role: &HbaseRole,
     rolegroup_ref: &RoleGroupRef<v1alpha1::HbaseCluster>,
-    rolegroup_config: &HashMap<PropertyNameKind, BTreeMap<String, String>>,
-    merged_config: &AnyServiceConfig,
+    validated_rg_config: &ValidatedRoleGroupConfig,
     resolved_product_image: &ResolvedProductImage,
     service_account: &ServiceAccount,
 ) -> Result<StatefulSet> {
+    let merged_config = &validated_rg_config.merged_config;
     let hbase_version = &resolved_product_image.app_version_label_value;
 
     let ports = hbase_role
@@ -879,7 +626,12 @@ fn build_rolegroup_statefulset(
         ..probe_template
     };
 
-    let mut merged_env = merged_env(rolegroup_config.get(&PropertyNameKind::Env));
+    let mut env_map: BTreeMap<String, String> = BTreeMap::from([
+        ("HBASE_CONF_DIR".to_string(), CONFIG_DIR_NAME.to_string()),
+        ("HADOOP_CONF_DIR".to_string(), CONFIG_DIR_NAME.to_string()),
+    ]);
+    env_map.extend(validated_rg_config.env_overrides.clone());
+    let mut merged_env = merged_env(&env_map);
     // This env var is set for all roles to avoid bash's "unbound variable" errors
     merged_env.extend([
         EnvVar {
@@ -1125,16 +877,6 @@ fn command() -> Vec<String> {
     ]
 }
 
-fn write_hbase_env_sh<'a, T>(properties: T) -> String
-where
-    T: Iterator<Item = (&'a String, &'a String)>,
-{
-    properties.fold(String::new(), |mut output, (variable, value)| {
-        let _ = writeln!(output, "export {variable}=\"{value}\"");
-        output
-    })
-}
-
 pub fn error_policy(
     _obj: Arc<DeserializeGuard<v1alpha1::HbaseCluster>>,
     error: &Error,
@@ -1164,53 +906,6 @@ pub fn build_recommended_labels<'a>(
     }
 }
 
-/// The content of the HBase `hbase-env.sh` file.
-fn build_hbase_env_sh(
-    hbase: &v1alpha1::HbaseCluster,
-    merged_config: &AnyServiceConfig,
-    hbase_role: &HbaseRole,
-    role_group: &str,
-) -> Result<BTreeMap<String, String>, Error> {
-    let mut result = BTreeMap::new();
-
-    result.insert("HBASE_MANAGES_ZK".to_string(), "false".to_string());
-
-    result.insert(
-        "HBASE_HEAPSIZE".to_owned(),
-        construct_hbase_heapsize_env(merged_config).context(ConstructHbaseHeapsizeEnvSnafu)?,
-    );
-    result.insert(
-        "HBASE_OPTS".to_owned(),
-        construct_global_jvm_args(hbase.has_kerberos_enabled()),
-    );
-    let role_specific_non_heap_jvm_args =
-        construct_role_specific_non_heap_jvm_args(hbase, hbase_role, role_group)
-            .context(ConstructJvmArgumentSnafu)?;
-
-    match hbase_role {
-        HbaseRole::Master => {
-            result.insert(
-                "HBASE_MASTER_OPTS".to_string(),
-                role_specific_non_heap_jvm_args,
-            );
-        }
-        HbaseRole::RegionServer => {
-            result.insert(
-                "HBASE_REGIONSERVER_OPTS".to_string(),
-                role_specific_non_heap_jvm_args,
-            );
-        }
-        HbaseRole::RestServer => {
-            result.insert(
-                "HBASE_REST_OPTS".to_string(),
-                role_specific_non_heap_jvm_args,
-            );
-        }
-    }
-
-    Ok(result)
-}
-
 #[cfg(test)]
 mod test {
     use rstest::rstest;

From a106a7dfcfe40300734780b7b368d662ebccad98 Mon Sep 17 00:00:00 2001
From: Malte Sander <malte.sander.it@gmail.com>
Date: Wed, 3 Jun 2026 16:39:41 +0200
Subject: [PATCH 05/21] refactor: validate the HbaseCluster without
 product-config

Drop ProductConfigManager / transform_all_roles_to_config /
validate_all_roles_and_groups_config from the validate step, remove the Configuration
trait impls and build_role_properties from the CRD, delete the now-unused
product_config_properties field and the Ctx.product_config field, and stop loading
the product config in main.rs. The product-config crate is now unreferenced in source.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../src/controller/validate.rs                | 157 ++++++---
 rust/operator-binary/src/crd/mod.rs           | 326 +-----------------
 rust/operator-binary/src/hbase_controller.rs  |  14 +-
 rust/operator-binary/src/main.rs              |   8 +-
 4 files changed, 118 insertions(+), 387 deletions(-)

diff --git a/rust/operator-binary/src/controller/validate.rs b/rust/operator-binary/src/controller/validate.rs
index d2aa20b4..720d9c2d 100644
--- a/rust/operator-binary/src/controller/validate.rs
+++ b/rust/operator-binary/src/controller/validate.rs
@@ -1,15 +1,14 @@
 use std::{collections::BTreeMap, str::FromStr};
 
-use product_config::ProductConfigManager;
 use snafu::{ResultExt, Snafu};
 use stackable_operator::{
     commons::product_image_selection::{self},
     config::merge::Merge,
     kube::ResourceExt,
-    product_config_utils::{transform_all_roles_to_config, validate_all_roles_and_groups_config},
     role_utils::GenericRoleConfig,
     v2::types::operator::ClusterName,
 };
+use strum::IntoEnumIterator;
 
 use crate::{
     controller::dereference::DereferencedObjects,
@@ -32,24 +31,8 @@ pub enum Error {
         source: stackable_operator::v2::macros::attributed_string_type::Error,
     },
 
-    #[snafu(display("invalid role properties"))]
-    RoleProperties { source: crate::crd::Error },
-
-    #[snafu(display("failed to generate product config"))]
-    GenerateProductConfig {
-        source: stackable_operator::product_config_utils::Error,
-    },
-
-    #[snafu(display("invalid product config"))]
-    InvalidProductConfig {
-        source: stackable_operator::product_config_utils::Error,
-    },
-
-    #[snafu(display("could not parse Hbase role [{role}]"))]
-    UnidentifiedHbaseRole {
-        source: strum::ParseError,
-        role: String,
-    },
+    #[snafu(display("the HbaseCluster has no {role} role defined"))]
+    MissingRequiredRole { role: String },
 
     #[snafu(display("failed to resolve and merge config for role and role group"))]
     FailedToResolveConfig { source: crate::crd::Error },
@@ -58,7 +41,6 @@ pub enum Error {
 pub fn validate_cluster(
     hbase: &v1alpha1::HbaseCluster,
     image_repository: &str,
-    product_config_manager: &ProductConfigManager,
     dereferenced_objects: DereferencedObjects,
 ) -> Result<ValidatedCluster, Error> {
     let resolved_product_image = hbase
@@ -71,24 +53,25 @@ pub fn validate_cluster(
         )
         .context(ResolveProductImageSnafu)?;
 
-    let roles = hbase.build_role_properties().context(RolePropertiesSnafu)?;
-
-    let validated_config = validate_all_roles_and_groups_config(
-        &resolved_product_image.product_version,
-        &transform_all_roles_to_config(hbase, &roles).context(GenerateProductConfigSnafu)?,
-        product_config_manager,
-        false,
-        false,
-    )
-    .context(InvalidProductConfigSnafu)?;
-
     let mut role_groups = BTreeMap::new();
     let mut role_configs = BTreeMap::new();
 
-    for (role_name, group_config) in validated_config.iter() {
-        let hbase_role = HbaseRole::from_str(role_name).context(UnidentifiedHbaseRoleSnafu {
-            role: role_name.to_string(),
-        })?;
+    for hbase_role in HbaseRole::iter() {
+        let role_group_names = role_group_names(hbase, &hbase_role);
+
+        // masters and region servers are required (preserves the old build_role_properties check);
+        // rest servers are optional.
+        if role_group_names.is_empty() {
+            match hbase_role {
+                HbaseRole::Master | HbaseRole::RegionServer => {
+                    return MissingRequiredRoleSnafu {
+                        role: hbase_role.to_string(),
+                    }
+                    .fail();
+                }
+                HbaseRole::RestServer => continue,
+            }
+        }
 
         if let Some(GenericRoleConfig {
             pod_disruption_budget: pdb,
@@ -98,13 +81,11 @@ pub fn validate_cluster(
         }
 
         let mut group_configs = BTreeMap::new();
-        for (rolegroup_name, rolegroup_config) in group_config.iter() {
-            let rolegroup = hbase.server_rolegroup_ref(role_name, rolegroup_name);
-
+        for rolegroup_name in role_group_names {
             let merged_config = hbase
                 .merged_config(
                     &hbase_role,
-                    &rolegroup.role_group,
+                    &rolegroup_name,
                     &hbase.spec.cluster_config.hdfs_config_map_name,
                 )
                 .context(FailedToResolveConfigSnafu)?;
@@ -113,9 +94,8 @@ pub fn validate_cluster(
                 rolegroup_name.clone(),
                 ValidatedRoleGroupConfig {
                     merged_config,
-                    config_overrides: merged_config_overrides(hbase, &hbase_role, rolegroup_name),
-                    env_overrides: merged_env_overrides(hbase, &hbase_role, rolegroup_name),
-                    product_config_properties: rolegroup_config.clone(),
+                    config_overrides: merged_config_overrides(hbase, &hbase_role, &rolegroup_name),
+                    env_overrides: merged_env_overrides(hbase, &hbase_role, &rolegroup_name),
                 },
             );
         }
@@ -136,6 +116,28 @@ pub fn validate_cluster(
     })
 }
 
+/// The names of the role groups defined for `role` in the spec.
+fn role_group_names(hbase: &v1alpha1::HbaseCluster, role: &HbaseRole) -> Vec<String> {
+    match role {
+        HbaseRole::Master => hbase
+            .spec
+            .masters
+            .as_ref()
+            .map(|r| r.role_groups.keys().cloned().collect()),
+        HbaseRole::RegionServer => hbase
+            .spec
+            .region_servers
+            .as_ref()
+            .map(|r| r.role_groups.keys().cloned().collect()),
+        HbaseRole::RestServer => hbase
+            .spec
+            .rest_servers
+            .as_ref()
+            .map(|r| r.role_groups.keys().cloned().collect()),
+    }
+    .unwrap_or_default()
+}
+
 /// Merge role-level then role-group-level `configOverrides` (role group wins).
 fn merged_config_overrides(
     hbase: &v1alpha1::HbaseCluster,
@@ -247,3 +249,72 @@ fn merged_env_overrides(
     }
     env_overrides
 }
+
+#[cfg(test)]
+mod tests {
+    use indoc::indoc;
+
+    use super::*;
+
+    #[test]
+    fn test_env_overrides() {
+        let input = indoc! {r#"
+---
+apiVersion: hbase.stackable.tech/v1alpha1
+kind: HbaseCluster
+metadata:
+  name: test-hbase
+spec:
+  image:
+    productVersion: 2.6.4
+  clusterConfig:
+    hdfsConfigMapName: test-hdfs
+    zookeeperConfigMapName: test-znode
+  masters:
+    envOverrides:
+      TEST_VAR_FROM_MASTER: MASTER
+      TEST_VAR: MASTER
+    config:
+      logging:
+        enableVectorAgent: False
+    roleGroups:
+      default:
+        replicas: 1
+        envOverrides:
+          TEST_VAR_FROM_MRG: MASTER
+          TEST_VAR: MASTER_RG
+  regionServers:
+    config:
+      logging:
+        enableVectorAgent: False
+      regionMover:
+        runBeforeShutdown: false
+    roleGroups:
+      default:
+        replicas: 1
+  restServers:
+    config:
+      logging:
+        enableVectorAgent: False
+    roleGroups:
+      default:
+        replicas: 1
+        "#};
+
+        let deserializer = serde_yaml::Deserializer::from_str(input);
+        let hbase: v1alpha1::HbaseCluster =
+            serde_yaml::with::singleton_map_recursive::deserialize(deserializer).unwrap();
+
+        let env_overrides = merged_env_overrides(&hbase, &HbaseRole::Master, "default");
+
+        assert_eq!(env_overrides.get("TEST_VAR"), Some(&"MASTER_RG".to_string()));
+        assert_eq!(
+            env_overrides.get("TEST_VAR_FROM_MASTER"),
+            Some(&"MASTER".to_string())
+        );
+        assert_eq!(
+            env_overrides.get("TEST_VAR_FROM_MRG"),
+            Some(&"MASTER".to_string())
+        );
+    }
+}
diff --git a/rust/operator-binary/src/crd/mod.rs b/rust/operator-binary/src/crd/mod.rs
index 4b1a6328..937d24c8 100644
--- a/rust/operator-binary/src/crd/mod.rs
+++ b/rust/operator-binary/src/crd/mod.rs
@@ -1,6 +1,5 @@
-use std::collections::{BTreeMap, HashMap};
+use std::collections::BTreeMap;
 
-use product_config::types::PropertyNameKind;
 use security::AuthenticationConfig;
 use serde::{Deserialize, Serialize};
 use shell_escape::escape;
@@ -23,7 +22,6 @@ use stackable_operator::{
         fragment::{self, Fragment, ValidationError},
         merge::{Atomic, Merge},
     },
-    config_overrides::KeyValueOverridesProvider,
     deep_merger::ObjectOverrides,
     k8s_openapi::{
         DeepMerge,
@@ -32,7 +30,6 @@ use stackable_operator::{
     },
     kube::{CustomResource, ResourceExt, runtime::reflector::ObjectRef},
     kvp::Labels,
-    product_config_utils::Configuration,
     product_logging::{self, spec::Logging},
     role_utils::{GenericRoleConfig, JavaCommonConfig, Role, RoleGroupRef},
     schemars::{self, JsonSchema},
@@ -61,10 +58,7 @@ pub const TLS_STORE_PASSWORD: &str = "changeit";
 
 pub const JVM_SECURITY_PROPERTIES_FILE: &str = "security.properties";
 
-pub const HBASE_ENV_SH: &str = "hbase-env.sh";
 pub const HBASE_SITE_XML: &str = "hbase-site.xml";
-pub const SSL_SERVER_XML: &str = "ssl-server.xml";
-pub const SSL_CLIENT_XML: &str = "ssl-client.xml";
 
 pub const HBASE_CLUSTER_DISTRIBUTED: &str = "hbase.cluster.distributed";
 pub const HBASE_ROOTDIR: &str = "hbase.rootdir";
@@ -122,12 +116,6 @@ pub enum Error {
     #[snafu(display("fragment validation failure"))]
     FragmentValidationFailure { source: ValidationError },
 
-    #[snafu(display("object defines no master role"))]
-    NoMasterRole,
-
-    #[snafu(display("object defines no regionserver role"))]
-    NoRegionServerRole,
-
     #[snafu(display("incompatible merge types"))]
     IncompatibleMergeTypes,
 
@@ -370,67 +358,6 @@ impl v1alpha1::HbaseCluster {
         })
     }
 
-    // The result type is only defined once, there is no value in extracting it into a type definition.
-    #[allow(clippy::type_complexity)]
-    pub fn build_role_properties(
-        &self,
-    ) -> Result<
-        HashMap<
-            String,
-            (
-                Vec<PropertyNameKind>,
-                Role<
-                    impl Configuration<Configurable = Self>,
-                    v1alpha1::HbaseConfigOverrides,
-                    GenericRoleConfig,
-                    JavaCommonConfig,
-                >,
-            ),
-        >,
-        Error,
-    > {
-        let config_types = vec![
-            PropertyNameKind::Env,
-            PropertyNameKind::File(HBASE_ENV_SH.to_string()),
-            PropertyNameKind::File(HBASE_SITE_XML.to_string()),
-            PropertyNameKind::File(SSL_SERVER_XML.to_string()),
-            PropertyNameKind::File(SSL_CLIENT_XML.to_string()),
-            PropertyNameKind::File(JVM_SECURITY_PROPERTIES_FILE.to_string()),
-        ];
-
-        let mut roles = HashMap::from([(
-            HbaseRole::Master.to_string(),
-            (
-                config_types.to_owned(),
-                self.spec
-                    .masters
-                    .clone()
-                    .context(NoMasterRoleSnafu)?
-                    .erase(),
-            ),
-        )]);
-        roles.insert(
-            HbaseRole::RegionServer.to_string(),
-            (
-                config_types.to_owned(),
-                self.spec
-                    .region_servers
-                    .clone()
-                    .context(NoRegionServerRoleSnafu)?
-                    .erase(),
-            ),
-        );
-
-        if let Some(rest_servers) = self.spec.rest_servers.as_ref() {
-            roles.insert(
-                HbaseRole::RestServer.to_string(),
-                (config_types, rest_servers.to_owned().erase()),
-            );
-        }
-
-        Ok(roles)
-    }
-
     pub fn merge_pod_overrides(
         &self,
         pod_template: &mut PodTemplateSpec,
@@ -563,19 +490,6 @@ impl v1alpha1::HbaseCluster {
     }
 }
 
-impl KeyValueOverridesProvider for v1alpha1::HbaseConfigOverrides {
-    fn get_key_value_overrides(&self, file: &str) -> BTreeMap<String, Option<String>> {
-        match file {
-            HBASE_SITE_XML => self.hbase_site_xml.overrides.clone(),
-            HBASE_ENV_SH => self.hbase_env_sh.overrides.clone(),
-            SSL_SERVER_XML => self.ssl_server_xml.overrides.clone(),
-            SSL_CLIENT_XML => self.ssl_client_xml.overrides.clone(),
-            JVM_SECURITY_PROPERTIES_FILE => self.security_properties.overrides.clone(),
-            _ => BTreeMap::new(),
-        }
-    }
-}
-
 pub fn merged_env(rolegroup_config: &BTreeMap<String, String>) -> Vec<EnvVar> {
     rolegroup_config
         .iter()
@@ -1004,73 +918,6 @@ pub struct HbaseConfig {
     pub listener_class: String,
 }
 
-impl Configuration for HbaseConfigFragment {
-    type Configurable = v1alpha1::HbaseCluster;
-
-    fn compute_env(
-        &self,
-        _resource: &Self::Configurable,
-        _role_name: &str,
-    ) -> Result<BTreeMap<String, Option<String>>, stackable_operator::product_config_utils::Error>
-    {
-        // Maps env var name to env var object. This allows env_overrides to work
-        // as expected (i.e. users can override the env var value).
-        let mut vars: BTreeMap<String, Option<String>> = BTreeMap::new();
-
-        vars.insert(
-            "HBASE_CONF_DIR".to_string(),
-            Some(CONFIG_DIR_NAME.to_string()),
-        );
-        // required by phoenix (for cases where Kerberos is enabled): see https://issues.apache.org/jira/browse/PHOENIX-2369
-        vars.insert(
-            "HADOOP_CONF_DIR".to_string(),
-            Some(CONFIG_DIR_NAME.to_string()),
-        );
-        Ok(vars)
-    }
-
-    fn compute_cli(
-        &self,
-        _resource: &Self::Configurable,
-        _role_name: &str,
-    ) -> Result<BTreeMap<String, Option<String>>, stackable_operator::product_config_utils::Error>
-    {
-        Ok(BTreeMap::new())
-    }
-
-    fn compute_files(
-        &self,
-        _resource: &Self::Configurable,
-        _role_name: &str,
-        file: &str,
-    ) -> Result<BTreeMap<String, Option<String>>, stackable_operator::product_config_utils::Error>
-    {
-        let mut result = BTreeMap::new();
-
-        match file {
-            HBASE_ENV_SH => {
-                // The contents of this file cannot be built entirely here because we don't have
-                // access to the clusterConfig or product version.
-                // These are needed to set up Kerberos.
-                // To avoid fragmentation of the code needed to build this file, we moved the
-                // implementation to the hbase_controller::build_hbase_env_sh() function.
-            }
-            HBASE_SITE_XML => {
-                result.insert(
-                    HBASE_CLUSTER_DISTRIBUTED.to_string(),
-                    Some("true".to_string()),
-                );
-                result.insert(HBASE_ROOTDIR.to_string(), self.hbase_rootdir.clone());
-            }
-            _ => {}
-        }
-
-        result.retain(|_, maybe_value| maybe_value.is_some());
-
-        Ok(result)
-    }
-}
-
 #[derive(Fragment, Clone, Debug, JsonSchema, PartialEq, Serialize, Deserialize)]
 #[fragment_attrs(
     derive(
@@ -1156,71 +1003,6 @@ pub struct RegionServerConfig {
     pub listener_class: String,
 }
 
-impl Configuration for RegionServerConfigFragment {
-    type Configurable = v1alpha1::HbaseCluster;
-
-    fn compute_env(
-        &self,
-        _resource: &Self::Configurable,
-        _role_name: &str,
-    ) -> Result<BTreeMap<String, Option<String>>, stackable_operator::product_config_utils::Error>
-    {
-        let mut vars: BTreeMap<String, Option<String>> = BTreeMap::new();
-
-        vars.insert(
-            "HBASE_CONF_DIR".to_string(),
-            Some(CONFIG_DIR_NAME.to_string()),
-        );
-        // required by phoenix (for cases where Kerberos is enabled): see https://issues.apache.org/jira/browse/PHOENIX-2369
-        vars.insert(
-            "HADOOP_CONF_DIR".to_string(),
-            Some(CONFIG_DIR_NAME.to_string()),
-        );
-        Ok(vars)
-    }
-
-    fn compute_cli(
-        &self,
-        _resource: &Self::Configurable,
-        _role_name: &str,
-    ) -> Result<BTreeMap<String, Option<String>>, stackable_operator::product_config_utils::Error>
-    {
-        Ok(BTreeMap::new())
-    }
-
-    fn compute_files(
-        &self,
-        _resource: &Self::Configurable,
-        _role_name: &str,
-        file: &str,
-    ) -> Result<BTreeMap<String, Option<String>>, stackable_operator::product_config_utils::Error>
-    {
-        let mut result = BTreeMap::new();
-
-        match file {
-            HBASE_ENV_SH => {
-                // The contents of this file cannot be built entirely here because we don't have
-                // access to the clusterConfig or product version.
-                // These are needed to set up Kerberos.
-                // To avoid fragmentation of the code needed to build this file, we moved the
-                // implementation to the hbase_controller::build_hbase_env_sh() function.
-            }
-            HBASE_SITE_XML => {
-                result.insert(
-                    HBASE_CLUSTER_DISTRIBUTED.to_string(),
-                    Some("true".to_string()),
-                );
-                result.insert(HBASE_ROOTDIR.to_string(), self.hbase_rootdir.clone());
-            }
-            _ => {}
-        }
-
-        result.retain(|_, maybe_value| maybe_value.is_some());
-
-        Ok(result)
-    }
-}
-
 #[derive(Clone, Debug, Default, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct HbaseClusterStatus {
@@ -1352,116 +1134,12 @@ impl AnyServiceConfig {
 
 #[cfg(test)]
 mod tests {
-    use std::collections::{BTreeMap, HashMap};
-
     use indoc::indoc;
-    use product_config::{ProductConfigManager, types::PropertyNameKind};
     use rstest::rstest;
-    use stackable_operator::{
-        product_config_utils::{
-            transform_all_roles_to_config, validate_all_roles_and_groups_config,
-        },
-        versioned::test_utils::RoundtripTestData,
-    };
+    use stackable_operator::versioned::test_utils::RoundtripTestData;
 
     use super::*;
 
-    #[test]
-    pub fn test_env_overrides() {
-        let input = indoc! {r#"
----
-apiVersion: hbase.stackable.tech/v1alpha1
-kind: HbaseCluster
-metadata:
-  name: test-hbase
-spec:
-  image:
-    productVersion: 2.6.4
-  clusterConfig:
-    hdfsConfigMapName: test-hdfs
-    zookeeperConfigMapName: test-znode
-  masters:
-    envOverrides:
-      TEST_VAR_FROM_MASTER: MASTER
-      TEST_VAR: MASTER
-    config:
-      logging:
-        enableVectorAgent: False
-    roleGroups:
-      default:
-        replicas: 1
-        envOverrides:
-          TEST_VAR_FROM_MRG: MASTER
-          TEST_VAR: MASTER_RG
-  regionServers:
-    config:
-      logging:
-        enableVectorAgent: False
-      regionMover:
-        runBeforeShutdown: false
-    roleGroups:
-      default:
-        replicas: 1
-  restServers:
-    config:
-      logging:
-        enableVectorAgent: False
-    roleGroups:
-      default:
-        replicas: 1
-        "#};
-
-        let deserializer = serde_yaml::Deserializer::from_str(input);
-        let hbase: v1alpha1::HbaseCluster =
-            serde_yaml::with::singleton_map_recursive::deserialize(deserializer).unwrap();
-
-        let roles = HashMap::from([(
-            HbaseRole::Master.to_string(),
-            (
-                vec![PropertyNameKind::Env],
-                hbase.spec.masters.clone().unwrap(),
-            ),
-        )]);
-
-        let validated_config = validate_all_roles_and_groups_config(
-            "2.6.4",
-            &transform_all_roles_to_config(&hbase, &roles).unwrap(),
-            &ProductConfigManager::from_yaml_file("../../deploy/config-spec/properties.yaml")
-                .unwrap(),
-            false,
-            false,
-        )
-        .unwrap();
-
-        let rolegroup_config = validated_config
-            .get(&HbaseRole::Master.to_string())
-            .unwrap()
-            .get("default")
-            .unwrap()
-            .get(&PropertyNameKind::Env)
-            .cloned()
-            .unwrap_or_default();
-        let merged_env = merged_env(&rolegroup_config);
-
-        let env_map: BTreeMap<&str, Option<String>> = merged_env
-            .iter()
-            .map(|env_var| (env_var.name.as_str(), env_var.value.clone()))
-            .collect();
-
-        assert_eq!(
-            Some(&Some("MASTER_RG".to_string())),
-            env_map.get("TEST_VAR")
-        );
-        assert_eq!(
-            Some(&Some("MASTER".to_string())),
-            env_map.get("TEST_VAR_FROM_MASTER")
-        );
-        assert_eq!(
-            Some(&Some("MASTER".to_string())),
-            env_map.get("TEST_VAR_FROM_MRG")
-        );
-    }
-
     #[rstest]
     #[case("default", false, 1, vec![])]
     #[case("groupRegionMover", true, 5, vec!["--some".to_string(), "extra".to_string()])]
diff --git a/rust/operator-binary/src/hbase_controller.rs b/rust/operator-binary/src/hbase_controller.rs
index 90fe9c8e..7955e31d 100644
--- a/rust/operator-binary/src/hbase_controller.rs
+++ b/rust/operator-binary/src/hbase_controller.rs
@@ -1,13 +1,9 @@
 //! Ensures that `Pod`s are configured and running for each [`v1alpha1::HbaseCluster`]
 
-use std::{
-    collections::{BTreeMap, HashMap},
-    sync::Arc,
-};
+use std::{collections::BTreeMap, sync::Arc};
 
 use const_format::concatcp;
 use indoc::formatdoc;
-use product_config::{ProductConfigManager, types::PropertyNameKind};
 use snafu::{OptionExt, ResultExt, Snafu};
 use stackable_operator::{
     builder::{
@@ -89,7 +85,6 @@ pub const CONTAINER_IMAGE_BASE_NAME: &str = "hbase";
 
 pub struct Ctx {
     pub client: stackable_operator::client::Client,
-    pub product_config: ProductConfigManager,
     pub operator_environment: OperatorEnvironmentOptions,
 }
 
@@ -122,17 +117,11 @@ pub struct ValidatedRoleConfig {
 
 /// Per-rolegroup configuration: the merged CRD config plus the merged
 /// (role <- role group) `configOverrides` and `envOverrides`.
-///
-/// `product_config_properties` is retained temporarily so the existing controller
-/// path keeps compiling; it is removed in a later commit.
 #[derive(Clone, Debug)]
 pub struct ValidatedRoleGroupConfig {
     pub merged_config: AnyServiceConfig,
     pub config_overrides: v1alpha1::HbaseConfigOverrides,
     pub env_overrides: BTreeMap<String, String>,
-    // Retained until the product-config path is fully removed in a later commit.
-    #[allow(dead_code)]
-    pub product_config_properties: HashMap<PropertyNameKind, BTreeMap<String, String>>,
 }
 
 #[derive(Snafu, Debug, EnumDiscriminants)]
@@ -307,7 +296,6 @@ pub async fn reconcile_hbase(
     let validated = crate::controller::validate::validate_cluster(
         hbase,
         &ctx.operator_environment.image_repository,
-        &ctx.product_config,
         dereferenced_objects,
     )
     .context(ValidateSnafu)?;
diff --git a/rust/operator-binary/src/main.rs b/rust/operator-binary/src/main.rs
index 917c95fd..6a97d872 100644
--- a/rust/operator-binary/src/main.rs
+++ b/rust/operator-binary/src/main.rs
@@ -73,7 +73,7 @@ async fn main() -> anyhow::Result<()> {
         Command::Run(RunArguments {
             operator_environment,
             watch_namespace,
-            product_config,
+            product_config: _,
             maintenance,
             common,
         }) => {
@@ -120,11 +120,6 @@ async fn main() -> anyhow::Result<()> {
                 .run(sigterm_watcher.handle())
                 .map_err(|err| anyhow!(err).context("failed to run webhook server"));
 
-            let product_config = product_config.load(&[
-                "deploy/config-spec/properties.yaml",
-                "/etc/stackable/hbase-operator/config-spec/properties.yaml",
-            ])?;
-
             let event_recorder = Arc::new(Recorder::new(
                 client.as_kube_client(),
                 Reporter {
@@ -165,7 +160,6 @@ async fn main() -> anyhow::Result<()> {
                     Arc::new(hbase_controller::Ctx {
                         client: client.clone(),
                         operator_environment,
-                        product_config,
                     }),
                 )
                 .for_each_concurrent(

From 47a854b0bf05ff986fe3674c7c9ae45a1864df8f Mon Sep 17 00:00:00 2001
From: Malte Sander <malte.sander.it@gmail.com>
Date: Wed, 3 Jun 2026 17:19:32 +0200
Subject: [PATCH 06/21] chore: remove the product-config dependency

Empty config-spec/properties.yaml (mirroring trino/opensearch/hdfs) and drop the
product-config crate from both Cargo manifests. The operator now renders all config
from typed, validated inputs; product-config remains only as a transitive dependency
of stackable-operator. Also remove the stale product-config CLI/env-var docs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                                  |   1 +
 Cargo.lock                                    |   1 -
 Cargo.toml                                    |   1 -
 deploy/config-spec/properties.yaml            | 268 +-----------------
 .../reference/commandline-parameters.adoc     |  13 -
 .../reference/environment-variables.adoc      |  26 --
 rust/operator-binary/Cargo.toml               |   1 -
 7 files changed, 2 insertions(+), 309 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a7e5e974..0942934b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,7 @@
   Previously, arbitrary file names were silently accepted and ignored ([#751]).
 - Bump `stackable-operator` to 0.111.1 and snafu to 0.9 ([#751], [#752]).
 - Internal operator refactoring: introduce dereference() and validate() steps in the reconciler ([#757]).
+- Removed the `product-config` dependency; configuration is now rendered from typed, validated inputs ([#757]).
 - test: Bump vector-aggregator to 0.55.0, replace /graphql call with gRPC call ([#762]).
 
 [#745]: https://github.com/stackabletech/hbase-operator/pull/745
diff --git a/Cargo.lock b/Cargo.lock
index 18141326..814820ac 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2926,7 +2926,6 @@ dependencies = [
  "futures 0.3.32",
  "indoc",
  "java-properties",
- "product-config",
  "rstest",
  "serde",
  "serde_json",
diff --git a/Cargo.toml b/Cargo.toml
index c2e49e69..ed454cd1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -10,7 +10,6 @@ edition = "2021"
 repository = "https://github.com/stackabletech/hbase-operator"
 
 [workspace.dependencies]
-product-config = { git = "https://github.com/stackabletech/product-config.git", tag = "0.8.0" }
 stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.111.1", features = ["crds", "webhook"] }
 
 anyhow = "1.0"
diff --git a/deploy/config-spec/properties.yaml b/deploy/config-spec/properties.yaml
index c3840065..9bd8c3b2 100644
--- a/deploy/config-spec/properties.yaml
+++ b/deploy/config-spec/properties.yaml
@@ -2,270 +2,4 @@
 version: 0.1.0
 spec:
   units: []
-
-properties:
-
-  #################################################################################################
-  # security.properties
-  #################################################################################################
-
-  - property:
-      propertyNames:
-        - name: "networkaddress.cache.ttl"
-          kind:
-            type: "file"
-            file: "security.properties"
-      datatype:
-        type: "integer"
-        min: "0"
-      recommendedValues:
-        - fromVersion: "0.0.0"
-          value: "5"
-      roles:
-        - name: "master"
-          required: true
-      asOfVersion: "0.0.0"
-      comment: "master - TTL for successfully resolved domain names."
-      description: "master - TTL for successfully resolved domain names."
-
-  - property:
-      propertyNames:
-        - name: "networkaddress.cache.ttl"
-          kind:
-            type: "file"
-            file: "security.properties"
-      datatype:
-        type: "integer"
-        min: "0"
-      recommendedValues:
-        - fromVersion: "0.0.0"
-          value: "10"
-      roles:
-        - name: "regionserver"
-          required: true
-      asOfVersion: "0.0.0"
-      comment: "regionserver - TTL for successfully resolved domain names."
-      description: "regionserver - TTL for successfully resolved domain names."
-
-  - property:
-      propertyNames:
-        - name: "networkaddress.cache.ttl"
-          kind:
-            type: "file"
-            file: "security.properties"
-      datatype:
-        type: "integer"
-        min: "0"
-      recommendedValues:
-        - fromVersion: "0.0.0"
-          value: "30"
-      roles:
-        - name: "restserver"
-          required: true
-      asOfVersion: "0.0.0"
-      comment: "restserver - TTL for successfully resolved domain names."
-      description: "restserver - TTL for successfully resolved domain names."
-
-  - property:
-      propertyNames:
-        - name: "networkaddress.cache.negative.ttl"
-          kind:
-            type: "file"
-            file: "security.properties"
-      datatype:
-        type: "integer"
-        min: "0"
-      recommendedValues:
-        - fromVersion: "0.0.0"
-          value: "0"
-      roles:
-        - name: "master"
-          required: true
-      asOfVersion: "0.0.0"
-      comment: "master - TTL for domain names that cannot be resolved."
-      description: "master - TTL for domain names that cannot be resolved."
-
-  - property:
-      propertyNames:
-        - name: "networkaddress.cache.negative.ttl"
-          kind:
-            type: "file"
-            file: "security.properties"
-      datatype:
-        type: "integer"
-        min: "0"
-      recommendedValues:
-        - fromVersion: "0.0.0"
-          value: "0"
-      roles:
-        - name: "regionserver"
-          required: true
-      asOfVersion: "0.0.0"
-      comment: "regionserver - TTL for domain names that cannot be resolved."
-      description: "regionserver - TTL for domain names that cannot be resolved."
-
-  - property:
-      propertyNames:
-        - name: "networkaddress.cache.negative.ttl"
-          kind:
-            type: "file"
-            file: "security.properties"
-      datatype:
-        type: "integer"
-        min: "0"
-      recommendedValues:
-        - fromVersion: "0.0.0"
-          value: "0"
-      roles:
-        - name: "restserver"
-          required: true
-      asOfVersion: "0.0.0"
-      comment: "restserver - TTL for domain names that cannot be resolved."
-      description: "restserver - TTL for domain names that cannot be resolved."
-
-
-  #################################################################################################
-  # hbase-env.sh
-  #################################################################################################
-
-  - property: &hbaseManagesZk
-      propertyNames:
-        - name: "HBASE_MANAGES_ZK"
-          kind:
-            type: "file"
-            file: "hbase-env.sh"
-      datatype:
-        type: "bool"
-      defaultValues:
-        - fromVersion: "0.0.0"
-          value: "true"
-      recommendedValues:
-        - fromVersion: "0.0.0"
-          value: "false"
-      roles:
-        - name: "master"
-          required: false
-        - name: "regionserver"
-          required: false
-        - name: "restserver"
-          required: false
-      asOfVersion: "0.0.0"
-      description: "This variable tells HBase whether to start/stop the ZooKeeper ensemble servers as part of HBase start/stop."
-  - property: &hbaseOpts
-      propertyNames:
-        - name: "HBASE_OPTS"
-          kind:
-            type: "file"
-            file: "hbase-env.sh"
-      datatype:
-        type: "string"
-      defaultValues:
-        - fromVersion: "0.0.0"
-          value: ""
-      recommendedValues:
-        - fromVersion: "0.0.0"
-          value: ""
-      roles:
-        - name: "master"
-          required: false
-        - name: "regionserver"
-          required: false
-        - name: "restserver"
-          required: false
-      asOfVersion: "0.0.0"
-      description: "This variable allows to pass VM options to HBase."
-
-  #################################################################################################
-  # hbase-site.xml
-  #################################################################################################
-
-  - property: &hbaseClusterDistributed
-      propertyNames:
-        - name: "hbase.cluster.distributed"
-          kind:
-            type: "file"
-            file: "hbase-site.xml"
-      datatype:
-        type: "bool"
-      defaultValues:
-        - fromVersion: "0.0.0"
-          value: "false"
-      recommendedValues:
-        - fromVersion: "0.0.0"
-          value: "true"
-      roles:
-        - name: "master"
-          required: false
-        - name: "regionserver"
-          required: false
-        - name: "restserver"
-          required: false
-      asOfVersion: "0.0.0"
-      description: "The mode the cluster will be in. Possible values are false for standalone mode and true for distributed mode. If false, startup will run all HBase and ZooKeeper daemons together in the one JVM."
-
-  - property: &hbaseRootdir
-      propertyNames:
-        - name: "hbase.rootdir"
-          kind:
-            type: "file"
-            file: "hbase-site.xml"
-      datatype:
-        type: "string"
-      defaultValues:
-        - fromVersion: "0.0.0"
-          value: "/hbase"
-      roles:
-        - name: "master"
-          required: true
-        - name: "regionserver"
-          required: true # this can be false (only required for master) - kept for compatibility (avoid restarts)
-        - name: "restserver"
-          required: true # this can be false (only required for master) - kept for compatibility (avoid restarts)
-      asOfVersion: "0.0.0"
-      description: "The directory shared by region servers and into which HBase persists. The URL should be 'fully-qualified' to include the filesystem scheme. For example, to specify the HDFS directory '/hbase' where the HDFS instance's namenode is running at namenode.example.org on port 9000, set this value to: hdfs://namenode.example.org:9000/hbase. By default, we write to whatever ${hbase.tmp.dir} is set too -- usually /tmp -- so change this configuration or else all data will be lost on machine restart."
-
-  - property: &hbaseZookeeperQuorum
-      propertyNames:
-        - name: "hbase.zookeeper.quorum"
-          kind:
-            type: "file"
-            file: "hbase-site.xml"
-      datatype:
-        type: "string"
-      defaultValues:
-        - fromVersion: "0.0.0"
-          value: "127.0.0.1"
-      roles:
-        - name: "master"
-          required: false
-        - name: "regionserver"
-          required: false
-        - name: "restserver"
-          required: false
-      asOfVersion: "0.0.0"
-      description: "Comma separated list of servers in the ZooKeeper ensemble (This config. should have been named hbase.zookeeper.ensemble). For example, \"host1.mydomain.com,host2.mydomain.com,host3.mydomain.com\". By default this is set to localhost for local and pseudo-distributed modes of operation. For a fully-distributed setup, this should be set to a full list of ZooKeeper ensemble servers. If HBASE_MANAGES_ZK is set in hbase-env.sh this is the list of servers which hbase will start/stop ZooKeeper on as part of cluster start/stop. Client-side, we will take this list of ensemble members and put it together with the hbase.zookeeper.property.clientPort config. and pass it into zookeeper constructor as the connectString parameter."
-
-  #################################################################################################
-  # hdfs-site.xml
-  #################################################################################################
-
-  - property: &hdfsConfig
-      propertyNames:
-        - name: "content"
-          kind:
-            type: "file"
-            file: "hbase-site.xml"
-      datatype:
-        type: "string"
-      defaultValues:
-        - fromVersion: "0.0.0"
-          value: ""
-      roles:
-        - name: "master"
-          required: false
-        - name: "regionserver"
-          required: false
-        - name: "restserver"
-          required: false
-      asOfVersion: "0.0.0"
-      description: "The HDFS configuration file"
+properties: []
diff --git a/docs/modules/hbase/pages/reference/commandline-parameters.adoc b/docs/modules/hbase/pages/reference/commandline-parameters.adoc
index 8f28dd89..7f15684e 100644
--- a/docs/modules/hbase/pages/reference/commandline-parameters.adoc
+++ b/docs/modules/hbase/pages/reference/commandline-parameters.adoc
@@ -2,19 +2,6 @@
 
 This operator accepts the following command line parameters:
 
-== product-config
-
-*Default value*: `/etc/stackable/hbase-operator/config-spec/properties.yaml`
-
-*Required*: false
-
-*Multiple values:* false
-
-[source]
-----
-stackable-hbase-operator run --product-config /foo/bar/properties.yaml
-----
-
 == watch-namespace
 
 *Default value*: All namespaces
diff --git a/docs/modules/hbase/pages/reference/environment-variables.adoc b/docs/modules/hbase/pages/reference/environment-variables.adoc
index a6003bce..ab123938 100644
--- a/docs/modules/hbase/pages/reference/environment-variables.adoc
+++ b/docs/modules/hbase/pages/reference/environment-variables.adoc
@@ -33,32 +33,6 @@ docker run \
 oci.stackable.tech/sdp/hbase-operator:0.0.0-dev
 ----
 
-== PRODUCT_CONFIG
-
-*Default value*: `/etc/stackable/hbase-operator/config-spec/properties.yaml`
-
-*Required*: false
-
-*Multiple values*: false
-
-[source]
-----
-export PRODUCT_CONFIG=/foo/bar/properties.yaml
-stackable-hbase-operator run
-----
-
-or via docker:
-
-----
-docker run \
-    --name hbase-operator \
-    --network host \
-    --env KUBECONFIG=/home/stackable/.kube/config \
-    --env PRODUCT_CONFIG=/my/product/config.yaml \
-    --mount type=bind,source="$HOME/.kube/config",target="/home/stackable/.kube/config" \
-    oci.stackable.tech/sdp/hbase-operator:0.0.0-dev
-----
-
 == WATCH_NAMESPACE
 
 *Default value*: All namespaces
diff --git a/rust/operator-binary/Cargo.toml b/rust/operator-binary/Cargo.toml
index 336c050d..35e88f0e 100644
--- a/rust/operator-binary/Cargo.toml
+++ b/rust/operator-binary/Cargo.toml
@@ -9,7 +9,6 @@ repository.workspace = true
 publish = false
 
 [dependencies]
-product-config.workspace = true
 stackable-operator.workspace = true
 
 anyhow.workspace = true

From 0146d35db028b8af00124ff77fd4106911010ee8 Mon Sep 17 00:00:00 2001
From: Malte Sander <malte.sander.it@gmail.com>
Date: Wed, 3 Jun 2026 19:16:18 +0200
Subject: [PATCH 07/21] refactor: decouple config-map builders from
 HbaseCluster

Pre-resolve kerberos/TLS settings + kerberos flag (ValidatedClusterConfig) and the
role-specific non-heap JVM args (ValidatedRoleGroupConfig) during validate, so the
hbase-site/hbase-env/ssl-server/ssl-client builders render purely from the validated
cluster. The config_map orchestrator still uses HbaseCluster only for the ConfigMap
owner reference/metadata (to be decoupled in a follow-up). Rename validated ->
validated_cluster.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../src/controller/build/config_map.rs        | 27 +++++-----
 .../controller/build/properties/hbase_env.rs  | 51 +++++++-----------
 .../controller/build/properties/hbase_site.rs | 54 +++++++------------
 .../src/controller/build/properties/mod.rs    | 11 +---
 .../controller/build/properties/ssl_client.rs | 36 ++++++++-----
 .../controller/build/properties/ssl_server.rs | 36 ++++++++-----
 .../src/controller/validate.rs                | 27 ++++++++++
 rust/operator-binary/src/hbase_controller.rs  | 48 +++++++++--------
 8 files changed, 149 insertions(+), 141 deletions(-)

diff --git a/rust/operator-binary/src/controller/build/config_map.rs b/rust/operator-binary/src/controller/build/config_map.rs
index 741d23a0..796650fc 100644
--- a/rust/operator-binary/src/controller/build/config_map.rs
+++ b/rust/operator-binary/src/controller/build/config_map.rs
@@ -5,7 +5,6 @@ use stackable_operator::{
     builder::{configmap::ConfigMapBuilder, meta::ObjectMetaBuilder},
     k8s_openapi::api::core::v1::ConfigMap,
     role_utils::RoleGroupRef,
-    utils::cluster_info::KubernetesClusterInfo,
 };
 
 use crate::{
@@ -23,9 +22,6 @@ pub enum Error {
     #[snafu(display("the validated cluster has no role group {role_group:?} for role {role:?}"))]
     MissingRoleGroup { role: String, role_group: String },
 
-    #[snafu(display("failed to build hbase-site.xml"))]
-    BuildHbaseSite { source: hbase_site::Error },
-
     #[snafu(display("failed to build hbase-env.sh"))]
     BuildHbaseEnv { source: hbase_env::Error },
 
@@ -62,10 +58,11 @@ pub enum Error {
 type Result<T, E = Error> = std::result::Result<T, E>;
 
 pub fn build_rolegroup_config_map(
+    // `hbase` is retained only for the ConfigMap ObjectMeta / owner reference; the rendered
+    // content comes entirely from `cluster`. To be decoupled in a follow-up.
     hbase: &v1alpha1::HbaseCluster,
     cluster: &ValidatedCluster,
     role: &HbaseRole,
-    cluster_info: &KubernetesClusterInfo,
     rolegroup_ref: &RoleGroupRef<v1alpha1::HbaseCluster>,
 ) -> Result<ConfigMap> {
     tracing::info!("Setting up ConfigMap for {:?}", rolegroup_ref);
@@ -83,29 +80,33 @@ pub fn build_rolegroup_config_map(
     let overrides = &rg.config_overrides;
 
     let hbase_site_xml = hbase_site::build(
-        hbase,
         role,
-        cluster_info,
         &rg.merged_config,
         cluster_config
             .zookeeper_connection_information
             .as_hbase_settings(),
+        cluster_config.hbase_site_kerberos_config.clone(),
         cluster_config.hbase_opa_config.as_ref(),
         overrides.hbase_site_xml.clone(),
-    )
-    .context(BuildHbaseSiteSnafu)?;
+    );
 
     let hbase_env_sh = hbase_env::build(
-        hbase,
         &rg.merged_config,
         role,
-        &rolegroup_ref.role_group,
+        cluster_config.kerberos_enabled,
+        rg.non_heap_jvm_args.clone(),
         overrides.hbase_env_sh.clone(),
     )
     .context(BuildHbaseEnvSnafu)?;
 
-    let ssl_server_xml = ssl_server::build(hbase, overrides.ssl_server_xml.clone());
-    let ssl_client_xml = ssl_client::build(hbase, overrides.ssl_client_xml.clone());
+    let ssl_server_xml = ssl_server::build(
+        cluster_config.ssl_server_settings.clone(),
+        overrides.ssl_server_xml.clone(),
+    );
+    let ssl_client_xml = ssl_client::build(
+        cluster_config.ssl_client_settings.clone(),
+        overrides.ssl_client_xml.clone(),
+    );
 
     let security_properties = security_properties::build(role, overrides.security_properties.clone())
         .with_context(|_| JvmSecurityPropertiesSnafu {
diff --git a/rust/operator-binary/src/controller/build/properties/hbase_env.rs b/rust/operator-binary/src/controller/build/properties/hbase_env.rs
index a3fbe0c2..42fc905e 100644
--- a/rust/operator-binary/src/controller/build/properties/hbase_env.rs
+++ b/rust/operator-binary/src/controller/build/properties/hbase_env.rs
@@ -6,29 +6,23 @@ use snafu::{ResultExt, Snafu};
 use stackable_operator::v2::config_overrides::KeyValueConfigOverrides;
 
 use crate::{
-    config::jvm::{
-        self, construct_global_jvm_args, construct_hbase_heapsize_env,
-        construct_role_specific_non_heap_jvm_args,
-    },
+    config::jvm::{self, construct_global_jvm_args, construct_hbase_heapsize_env},
     controller::build::properties::resolved_overrides,
-    crd::{AnyServiceConfig, HbaseRole, v1alpha1},
+    crd::{AnyServiceConfig, HbaseRole},
 };
 
 #[derive(Snafu, Debug)]
 pub enum Error {
     #[snafu(display("failed to construct the HBASE_HEAPSIZE env variable"))]
     ConstructHbaseHeapsizeEnv { source: jvm::Error },
-
-    #[snafu(display("failed to construct the JVM arguments"))]
-    ConstructJvmArgument { source: jvm::Error },
 }
 
 /// Renders `hbase-env.sh` as `export VAR="VALUE"` lines.
 pub fn build(
-    hbase: &v1alpha1::HbaseCluster,
     merged_config: &AnyServiceConfig,
     role: &HbaseRole,
-    role_group: &str,
+    kerberos_enabled: bool,
+    non_heap_jvm_args: String,
     overrides: KeyValueConfigOverrides,
 ) -> Result<String, Error> {
     let mut env: BTreeMap<String, String> = BTreeMap::new();
@@ -40,30 +34,18 @@ pub fn build(
     );
     env.insert(
         "HBASE_OPTS".to_string(),
-        construct_global_jvm_args(hbase.has_kerberos_enabled()),
+        construct_global_jvm_args(kerberos_enabled),
     );
 
-    let role_specific_non_heap_jvm_args =
-        construct_role_specific_non_heap_jvm_args(hbase, role, role_group)
-            .context(ConstructJvmArgumentSnafu)?;
     match role {
         HbaseRole::Master => {
-            env.insert(
-                "HBASE_MASTER_OPTS".to_string(),
-                role_specific_non_heap_jvm_args,
-            );
+            env.insert("HBASE_MASTER_OPTS".to_string(), non_heap_jvm_args);
         }
         HbaseRole::RegionServer => {
-            env.insert(
-                "HBASE_REGIONSERVER_OPTS".to_string(),
-                role_specific_non_heap_jvm_args,
-            );
+            env.insert("HBASE_REGIONSERVER_OPTS".to_string(), non_heap_jvm_args);
         }
         HbaseRole::RestServer => {
-            env.insert(
-                "HBASE_REST_OPTS".to_string(),
-                role_specific_non_heap_jvm_args,
-            );
+            env.insert("HBASE_REST_OPTS".to_string(), non_heap_jvm_args);
         }
     }
 
@@ -81,7 +63,10 @@ pub fn build(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::controller::build::properties::test_support::{config_overrides, minimal_hbase};
+    use crate::{
+        controller::build::properties::test_support::{config_overrides, minimal_hbase},
+        crd::v1alpha1,
+    };
 
     fn master_merged_config(hbase: &v1alpha1::HbaseCluster) -> AnyServiceConfig {
         hbase
@@ -100,10 +85,10 @@ mod tests {
         let hbase = minimal_hbase();
         let merged = master_merged_config(&hbase);
         let env = build(
-            &hbase,
             &merged,
             &HbaseRole::Master,
-            "default",
+            false,
+            "-Xtest".to_string(),
             config_overrides(&[]),
         )
         .unwrap();
@@ -116,10 +101,10 @@ mod tests {
         let hbase = minimal_hbase();
         let merged = region_server_merged_config(&hbase);
         let env = build(
-            &hbase,
             &merged,
             &HbaseRole::RegionServer,
-            "default",
+            false,
+            "-Xtest".to_string(),
             config_overrides(&[]),
         )
         .unwrap();
@@ -131,10 +116,10 @@ mod tests {
         let hbase = minimal_hbase();
         let merged = master_merged_config(&hbase);
         let env = build(
-            &hbase,
             &merged,
             &HbaseRole::Master,
-            "default",
+            false,
+            "-Xtest".to_string(),
             config_overrides(&[("CUSTOM_VAR", "custom_value")]),
         )
         .unwrap();
diff --git a/rust/operator-binary/src/controller/build/properties/hbase_site.rs b/rust/operator-binary/src/controller/build/properties/hbase_site.rs
index f97a1b2d..4bae593c 100644
--- a/rust/operator-binary/src/controller/build/properties/hbase_site.rs
+++ b/rust/operator-binary/src/controller/build/properties/hbase_site.rs
@@ -4,39 +4,28 @@
 
 use std::collections::BTreeMap;
 
-use snafu::{ResultExt, Snafu};
-use stackable_operator::{
-    utils::cluster_info::KubernetesClusterInfo, v2::config_overrides::KeyValueConfigOverrides,
-};
+use stackable_operator::v2::config_overrides::KeyValueConfigOverrides;
 
 use crate::{
     config::writer::to_hadoop_xml,
     controller::build::properties::resolved_overrides,
     crd::{
         AnyServiceConfig, HBASE_CLUSTER_DISTRIBUTED, HBASE_MASTER_PORT, HBASE_MASTER_UI_PORT,
-        HBASE_REGIONSERVER_PORT, HBASE_REGIONSERVER_UI_PORT, HBASE_ROOTDIR, HbaseRole, v1alpha1,
+        HBASE_REGIONSERVER_PORT, HBASE_REGIONSERVER_UI_PORT, HBASE_ROOTDIR, HbaseRole,
     },
-    kerberos::{self, kerberos_config_properties},
     security::opa::HbaseOpaConfig,
 };
 
-#[derive(Snafu, Debug)]
-pub enum Error {
-    #[snafu(display("failed to add the kerberos configuration"))]
-    AddKerberosConfig { source: kerberos::Error },
-}
-
 /// Renders `hbase-site.xml`.
 #[allow(clippy::too_many_arguments)]
 pub fn build(
-    hbase: &v1alpha1::HbaseCluster,
     role: &HbaseRole,
-    cluster_info: &KubernetesClusterInfo,
     merged_config: &AnyServiceConfig,
     zookeeper_config: BTreeMap<String, String>,
+    kerberos_config: BTreeMap<String, String>,
     opa_config: Option<&HbaseOpaConfig>,
     overrides: KeyValueConfigOverrides,
-) -> Result<String, Error> {
+) -> String {
     let mut config: BTreeMap<String, String> = BTreeMap::new();
 
     // Defaults previously injected by product-config's `compute_files`.
@@ -46,7 +35,7 @@ pub fn build(
     }
 
     config.extend(zookeeper_config);
-    config.extend(kerberos_config_properties(hbase, cluster_info).context(AddKerberosConfigSnafu)?);
+    config.extend(kerberos_config);
     config.extend(opa_config.map_or(vec![], |config| config.hbase_site_config()));
 
     // Set flag to override default behaviour, which is that the
@@ -124,20 +113,21 @@ pub fn build(
     // configOverride come last
     config.extend(resolved_overrides(overrides));
 
-    Ok(to_hadoop_xml(
+    to_hadoop_xml(
         config
             .into_iter()
             .map(|(k, v)| (k, Some(v)))
             .collect::<BTreeMap<_, _>>()
             .iter(),
-    ))
+    )
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::controller::build::properties::test_support::{
-        cluster_info, config_overrides, minimal_hbase,
+    use crate::{
+        controller::build::properties::test_support::{config_overrides, minimal_hbase},
+        crd::v1alpha1,
     };
 
     fn master_merged_config(hbase: &v1alpha1::HbaseCluster) -> AnyServiceConfig {
@@ -163,15 +153,13 @@ mod tests {
         let hbase = minimal_hbase();
         let merged = master_merged_config(&hbase);
         let xml = build(
-            &hbase,
             &HbaseRole::Master,
-            &cluster_info(),
             &merged,
             BTreeMap::new(),
+            BTreeMap::new(),
             None,
             config_overrides(&[]),
-        )
-        .unwrap();
+        );
         assert!(
             xml.contains("<name>hbase.cluster.distributed</name>\n    <value>true</value>"),
             "{xml}"
@@ -187,15 +175,13 @@ mod tests {
         let hbase = minimal_hbase();
         let merged = region_server_merged_config(&hbase);
         let xml = build(
-            &hbase,
             &HbaseRole::RegionServer,
-            &cluster_info(),
             &merged,
             BTreeMap::new(),
+            BTreeMap::new(),
             None,
             config_overrides(&[]),
-        )
-        .unwrap();
+        );
         assert!(
             xml.contains(
                 "<name>hbase.regionserver.ipc.address</name>\n    <value>0.0.0.0</value>"
@@ -215,15 +201,13 @@ mod tests {
         let hbase = minimal_hbase();
         let merged = rest_server_merged_config(&hbase);
         let xml = build(
-            &hbase,
             &HbaseRole::RestServer,
-            &cluster_info(),
             &merged,
             BTreeMap::new(),
+            BTreeMap::new(),
             None,
             config_overrides(&[]),
-        )
-        .unwrap();
+        );
         assert!(
             xml.contains(
                 "<name>hbase.rest.endpoint</name>\n    <value>${env:HBASE_SERVICE_HOST}:${env:HBASE_SERVICE_PORT}</value>"
@@ -237,15 +221,13 @@ mod tests {
         let hbase = minimal_hbase();
         let merged = master_merged_config(&hbase);
         let xml = build(
-            &hbase,
             &HbaseRole::Master,
-            &cluster_info(),
             &merged,
             BTreeMap::new(),
+            BTreeMap::new(),
             None,
             config_overrides(&[("hbase.cluster.distributed", "false")]),
-        )
-        .unwrap();
+        );
         assert!(
             xml.contains("<name>hbase.cluster.distributed</name>\n    <value>false</value>"),
             "{xml}"
diff --git a/rust/operator-binary/src/controller/build/properties/mod.rs b/rust/operator-binary/src/controller/build/properties/mod.rs
index 5fb54649..31c7af24 100644
--- a/rust/operator-binary/src/controller/build/properties/mod.rs
+++ b/rust/operator-binary/src/controller/build/properties/mod.rs
@@ -61,10 +61,7 @@ mod tests {
 
 #[cfg(test)]
 pub(crate) mod test_support {
-    use stackable_operator::{
-        commons::networking::DomainName, utils::cluster_info::KubernetesClusterInfo,
-        v2::config_overrides::KeyValueConfigOverrides,
-    };
+    use stackable_operator::v2::config_overrides::KeyValueConfigOverrides;
 
     use crate::crd::v1alpha1;
 
@@ -109,10 +106,4 @@ spec:
     pub fn minimal_hbase() -> v1alpha1::HbaseCluster {
         serde_yaml::from_str(MINIMAL_HBASE_YAML).expect("invalid test HbaseCluster YAML")
     }
-
-    pub fn cluster_info() -> KubernetesClusterInfo {
-        KubernetesClusterInfo {
-            cluster_domain: DomainName::try_from("cluster.local").unwrap(),
-        }
-    }
 }
diff --git a/rust/operator-binary/src/controller/build/properties/ssl_client.rs b/rust/operator-binary/src/controller/build/properties/ssl_client.rs
index fdfac797..c6db3f50 100644
--- a/rust/operator-binary/src/controller/build/properties/ssl_client.rs
+++ b/rust/operator-binary/src/controller/build/properties/ssl_client.rs
@@ -3,19 +3,12 @@ use std::collections::BTreeMap;
 
 use stackable_operator::v2::config_overrides::KeyValueConfigOverrides;
 
-use crate::{
-    config::writer::to_hadoop_xml, controller::build::properties::resolved_overrides,
-    crd::v1alpha1, kerberos::kerberos_ssl_client_settings,
-};
+use crate::{config::writer::to_hadoop_xml, controller::build::properties::resolved_overrides};
 
 /// Renders `ssl-client.xml`. Returns "" (HBase rejects empty XML files) when empty.
-pub fn build(hbase: &v1alpha1::HbaseCluster, overrides: KeyValueConfigOverrides) -> String {
+pub fn build(settings: BTreeMap<String, String>, overrides: KeyValueConfigOverrides) -> String {
     let mut config: BTreeMap<String, Option<String>> = BTreeMap::new();
-    config.extend(
-        kerberos_ssl_client_settings(hbase)
-            .into_iter()
-            .map(|(k, v)| (k, Some(v))),
-    );
+    config.extend(settings.into_iter().map(|(k, v)| (k, Some(v))));
     config.extend(resolved_overrides(overrides).map(|(k, v)| (k, Some(v))));
     if config.is_empty() {
         return String::new();
@@ -26,17 +19,32 @@ pub fn build(hbase: &v1alpha1::HbaseCluster, overrides: KeyValueConfigOverrides)
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::controller::build::properties::test_support::{config_overrides, minimal_hbase};
+    use crate::controller::build::properties::test_support::config_overrides;
 
     #[test]
-    fn non_kerberos_without_overrides_renders_empty_string() {
-        assert_eq!(build(&minimal_hbase(), config_overrides(&[])), "");
+    fn empty_settings_without_overrides_renders_empty_string() {
+        assert_eq!(build(BTreeMap::new(), config_overrides(&[])), "");
+    }
+
+    #[test]
+    fn settings_appear_in_xml() {
+        let xml = build(
+            BTreeMap::from([(
+                "ssl.client.truststore.type".to_string(),
+                "pkcs12".to_string(),
+            )]),
+            config_overrides(&[]),
+        );
+        assert!(
+            xml.contains("<name>ssl.client.truststore.type</name>\n    <value>pkcs12</value>"),
+            "{xml}"
+        );
     }
 
     #[test]
     fn user_override_appears_in_xml() {
         let xml = build(
-            &minimal_hbase(),
+            BTreeMap::new(),
             config_overrides(&[("ssl.client.keystore.type", "jks")]),
         );
         assert!(
diff --git a/rust/operator-binary/src/controller/build/properties/ssl_server.rs b/rust/operator-binary/src/controller/build/properties/ssl_server.rs
index f2d6a91c..36da52ea 100644
--- a/rust/operator-binary/src/controller/build/properties/ssl_server.rs
+++ b/rust/operator-binary/src/controller/build/properties/ssl_server.rs
@@ -3,19 +3,12 @@ use std::collections::BTreeMap;
 
 use stackable_operator::v2::config_overrides::KeyValueConfigOverrides;
 
-use crate::{
-    config::writer::to_hadoop_xml, controller::build::properties::resolved_overrides,
-    crd::v1alpha1, kerberos::kerberos_ssl_server_settings,
-};
+use crate::{config::writer::to_hadoop_xml, controller::build::properties::resolved_overrides};
 
 /// Renders `ssl-server.xml`. Returns "" (HBase rejects empty XML files) when empty.
-pub fn build(hbase: &v1alpha1::HbaseCluster, overrides: KeyValueConfigOverrides) -> String {
+pub fn build(settings: BTreeMap<String, String>, overrides: KeyValueConfigOverrides) -> String {
     let mut config: BTreeMap<String, Option<String>> = BTreeMap::new();
-    config.extend(
-        kerberos_ssl_server_settings(hbase)
-            .into_iter()
-            .map(|(k, v)| (k, Some(v))),
-    );
+    config.extend(settings.into_iter().map(|(k, v)| (k, Some(v))));
     config.extend(resolved_overrides(overrides).map(|(k, v)| (k, Some(v))));
     if config.is_empty() {
         return String::new();
@@ -26,17 +19,32 @@ pub fn build(hbase: &v1alpha1::HbaseCluster, overrides: KeyValueConfigOverrides)
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::controller::build::properties::test_support::{config_overrides, minimal_hbase};
+    use crate::controller::build::properties::test_support::config_overrides;
 
     #[test]
-    fn non_kerberos_without_overrides_renders_empty_string() {
-        assert_eq!(build(&minimal_hbase(), config_overrides(&[])), "");
+    fn empty_settings_without_overrides_renders_empty_string() {
+        assert_eq!(build(BTreeMap::new(), config_overrides(&[])), "");
+    }
+
+    #[test]
+    fn settings_appear_in_xml() {
+        let xml = build(
+            BTreeMap::from([(
+                "ssl.server.keystore.type".to_string(),
+                "pkcs12".to_string(),
+            )]),
+            config_overrides(&[]),
+        );
+        assert!(
+            xml.contains("<name>ssl.server.keystore.type</name>\n    <value>pkcs12</value>"),
+            "{xml}"
+        );
     }
 
     #[test]
     fn user_override_appears_in_xml() {
         let xml = build(
-            &minimal_hbase(),
+            BTreeMap::new(),
             config_overrides(&[("ssl.server.keystore.type", "jks")]),
         );
         assert!(
diff --git a/rust/operator-binary/src/controller/validate.rs b/rust/operator-binary/src/controller/validate.rs
index 720d9c2d..bdc610da 100644
--- a/rust/operator-binary/src/controller/validate.rs
+++ b/rust/operator-binary/src/controller/validate.rs
@@ -6,17 +6,22 @@ use stackable_operator::{
     config::merge::Merge,
     kube::ResourceExt,
     role_utils::GenericRoleConfig,
+    utils::cluster_info::KubernetesClusterInfo,
     v2::types::operator::ClusterName,
 };
 use strum::IntoEnumIterator;
 
 use crate::{
+    config::jvm::construct_role_specific_non_heap_jvm_args,
     controller::dereference::DereferencedObjects,
     crd::{HbaseRole, v1alpha1},
     hbase_controller::{
         CONTAINER_IMAGE_BASE_NAME, ValidatedCluster, ValidatedClusterConfig, ValidatedRoleConfig,
         ValidatedRoleGroupConfig,
     },
+    kerberos::{
+        self, kerberos_config_properties, kerberos_ssl_client_settings, kerberos_ssl_server_settings,
+    },
 };
 
 #[derive(Snafu, Debug)]
@@ -36,11 +41,18 @@ pub enum Error {
 
     #[snafu(display("failed to resolve and merge config for role and role group"))]
     FailedToResolveConfig { source: crate::crd::Error },
+
+    #[snafu(display("failed to resolve kerberos config"))]
+    AddKerberosConfig { source: kerberos::Error },
+
+    #[snafu(display("failed to construct role-specific JVM arguments"))]
+    ConstructJvmArgument { source: crate::config::jvm::Error },
 }
 
 pub fn validate_cluster(
     hbase: &v1alpha1::HbaseCluster,
     image_repository: &str,
+    cluster_info: &KubernetesClusterInfo,
     dereferenced_objects: DereferencedObjects,
 ) -> Result<ValidatedCluster, Error> {
     let resolved_product_image = hbase
@@ -96,6 +108,12 @@ pub fn validate_cluster(
                     merged_config,
                     config_overrides: merged_config_overrides(hbase, &hbase_role, &rolegroup_name),
                     env_overrides: merged_env_overrides(hbase, &hbase_role, &rolegroup_name),
+                    non_heap_jvm_args: construct_role_specific_non_heap_jvm_args(
+                        hbase,
+                        &hbase_role,
+                        &rolegroup_name,
+                    )
+                    .context(ConstructJvmArgumentSnafu)?,
                 },
             );
         }
@@ -103,6 +121,11 @@ pub fn validate_cluster(
         role_groups.insert(hbase_role, group_configs);
     }
 
+    let hbase_site_kerberos_config =
+        kerberos_config_properties(hbase, cluster_info).context(AddKerberosConfigSnafu)?;
+    let ssl_server_settings = kerberos_ssl_server_settings(hbase);
+    let ssl_client_settings = kerberos_ssl_client_settings(hbase);
+
     Ok(ValidatedCluster {
         name: ClusterName::from_str(&hbase.name_any()).context(InvalidClusterNameSnafu)?,
         image: resolved_product_image,
@@ -110,6 +133,10 @@ pub fn validate_cluster(
             zookeeper_connection_information: dereferenced_objects
                 .zookeeper_connection_information,
             hbase_opa_config: dereferenced_objects.hbase_opa_config,
+            kerberos_enabled: hbase.has_kerberos_enabled(),
+            hbase_site_kerberos_config,
+            ssl_server_settings,
+            ssl_client_settings,
         },
         role_group_configs: role_groups,
         role_configs,
diff --git a/rust/operator-binary/src/hbase_controller.rs b/rust/operator-binary/src/hbase_controller.rs
index 7955e31d..41df54be 100644
--- a/rust/operator-binary/src/hbase_controller.rs
+++ b/rust/operator-binary/src/hbase_controller.rs
@@ -52,7 +52,7 @@ use stackable_operator::{
     },
     v2::types::operator::ClusterName,
 };
-use strum::{EnumDiscriminants, IntoStaticStr, ParseError};
+use strum::{EnumDiscriminants, IntoStaticStr};
 
 use crate::{
     OPERATOR_NAME,
@@ -107,6 +107,13 @@ pub struct ValidatedCluster {
 pub struct ValidatedClusterConfig {
     pub zookeeper_connection_information: ZookeeperConnectionInformation,
     pub hbase_opa_config: Option<HbaseOpaConfig>,
+    pub kerberos_enabled: bool,
+    /// Pre-resolved kerberos properties for hbase-site.xml (empty when kerberos is disabled).
+    pub hbase_site_kerberos_config: BTreeMap<String, String>,
+    /// Pre-resolved ssl-server.xml settings (empty when HTTPS is disabled).
+    pub ssl_server_settings: BTreeMap<String, String>,
+    /// Pre-resolved ssl-client.xml settings (empty when HTTPS is disabled).
+    pub ssl_client_settings: BTreeMap<String, String>,
 }
 
 /// Per-role configuration extracted during validation.
@@ -122,6 +129,8 @@ pub struct ValidatedRoleGroupConfig {
     pub merged_config: AnyServiceConfig,
     pub config_overrides: v1alpha1::HbaseConfigOverrides,
     pub env_overrides: BTreeMap<String, String>,
+    /// Pre-resolved role-specific non-heap JVM args (operator-generated + role/role-group overrides).
+    pub non_heap_jvm_args: String,
 }
 
 #[derive(Snafu, Debug, EnumDiscriminants)]
@@ -176,12 +185,6 @@ pub enum Error {
         source: stackable_operator::builder::meta::Error,
     },
 
-    #[snafu(display("no configmap_name for {cm_name} discovery is configured"))]
-    MissingConfigMap {
-        source: stackable_operator::builder::meta::Error,
-        cm_name: String,
-    },
-
     #[snafu(display("failed to patch service account"))]
     ApplyServiceAccount {
         source: stackable_operator::cluster_resources::Error,
@@ -226,9 +229,6 @@ pub enum Error {
         source: stackable_operator::builder::meta::Error,
     },
 
-    #[snafu(display("unknown role [{role}]"))]
-    UnknownHbaseRole { source: ParseError, role: String },
-
     #[snafu(display("failed to configure logging"))]
     ConfigureLogging { source: LoggingError },
 
@@ -293,9 +293,10 @@ pub async fn reconcile_hbase(
         .await
         .context(DereferenceSnafu)?;
 
-    let validated = crate::controller::validate::validate_cluster(
+    let validated_cluster = crate::controller::validate::validate_cluster(
         hbase,
         &ctx.operator_environment.image_repository,
+        &client.kubernetes_cluster_info,
         dereferenced_objects,
     )
     .context(ValidateSnafu)?;
@@ -329,21 +330,24 @@ pub async fn reconcile_hbase(
 
     let mut ss_cond_builder = StatefulSetConditionBuilder::default();
 
-    for (hbase_role, role_group_configs) in &validated.role_group_configs {
+    for (hbase_role, role_group_configs) in &validated_cluster.role_group_configs {
         for (rolegroup_name, validated_rg_config) in role_group_configs {
             let rolegroup = hbase.server_rolegroup_ref(hbase_role.to_string(), rolegroup_name);
 
             let rg_service =
-                build_rolegroup_service(hbase, hbase_role, &rolegroup, &validated.image)?;
+                build_rolegroup_service(hbase, hbase_role, &rolegroup, &validated_cluster.image)?;
 
-            let rg_metrics_service =
-                build_rolegroup_metrics_service(hbase, hbase_role, &rolegroup, &validated.image)?;
+            let rg_metrics_service = build_rolegroup_metrics_service(
+                hbase,
+                hbase_role,
+                &rolegroup,
+                &validated_cluster.image,
+            )?;
 
             let rg_configmap = crate::controller::build::config_map::build_rolegroup_config_map(
                 hbase,
-                &validated,
+                &validated_cluster,
                 hbase_role,
-                &client.kubernetes_cluster_info,
                 &rolegroup,
             )
             .context(BuildRolegroupConfigMapSnafu)?;
@@ -352,7 +356,7 @@ pub async fn reconcile_hbase(
                 hbase_role,
                 &rolegroup,
                 validated_rg_config,
-                &validated.image,
+                &validated_cluster.image,
                 &rbac_sa,
             )?;
             cluster_resources
@@ -387,7 +391,7 @@ pub async fn reconcile_hbase(
             );
         }
 
-        if let Some(role_config) = validated.role_configs.get(hbase_role) {
+        if let Some(role_config) = validated_cluster.role_configs.get(hbase_role) {
             add_pdbs(
                 &role_config.pdb,
                 hbase,
@@ -405,8 +409,10 @@ pub async fn reconcile_hbase(
     let discovery_cm = build_discovery_configmap(
         hbase,
         &client.kubernetes_cluster_info,
-        &validated.cluster_config.zookeeper_connection_information,
-        &validated.image,
+        &validated_cluster
+            .cluster_config
+            .zookeeper_connection_information,
+        &validated_cluster.image,
     )
     .context(BuildDiscoveryConfigMapSnafu)?;
     cluster_resources

From 965c2126abfcd2fd5329517a49a0ae9354c8da20 Mon Sep 17 00:00:00 2001
From: Malte Sander <malte.sander.it@gmail.com>
Date: Wed, 3 Jun 2026 19:28:31 +0200
Subject: [PATCH 08/21] chore: regenerate

---
 Cargo.nix                                     | 1396 +++++++----------
 crate-hashes.json                             |   18 +-
 .../hbase-operator/configs/properties.yaml    |  268 +---
 extra/crds.yaml                               |   90 +-
 4 files changed, 633 insertions(+), 1139 deletions(-)

diff --git a/Cargo.nix b/Cargo.nix
index fdd7ec68..55fc2419 100644
--- a/Cargo.nix
+++ b/Cargo.nix
@@ -216,9 +216,9 @@ rec {
       };
       "anstream" = rec {
         crateName = "anstream";
-        version = "0.6.21";
+        version = "1.0.0";
         edition = "2021";
-        sha256 = "0jjgixms4qjj58dzr846h2s29p8w7ynwr9b9x6246m1pwy0v5ma3";
+        sha256 = "13d2bj0xfg012s4rmq44zc8zgy1q8k9yp7yhvfnarscnmwpj2jl2";
         dependencies = [
           {
             name = "anstyle";
@@ -261,9 +261,9 @@ rec {
       };
       "anstyle" = rec {
         crateName = "anstyle";
-        version = "1.0.13";
+        version = "1.0.14";
         edition = "2021";
-        sha256 = "0y2ynjqajpny6q0amvfzzgw0gfw3l47z85km4gvx87vg02lcr4ji";
+        sha256 = "0030szmgj51fxkic1hpakxxgappxzwm6m154a3gfml83lq63l2wl";
         features = {
           "default" = [ "std" ];
         };
@@ -271,9 +271,9 @@ rec {
       };
       "anstyle-parse" = rec {
         crateName = "anstyle-parse";
-        version = "0.2.7";
+        version = "1.0.0";
         edition = "2021";
-        sha256 = "1hhmkkfr95d462b3zf6yl2vfzdqfy5726ya572wwg8ha9y148xjf";
+        sha256 = "03hkv2690s0crssbnmfkr76kw1k7ah2i6s5amdy9yca2n8w7zkjj";
         libName = "anstyle_parse";
         dependencies = [
           {
@@ -345,9 +345,9 @@ rec {
       };
       "arc-swap" = rec {
         crateName = "arc-swap";
-        version = "1.8.2";
+        version = "1.9.1";
         edition = "2018";
-        sha256 = "19aas8y3kz0v6jr6yijvw6cad9grpl3lw1a25k0cws2m2iy69wzr";
+        sha256 = "01xjlahcya8igdalxmda375lnlhjqwjz0cdqhy0bc1jkyzb1yfka";
         libName = "arc_swap";
         authors = [
           "Michal 'vorner' Vaner <vorner@vorner.cz>"
@@ -489,9 +489,9 @@ rec {
       };
       "autocfg" = rec {
         crateName = "autocfg";
-        version = "1.5.0";
+        version = "1.5.1";
         edition = "2015";
-        sha256 = "1s77f98id9l4af4alklmzq46f21c980v13z2r1pcxx6bqgw0d1n0";
+        sha256 = "0lqasy5i30flcgih1b50kvsk6z32g09r1q4ql7q81pj6228jy0zj";
         authors = [
           "Josh Stone <cuviper@gmail.com>"
         ];
@@ -499,9 +499,9 @@ rec {
       };
       "axum" = rec {
         crateName = "axum";
-        version = "0.8.8";
+        version = "0.8.9";
         edition = "2021";
-        sha256 = "1f4p0m04mgwpn8b40i9r5mgqxk6w11sv4yri6xfqk305nhyayllb";
+        sha256 = "146df5x8dhczm1sp939gr3839220wl6rxc1k65bzc450z72ridii";
         dependencies = [
           {
             name = "axum-core";
@@ -866,9 +866,9 @@ rec {
       };
       "bitflags" = rec {
         crateName = "bitflags";
-        version = "2.11.0";
+        version = "2.12.1";
         edition = "2021";
-        sha256 = "1bwjibwry5nfwsfm9kjg2dqx5n5nja9xymwbfl6svnn8jsz6ff44";
+        sha256 = "02phhjm7w380zdh8928zf13cfi1bw2qz2ay36ml2jmwmmv8cxmw4";
         authors = [
           "The Rust Project Developers"
         ];
@@ -898,9 +898,9 @@ rec {
       };
       "built" = rec {
         crateName = "built";
-        version = "0.8.0";
-        edition = "2021";
-        sha256 = "0r5f08lpjsr6j5ajkbmd0ymfmajpq8ddbfvi8ji8rx48y88qzbgl";
+        version = "0.8.1";
+        edition = "2024";
+        sha256 = "1saq332pd6g3svvc9ah8myjpfvgqlzl2ksb1ypp3976kjcfm63jw";
         authors = [
           "Lukas Lueg <lukas.lueg@gmail.com>"
         ];
@@ -924,15 +924,16 @@ rec {
           "chrono" = [ "dep:chrono" ];
           "dependency-tree" = [ "cargo-lock/dependency-tree" ];
           "git2" = [ "dep:git2" ];
+          "gix" = [ "dep:gix" ];
           "semver" = [ "dep:semver" ];
         };
         resolvedDefaultFeatures = [ "chrono" "git2" ];
       };
       "bumpalo" = rec {
         crateName = "bumpalo";
-        version = "3.20.2";
+        version = "3.20.3";
         edition = "2021";
-        sha256 = "1jrgxlff76k9glam0akhwpil2fr1w32gbjdf5hpipc7ld2c7h82x";
+        sha256 = "0jc6va3nwcqikm7chnpdv1s87my3gs2j7g1sc7g3k91brg3arxbj";
         authors = [
           "Nick Fitzgerald <fitzgen@gmail.com>"
         ];
@@ -961,9 +962,9 @@ rec {
       };
       "cc" = rec {
         crateName = "cc";
-        version = "1.2.56";
+        version = "1.2.63";
         edition = "2018";
-        sha256 = "1chvh9g2izhqad7vzy4cc7xpdljdvqpsr6x6hv1hmyqv3mlkbgxf";
+        sha256 = "0zy2bqc4nvj6bv2cipx4h4bn65wf1zqf1fw1hsh64mmvg1hh2vjm";
         authors = [
           "Alex Crichton <alex@alexcrichton.com>"
         ];
@@ -1060,10 +1061,10 @@ rec {
       };
       "clap" = rec {
         crateName = "clap";
-        version = "4.5.60";
-        edition = "2021";
+        version = "4.6.1";
+        edition = "2024";
         crateBin = [];
-        sha256 = "02h3nzznssjgp815nnbzk0r62y2iw03kdli75c233kirld6z75r7";
+        sha256 = "0lcf88l7vlg796rrqr7wipbbmfa5sgsgx4211b7xmxxv8dz13nqx";
         dependencies = [
           {
             name = "clap_builder";
@@ -1102,9 +1103,9 @@ rec {
       };
       "clap_builder" = rec {
         crateName = "clap_builder";
-        version = "4.5.60";
-        edition = "2021";
-        sha256 = "0xk8mdizvmmn6w5ij5cwhy5pbgyac4w9pfvl6nqmjl7a5hql38i4";
+        version = "4.6.0";
+        edition = "2024";
+        sha256 = "17q6np22yxhh5y5v53y4l31ps3hlaz45mvz2n2nicr7n3c056jki";
         dependencies = [
           {
             name = "anstream";
@@ -1141,9 +1142,9 @@ rec {
       };
       "clap_derive" = rec {
         crateName = "clap_derive";
-        version = "4.5.55";
-        edition = "2021";
-        sha256 = "1r949xis3jmhzh387smd70vc8a3b9734ck3g5ahg59a63bd969x9";
+        version = "4.6.1";
+        edition = "2024";
+        sha256 = "1acpz49hi00iv9jkapixjzcv7s51x8qkfaqscjm36rqgf428dkpj";
         procMacro = true;
         dependencies = [
           {
@@ -1173,16 +1174,16 @@ rec {
       };
       "clap_lex" = rec {
         crateName = "clap_lex";
-        version = "1.0.0";
-        edition = "2021";
-        sha256 = "0c8888qi1l9sayqlv666h8s0yxn2qc6jr88v1zagk43mpjjjx0is";
+        version = "1.1.0";
+        edition = "2024";
+        sha256 = "1ycqkpygnlqnndghhcxjb44lzl0nmgsia64x9581030yifxs7m68";
 
       };
       "colorchoice" = rec {
         crateName = "colorchoice";
-        version = "1.0.4";
+        version = "1.0.5";
         edition = "2021";
-        sha256 = "0x8ymkz1xr77rcj1cfanhf416pc4v681gmkc9dzb3jqja7f62nxh";
+        sha256 = "0w75k89hw39p0mnnhlrwr23q50rza1yjki44qvh2mgrnj065a1qx";
 
       };
       "concurrent-queue" = rec {
@@ -1226,9 +1227,9 @@ rec {
       };
       "const_format" = rec {
         crateName = "const_format";
-        version = "0.2.35";
+        version = "0.2.36";
         edition = "2021";
-        sha256 = "1b9h03z3k76ail1ldqxcqmsc4raa7dwgwwqwrjf6wmism5lp9akz";
+        sha256 = "07ncczs8yndga2f8p4386c827l4fxwzl0pbwp7ijnhcsmlbsd0a4";
         authors = [
           "rodrimati1992 <rodrimatt1985@gmail.com>"
         ];
@@ -1237,6 +1238,12 @@ rec {
             name = "const_format_proc_macros";
             packageId = "const_format_proc_macros";
           }
+          {
+            name = "konst";
+            packageId = "konst";
+            usesDefaultFeatures = false;
+            features = [ "rust_1_64" ];
+          }
         ];
         features = {
           "__debug" = [ "const_format_proc_macros/debug" ];
@@ -1250,10 +1257,9 @@ rec {
           "constant_time_as_str" = [ "fmt" ];
           "derive" = [ "fmt" "const_format_proc_macros/derive" ];
           "fmt" = [ "rust_1_83" ];
-          "konst" = [ "dep:konst" ];
           "more_str_macros" = [ "rust_1_64" ];
           "nightly_const_generics" = [ "const_generics" ];
-          "rust_1_64" = [ "rust_1_51" "konst" "konst/rust_1_64" ];
+          "rust_1_64" = [ "rust_1_51" ];
           "rust_1_83" = [ "rust_1_64" ];
         };
         resolvedDefaultFeatures = [ "default" ];
@@ -1901,9 +1907,9 @@ rec {
       };
       "displaydoc" = rec {
         crateName = "displaydoc";
-        version = "0.2.5";
+        version = "0.2.6";
         edition = "2021";
-        sha256 = "1q0alair462j21iiqwrr21iabkfnb13d6x5w95lkdg21q2xrqdlp";
+        sha256 = "0kyxwfbdmagd8afzb2pzja7wj8dhah7smxdsgw00iq8pa2jhmiqs";
         procMacro = true;
         authors = [
           "Jane Lusby <jlusby@yaah.dev>"
@@ -2103,12 +2109,9 @@ rec {
       };
       "either" = rec {
         crateName = "either";
-        version = "1.15.0";
+        version = "1.16.0";
         edition = "2021";
-        sha256 = "069p1fknsmzn9llaizh77kip0pqmcwpdsykv2x30xpjyija5gis8";
-        authors = [
-          "bluss"
-        ];
+        sha256 = "17k7jfbdz7k440h6lws9baz8p9zlxgb41sig3w81h80nwzsjyqli";
         features = {
           "default" = [ "std" ];
           "serde" = [ "dep:serde" ];
@@ -2452,9 +2455,9 @@ rec {
       };
       "fastrand" = rec {
         crateName = "fastrand";
-        version = "2.3.0";
+        version = "2.4.1";
         edition = "2018";
-        sha256 = "1ghiahsw1jd68df895cy5h3gzwk30hndidn3b682zmshpgmrx41p";
+        sha256 = "1mnqxxnxvd69ma9mczabpbbsgwlhd6l78yv3vd681453a9s247wz";
         authors = [
           "Stjepan Glavina <stjepang@gmail.com>"
         ];
@@ -2825,9 +2828,9 @@ rec {
       };
       "futures-timer" = rec {
         crateName = "futures-timer";
-        version = "3.0.3";
+        version = "3.0.4";
         edition = "2018";
-        sha256 = "094vw8k37djpbwv74bwf2qb7n6v6ghif4myss6smd6hgyajb127j";
+        sha256 = "0s39in8ivw7g4d37pf31q02y44zd1hpfkd1pgra2slcqibdzlhxg";
         libName = "futures_timer";
         authors = [
           "Alex Crichton <alex@alexcrichton.com>"
@@ -3085,9 +3088,9 @@ rec {
       };
       "git2" = rec {
         crateName = "git2";
-        version = "0.20.4";
-        edition = "2018";
-        sha256 = "0azykjpk3j6s354z23jkyq3r3pbmlw9ha1zsxkw5cnnpi1h2b23v";
+        version = "0.21.0";
+        edition = "2021";
+        sha256 = "0bmqga9vlyx5sdlr0i28z0362s89xv9i4qcv20vvx9j54y9vzpfx";
         authors = [
           "Josh Triplett <josh@joshtriplett.org>"
           "Alex Crichton <alex@alexcrichton.com>"
@@ -3109,17 +3112,14 @@ rec {
             name = "log";
             packageId = "log";
           }
-          {
-            name = "url";
-            packageId = "url";
-          }
         ];
         features = {
-          "default" = [ "ssh" "https" ];
-          "https" = [ "libgit2-sys/https" "openssl-sys" "openssl-probe" ];
+          "cred" = [ "dep:url" ];
+          "https" = [ "libgit2-sys/https" "openssl-sys" "openssl-probe" "cred" ];
           "openssl-probe" = [ "dep:openssl-probe" ];
           "openssl-sys" = [ "dep:openssl-sys" ];
-          "ssh" = [ "libgit2-sys/ssh" ];
+          "ssh" = [ "libgit2-sys/ssh" "cred" ];
+          "unstable-sha256" = [ "libgit2-sys/unstable-sha256" ];
           "vendored-libgit2" = [ "libgit2-sys/vendored" ];
           "vendored-openssl" = [ "openssl-sys/vendored" "libgit2-sys/vendored-openssl" ];
           "zlib-ng-compat" = [ "libgit2-sys/zlib-ng-compat" ];
@@ -3209,9 +3209,9 @@ rec {
       };
       "h2" = rec {
         crateName = "h2";
-        version = "0.4.13";
+        version = "0.4.14";
         edition = "2021";
-        sha256 = "0m6w5gg0n0m1m5915bxrv8n4rlazhx5icknkslz719jhh4xdli1g";
+        sha256 = "0cw7jk7kn2vn6f8w8ssh6gis1mljnfjxd606gvi4sjpyjayfy7qp";
         authors = [
           "Carl Lerche <me@carllerche.com>"
           "Sean McArthur <sean@seanmonstar.com>"
@@ -3279,7 +3279,7 @@ rec {
         features = {
         };
       };
-      "hashbrown" = rec {
+      "hashbrown 0.16.1" = rec {
         crateName = "hashbrown";
         version = "0.16.1";
         edition = "2021";
@@ -3322,6 +3322,24 @@ rec {
         };
         resolvedDefaultFeatures = [ "allocator-api2" "default" "default-hasher" "equivalent" "inline-more" "raw-entry" ];
       };
+      "hashbrown 0.17.1" = rec {
+        crateName = "hashbrown";
+        version = "0.17.1";
+        edition = "2024";
+        sha256 = "0jmqz7i4yl6cm7rbn0i2ffkfrmwi6xkmzkaldr2v8bcsx2v0jngd";
+        features = {
+          "alloc" = [ "dep:alloc" ];
+          "allocator-api2" = [ "dep:allocator-api2" ];
+          "core" = [ "dep:core" ];
+          "default" = [ "default-hasher" "inline-more" "allocator-api2" "equivalent" "raw-entry" ];
+          "default-hasher" = [ "dep:foldhash" ];
+          "equivalent" = [ "dep:equivalent" ];
+          "nightly" = [ "foldhash?/nightly" "bumpalo/allocator_api" ];
+          "rayon" = [ "dep:rayon" ];
+          "rustc-dep-of-std" = [ "nightly" "core" "alloc" "rustc-internal-api" ];
+          "serde" = [ "dep:serde_core" "dep:serde" ];
+        };
+      };
       "heck" = rec {
         crateName = "heck";
         version = "0.5.0";
@@ -3383,9 +3401,9 @@ rec {
       };
       "http" = rec {
         crateName = "http";
-        version = "1.4.0";
+        version = "1.4.1";
         edition = "2021";
-        sha256 = "06iind4cwsj1d6q8c2xgq8i2wka4ps74kmws24gsi1bzdlw2mfp3";
+        sha256 = "1l7k2ia57z3q7q3ka497krzps795kd3fymm2k12lr623y4nldrwb";
         authors = [
           "Alex Crichton <alex@alexcrichton.com>"
           "Carl Lerche <me@carllerche.com>"
@@ -3502,9 +3520,9 @@ rec {
       };
       "hyper" = rec {
         crateName = "hyper";
-        version = "1.8.1";
+        version = "1.10.1";
         edition = "2021";
-        sha256 = "04cxr8j5y86bhxxlyqb8xkxjskpajk7cxwfzzk4v3my3a3rd9cia";
+        sha256 = "1624nwrh1ci34psqcl3q8q266kha8kd6fmqjj14qck49l59iqa2m";
         authors = [
           "Sean McArthur <sean@seanmonstar.com>"
         ];
@@ -3561,11 +3579,6 @@ rec {
             packageId = "pin-project-lite";
             optional = true;
           }
-          {
-            name = "pin-utils";
-            packageId = "pin-utils";
-            optional = true;
-          }
           {
             name = "smallvec";
             packageId = "smallvec";
@@ -3603,7 +3616,7 @@ rec {
           "client" = [ "dep:want" "dep:pin-project-lite" "dep:smallvec" ];
           "ffi" = [ "dep:http-body-util" "dep:futures-util" ];
           "full" = [ "client" "http1" "http2" "server" ];
-          "http1" = [ "dep:atomic-waker" "dep:futures-channel" "dep:futures-core" "dep:httparse" "dep:itoa" "dep:pin-utils" ];
+          "http1" = [ "dep:atomic-waker" "dep:futures-channel" "dep:futures-core" "dep:httparse" "dep:itoa" ];
           "http2" = [ "dep:futures-channel" "dep:futures-core" "dep:h2" ];
           "server" = [ "dep:httpdate" "dep:pin-project-lite" "dep:smallvec" ];
           "tracing" = [ "dep:tracing" ];
@@ -3612,9 +3625,9 @@ rec {
       };
       "hyper-rustls" = rec {
         crateName = "hyper-rustls";
-        version = "0.27.7";
+        version = "0.27.9";
         edition = "2021";
-        sha256 = "0n6g8998szbzhnvcs1b7ibn745grxiqmlpg53xz206v826v3xjg3";
+        sha256 = "03vfnsm873wsp1dk0q85nxvk7w6syp8c2m5bcdjcyfgg4786ijik";
         libName = "hyper_rustls";
         dependencies = [
           {
@@ -3647,11 +3660,6 @@ rec {
             packageId = "rustls-native-certs";
             optional = true;
           }
-          {
-            name = "rustls-pki-types";
-            packageId = "rustls-pki-types";
-            rename = "pki-types";
-          }
           {
             name = "tokio";
             packageId = "tokio";
@@ -3951,9 +3959,9 @@ rec {
       };
       "icu_collections" = rec {
         crateName = "icu_collections";
-        version = "2.1.1";
+        version = "2.2.0";
         edition = "2021";
-        sha256 = "0hsblchsdl64q21qwrs4hvc2672jrf466zivbj1bwyv606bn8ssc";
+        sha256 = "070r7xd0pynm0hnc1v2jzlbxka6wf50f81wybf9xg0y82v6x3119";
         authors = [
           "The ICU4X Project Developers"
         ];
@@ -3969,6 +3977,11 @@ rec {
             usesDefaultFeatures = false;
             features = [ "zerovec" ];
           }
+          {
+            name = "utf8_iter";
+            packageId = "utf8_iter";
+            usesDefaultFeatures = false;
+          }
           {
             name = "yoke";
             packageId = "yoke";
@@ -3996,9 +4009,9 @@ rec {
       };
       "icu_locale_core" = rec {
         crateName = "icu_locale_core";
-        version = "2.1.1";
+        version = "2.2.0";
         edition = "2021";
-        sha256 = "1djvdc2f5ylmp1ymzv4gcnmq1s4hqfim9nxlcm173lsd01hpifpd";
+        sha256 = "0a9cmin5w1x3bg941dlmgszn33qgq428k7qiqn5did72ndi9n8cj";
         authors = [
           "The ICU4X Project Developers"
         ];
@@ -4030,6 +4043,14 @@ rec {
             usesDefaultFeatures = false;
           }
         ];
+        devDependencies = [
+          {
+            name = "litemap";
+            packageId = "litemap";
+            usesDefaultFeatures = false;
+            features = [ "testing" ];
+          }
+        ];
         features = {
           "alloc" = [ "litemap/alloc" "tinystr/alloc" "writeable/alloc" "serde?/alloc" ];
           "databake" = [ "dep:databake" "alloc" ];
@@ -4040,9 +4061,9 @@ rec {
       };
       "icu_normalizer" = rec {
         crateName = "icu_normalizer";
-        version = "2.1.1";
+        version = "2.2.0";
         edition = "2021";
-        sha256 = "16dmn5596la2qm0r3vih0bzjfi0vx9a20yqjha6r1y3vnql8hv2z";
+        sha256 = "1d7krxr0xpc4x9635k1100a24nh0nrc59n65j6yk6gbfkplmwvn5";
         authors = [
           "The ICU4X Project Developers"
         ];
@@ -4084,6 +4105,7 @@ rec {
           "compiled_data" = [ "dep:icu_normalizer_data" "icu_properties?/compiled_data" "icu_provider/baked" ];
           "datagen" = [ "serde" "dep:databake" "icu_properties" "icu_collections/databake" "zerovec/databake" "icu_properties?/datagen" "icu_provider/export" ];
           "default" = [ "compiled_data" "utf8_iter" "utf16_iter" ];
+          "harfbuzz_traits" = [ "dep:harfbuzz-traits" ];
           "icu_properties" = [ "dep:icu_properties" ];
           "serde" = [ "dep:serde" "icu_collections/serde" "zerovec/serde" "icu_properties?/serde" "icu_provider/serde" ];
           "utf16_iter" = [ "dep:utf16_iter" "dep:write16" ];
@@ -4093,9 +4115,9 @@ rec {
       };
       "icu_normalizer_data" = rec {
         crateName = "icu_normalizer_data";
-        version = "2.1.1";
+        version = "2.2.0";
         edition = "2021";
-        sha256 = "02jnzizg6q75m41l6c13xc7nkc5q8yr1b728dcgfhpzw076wrvbs";
+        sha256 = "0f5d5d5fhhr9937m2z6z38fzh6agf14z24kwlr6lyczafypf0fys";
         authors = [
           "The ICU4X Project Developers"
         ];
@@ -4103,9 +4125,9 @@ rec {
       };
       "icu_properties" = rec {
         crateName = "icu_properties";
-        version = "2.1.2";
+        version = "2.2.0";
         edition = "2021";
-        sha256 = "1v3lbmhhi7i6jgw51ikjb1p50qh5rb67grlkdnkc63l7zq1gq2q2";
+        sha256 = "1pkh3s837808cbwxvfagwc28cvwrz2d9h5rl02jwrhm51ryvdqxy";
         authors = [
           "The ICU4X Project Developers"
         ];
@@ -4150,6 +4172,7 @@ rec {
           "compiled_data" = [ "dep:icu_properties_data" "icu_provider/baked" ];
           "datagen" = [ "serde" "dep:databake" "zerovec/databake" "icu_collections/databake" "icu_locale_core/databake" "zerotrie/databake" "icu_provider/export" ];
           "default" = [ "compiled_data" ];
+          "harfbuzz_traits" = [ "dep:harfbuzz-traits" ];
           "serde" = [ "dep:serde" "icu_locale_core/serde" "zerovec/serde" "icu_collections/serde" "icu_provider/serde" "zerotrie/serde" ];
           "unicode_bidi" = [ "dep:unicode-bidi" ];
         };
@@ -4157,9 +4180,9 @@ rec {
       };
       "icu_properties_data" = rec {
         crateName = "icu_properties_data";
-        version = "2.1.2";
+        version = "2.2.0";
         edition = "2021";
-        sha256 = "1bvpkh939rgzrjfdb7hz47v4wijngk0snmcgrnpwc9fpz162jv31";
+        sha256 = "052awny0qwkbcbpd5jg2cd7vl5ry26pq4hz1nfsgf10c3qhbnawf";
         authors = [
           "The ICU4X Project Developers"
         ];
@@ -4167,9 +4190,9 @@ rec {
       };
       "icu_provider" = rec {
         crateName = "icu_provider";
-        version = "2.1.1";
+        version = "2.2.0";
         edition = "2021";
-        sha256 = "0576b7dizgyhpfa74kacv86y4g1p7v5ffd6c56kf1q82rvq2r5l5";
+        sha256 = "08dl8pxbwr8zsz4c5vphqb7xw0hykkznwi4rw7bk6pwb3krlr70k";
         authors = [
           "The ICU4X Project Developers"
         ];
@@ -4270,9 +4293,9 @@ rec {
       };
       "idna_adapter" = rec {
         crateName = "idna_adapter";
-        version = "1.2.1";
-        edition = "2021";
-        sha256 = "0i0339pxig6mv786nkqcxnwqa87v4m94b2653f6k3aj0jmhfkjis";
+        version = "1.2.2";
+        edition = "2024";
+        sha256 = "0557p76l8hj35r9zn1yv7c6x1c0qbrsffmg80n0yy8361ly3fs6b";
         authors = [
           "The rust-url developers"
         ];
@@ -4295,9 +4318,9 @@ rec {
       };
       "indexmap" = rec {
         crateName = "indexmap";
-        version = "2.13.0";
-        edition = "2021";
-        sha256 = "05qh5c4h2hrnyypphxpwflk45syqbzvqsvvyxg43mp576w2ff53p";
+        version = "2.14.0";
+        edition = "2024";
+        sha256 = "1na9z6f0d5pkjr1lgsni470v98gv2r7c41j8w48skr089x2yjrnl";
         dependencies = [
           {
             name = "equivalent";
@@ -4306,7 +4329,7 @@ rec {
           }
           {
             name = "hashbrown";
-            packageId = "hashbrown";
+            packageId = "hashbrown 0.17.1";
             usesDefaultFeatures = false;
           }
         ];
@@ -4346,55 +4369,24 @@ rec {
       };
       "ipnet" = rec {
         crateName = "ipnet";
-        version = "2.11.0";
+        version = "2.12.0";
         edition = "2018";
-        sha256 = "0c5i9sfi2asai28m8xp48k5gvwkqrg5ffpi767py6mzsrswv17s6";
+        sha256 = "1qpq2y0asyv0jppw7zww9y96fpnpinwap8a0phhqqgyy3znnz3yr";
         authors = [
           "Kris Price <kris@krisprice.nz>"
         ];
         features = {
           "default" = [ "std" ];
-          "heapless" = [ "dep:heapless" ];
-          "json" = [ "serde" "schemars" ];
-          "schemars" = [ "dep:schemars" ];
-          "ser_as_str" = [ "heapless" ];
+          "heapless" = [ "dep:heapless" "serde" ];
+          "json" = [ "schemars08" "serde" ];
+          "schemars" = [ "schemars08" ];
+          "schemars08" = [ "dep:schemars08" ];
+          "schemars1" = [ "dep:schemars1" ];
+          "ser_as_str" = [ "dep:heapless" ];
           "serde" = [ "dep:serde" ];
         };
         resolvedDefaultFeatures = [ "default" "std" ];
       };
-      "iri-string" = rec {
-        crateName = "iri-string";
-        version = "0.7.10";
-        edition = "2021";
-        sha256 = "06kk3a5jz576p7vrpf7zz9jv3lrgcyp7pczcblcxdnryg3q3h4y9";
-        libName = "iri_string";
-        authors = [
-          "YOSHIOKA Takuma <nop_thread@nops.red>"
-        ];
-        dependencies = [
-          {
-            name = "memchr";
-            packageId = "memchr";
-            optional = true;
-            usesDefaultFeatures = false;
-          }
-          {
-            name = "serde";
-            packageId = "serde";
-            optional = true;
-            usesDefaultFeatures = false;
-            features = [ "derive" ];
-          }
-        ];
-        features = {
-          "alloc" = [ "serde?/alloc" ];
-          "default" = [ "std" ];
-          "memchr" = [ "dep:memchr" ];
-          "serde" = [ "dep:serde" ];
-          "std" = [ "alloc" "memchr?/std" "serde?/std" ];
-        };
-        resolvedDefaultFeatures = [ "alloc" "default" "std" ];
-      };
       "is_terminal_polyfill" = rec {
         crateName = "is_terminal_polyfill";
         version = "1.70.2";
@@ -4427,9 +4419,9 @@ rec {
       };
       "itoa" = rec {
         crateName = "itoa";
-        version = "1.0.17";
+        version = "1.0.18";
         edition = "2021";
-        sha256 = "1lh93xydrdn1g9x547bd05g0d3hra7pd1k4jfd2z1pl1h5hwdv4j";
+        sha256 = "10jnd1vpfkb8kj38rlkn2a6k02afvj3qmw054dfpzagrpl6achlg";
         authors = [
           "David Tolnay <dtolnay@gmail.com>"
         ];
@@ -4464,9 +4456,9 @@ rec {
       };
       "jiff" = rec {
         crateName = "jiff";
-        version = "0.2.21";
+        version = "0.2.28";
         edition = "2021";
-        sha256 = "0h3rypc82v4a8wf1s8jvqdryv5khp520ks0nmd3fjslc05gxdqxk";
+        sha256 = "00lixngcc7amh2fcsxfr0z38j06lllhapz192biv1qj97q1x60s6";
         authors = [
           "Andrew Gallant <jamslam@gmail.com>"
         ];
@@ -4512,12 +4504,10 @@ rec {
             usesDefaultFeatures = false;
           }
           {
-            name = "windows-sys";
-            packageId = "windows-sys 0.61.2";
+            name = "windows-link";
+            packageId = "windows-link";
             optional = true;
-            usesDefaultFeatures = false;
             target = { target, features }: (target."windows" or false);
-            features = [ "Win32_Foundation" "Win32_System_Time" ];
           }
         ];
         devDependencies = [
@@ -4536,7 +4526,7 @@ rec {
           "static-tz" = [ "dep:jiff-static" ];
           "std" = [ "alloc" "log?/std" "serde_core?/std" ];
           "tz-fat" = [ "jiff-static?/tz-fat" ];
-          "tz-system" = [ "std" "dep:windows-sys" ];
+          "tz-system" = [ "std" "dep:windows-link" ];
           "tzdb-bundle-always" = [ "dep:jiff-tzdb" "alloc" ];
           "tzdb-bundle-platform" = [ "dep:jiff-tzdb-platform" "alloc" ];
           "tzdb-concatenated" = [ "std" ];
@@ -4546,9 +4536,9 @@ rec {
       };
       "jiff-static" = rec {
         crateName = "jiff-static";
-        version = "0.2.21";
+        version = "0.2.28";
         edition = "2021";
-        sha256 = "061qz1zyvp8bhvr58r9817hri6s338y8msnb0bg7yg463lhjnz51";
+        sha256 = "0irbhfh2f4i9w5l53jcmh6ssnhdd92wfy76978chgwnxilvk4bbq";
         procMacro = true;
         libName = "jiff_static";
         authors = [
@@ -4575,9 +4565,9 @@ rec {
       };
       "jiff-tzdb" = rec {
         crateName = "jiff-tzdb";
-        version = "0.1.5";
+        version = "0.1.6";
         edition = "2021";
-        sha256 = "1hm5xn3q092zac6apjy4492ddid473mwa0d64z5f5f95yyzix5v8";
+        sha256 = "0xihzlnnyk0xnrzpq4xcyjdcmy8xc3ychzb9ayjkh4vgha2fy069";
         libName = "jiff_tzdb";
         libPath = "lib.rs";
         authors = [
@@ -4628,14 +4618,25 @@ rec {
       };
       "js-sys" = rec {
         crateName = "js-sys";
-        version = "0.3.90";
+        version = "0.3.99";
         edition = "2021";
-        sha256 = "19m5qg024y5xanjrq5c6m1sx69nnzqw7ychnbgnx9xmka1j6zp0l";
+        sha256 = "04azrzsz91gr5s3z0ij36lz0kj9ry4lw3jz0mmbiwb251rsc8aql";
         libName = "js_sys";
         authors = [
           "The wasm-bindgen Developers"
         ];
         dependencies = [
+          {
+            name = "cfg-if";
+            packageId = "cfg-if";
+          }
+          {
+            name = "futures-util";
+            packageId = "futures-util";
+            optional = true;
+            usesDefaultFeatures = false;
+            features = [ "std" ];
+          }
           {
             name = "once_cell";
             packageId = "once_cell";
@@ -4649,15 +4650,16 @@ rec {
         ];
         features = {
           "default" = [ "std" "unsafe-eval" ];
-          "std" = [ "wasm-bindgen/std" ];
+          "futures-core-03-stream" = [ "dep:futures-util" "dep:futures-core" ];
+          "std" = [ "wasm-bindgen/std" "dep:futures-util" ];
         };
         resolvedDefaultFeatures = [ "default" "std" "unsafe-eval" ];
       };
       "json-patch" = rec {
         crateName = "json-patch";
-        version = "4.1.0";
+        version = "4.2.0";
         edition = "2021";
-        sha256 = "147yaxmv3i4s0bdna86rgwpmqh2507fn4ighfpplaiqkw8ay807k";
+        sha256 = "0wkv896d0pzq56i2kkl0giqpv117fwvhbpgs8iz85805w66l68bl";
         libName = "json_patch";
         authors = [
           "Ivan Dubrov <dubrov.ivan@gmail.com>"
@@ -4667,6 +4669,11 @@ rec {
             name = "jsonptr";
             packageId = "jsonptr";
           }
+          {
+            name = "schemars";
+            packageId = "schemars";
+            optional = true;
+          }
           {
             name = "serde";
             packageId = "serde";
@@ -4678,10 +4685,14 @@ rec {
           }
           {
             name = "thiserror";
-            packageId = "thiserror 1.0.69";
+            packageId = "thiserror 2.0.18";
           }
         ];
         devDependencies = [
+          {
+            name = "schemars";
+            packageId = "schemars";
+          }
           {
             name = "serde_json";
             packageId = "serde_json";
@@ -4693,7 +4704,7 @@ rec {
           "schemars" = [ "dep:schemars" ];
           "utoipa" = [ "dep:utoipa" ];
         };
-        resolvedDefaultFeatures = [ "default" "diff" ];
+        resolvedDefaultFeatures = [ "default" "diff" "schemars" ];
       };
       "jsonpath-rust" = rec {
         crateName = "jsonpath-rust";
@@ -4766,10 +4777,10 @@ rec {
       };
       "k8s-openapi" = rec {
         crateName = "k8s-openapi";
-        version = "0.27.0";
+        version = "0.27.1";
         edition = "2021";
-        links = "k8s-openapi-0.27.0";
-        sha256 = "038zxrklpni04rpaww9dr7v8ln8zj8p7mgdd68bx5l8sc7rxd9h5";
+        links = "k8s-openapi-0.27.1";
+        sha256 = "0pldsxbxd4ckq94p8rkck4s862w33gfns6rclxr5imcx47sjdcsi";
         libName = "k8s_openapi";
         authors = [
           "Arnav Singh <me@arnavion.dev>"
@@ -4819,8 +4830,8 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "7a5f0c3fbcd091340214a23f0607fcd4b4fcc152";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
           sha256 = "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk";
         };
         libName = "k8s_version";
@@ -4839,7 +4850,7 @@ rec {
           }
           {
             name = "snafu";
-            packageId = "snafu 0.9.0";
+            packageId = "snafu 0.9.1";
           }
         ];
         features = {
@@ -4848,6 +4859,53 @@ rec {
         };
         resolvedDefaultFeatures = [ "darling" ];
       };
+      "konst" = rec {
+        crateName = "konst";
+        version = "0.2.20";
+        edition = "2018";
+        sha256 = "1yyf1fhk28wbf1lqrga9as4cpfmpbry9a5vvdqyxgz14g3nk708j";
+        authors = [
+          "rodrimati1992 <rodrimatt1985@gmail.com>"
+        ];
+        dependencies = [
+          {
+            name = "konst_macro_rules";
+            packageId = "konst_macro_rules";
+          }
+        ];
+        features = {
+          "__ui" = [ "__test" "trybuild" "rust_latest_stable" ];
+          "const_generics" = [ "rust_1_51" ];
+          "constant_time_slice" = [ "rust_latest_stable" ];
+          "default" = [ "cmp" "parsing" ];
+          "deref_raw_in_fn" = [ "rust_1_56" ];
+          "konst_proc_macros" = [ "dep:konst_proc_macros" ];
+          "mut_refs" = [ "rust_latest_stable" "konst_macro_rules/mut_refs" ];
+          "nightly_mut_refs" = [ "mut_refs" "konst_macro_rules/nightly_mut_refs" ];
+          "parsing" = [ "parsing_no_proc" "konst_proc_macros" ];
+          "rust_1_51" = [ "konst_macro_rules/rust_1_51" ];
+          "rust_1_55" = [ "rust_1_51" "konst_macro_rules/rust_1_55" ];
+          "rust_1_56" = [ "rust_1_55" "konst_macro_rules/rust_1_56" ];
+          "rust_1_57" = [ "rust_1_56" "konst_macro_rules/rust_1_57" ];
+          "rust_1_61" = [ "rust_1_57" "konst_macro_rules/rust_1_61" ];
+          "rust_1_64" = [ "rust_1_61" ];
+          "rust_latest_stable" = [ "rust_1_64" ];
+          "trybuild" = [ "dep:trybuild" ];
+        };
+        resolvedDefaultFeatures = [ "rust_1_51" "rust_1_55" "rust_1_56" "rust_1_57" "rust_1_61" "rust_1_64" ];
+      };
+      "konst_macro_rules" = rec {
+        crateName = "konst_macro_rules";
+        version = "0.2.19";
+        edition = "2018";
+        sha256 = "0dswja0dqcww4x3fwjnirc0azv2n6cazn8yv0kddksd8awzkz4x4";
+        authors = [
+          "rodrimati1992 <rodrimatt1985@gmail.com>"
+        ];
+        features = {
+        };
+        resolvedDefaultFeatures = [ "rust_1_51" "rust_1_55" "rust_1_56" "rust_1_57" "rust_1_61" ];
+      };
       "kube" = rec {
         crateName = "kube";
         version = "3.1.0";
@@ -5322,7 +5380,7 @@ rec {
           }
           {
             name = "hashbrown";
-            packageId = "hashbrown";
+            packageId = "hashbrown 0.16.1";
           }
           {
             name = "hostname";
@@ -5424,9 +5482,9 @@ rec {
       };
       "libc" = rec {
         crateName = "libc";
-        version = "0.2.182";
+        version = "0.2.186";
         edition = "2021";
-        sha256 = "04k1w1mq9f4cxv520dbr5xw1i7xkbc9fcrvaggyjy25jdkdvl038";
+        sha256 = "0rnyhzjyqq9x56skkllbjzzzwym3r61lq3l4hqj64v71gw0r3av8";
         authors = [
           "The Rust Project Developers"
         ];
@@ -5440,10 +5498,10 @@ rec {
       };
       "libgit2-sys" = rec {
         crateName = "libgit2-sys";
-        version = "0.18.3+1.9.2";
+        version = "0.18.5+1.9.4";
         edition = "2021";
         links = "git2";
-        sha256 = "11rlbyihj3k35mnkxxz4yvsnlx33a4r9srl66c5vp08pp72arcy9";
+        sha256 = "18lwqnhy7qxg4iw24s1a0n7aj7qbnryry1iy0w32k4f1xbk6lp80";
         libName = "libgit2_sys";
         libPath = "lib.rs";
         authors = [
@@ -5501,10 +5559,10 @@ rec {
       };
       "libz-sys" = rec {
         crateName = "libz-sys";
-        version = "1.1.24";
+        version = "1.1.29";
         edition = "2018";
         links = "z";
-        sha256 = "0f8879301wxgljw8snkcix90p6qbm4inp3sqrsjq9b2svv5yjda7";
+        sha256 = "1n98kqya7a7a0cxf5n5z3g13rj7a1vqxynk2xc7bja1qfxbrdg45";
         libName = "libz_sys";
         authors = [
           "Alex Crichton <alex@alexcrichton.com>"
@@ -5543,9 +5601,9 @@ rec {
       };
       "litemap" = rec {
         crateName = "litemap";
-        version = "0.8.1";
+        version = "0.8.2";
         edition = "2021";
-        sha256 = "0xsy8pfp9s802rsj1bq2ys2kbk1g36w5dr3gkfip7gphb5x60wv3";
+        sha256 = "1w7628bc7wwcxc4n4s5kw0610xk06710nh2hn5kwwk2wa91z9nlj";
         authors = [
           "The ICU4X Project Developers"
         ];
@@ -5581,9 +5639,9 @@ rec {
       };
       "log" = rec {
         crateName = "log";
-        version = "0.4.29";
+        version = "0.4.31";
         edition = "2021";
-        sha256 = "15q8j9c8g5zpkcw0hnd6cf2z7fxqnvsjh3rw5mv5q10r83i34l2y";
+        sha256 = "0kq2fh6q2bjkrm8m6hj8kb7gxfd7cr7qbcpxd1lc1xq5rns30fqi";
         authors = [
           "The Rust Project Developers"
         ];
@@ -5637,9 +5695,9 @@ rec {
       };
       "memchr" = rec {
         crateName = "memchr";
-        version = "2.8.0";
+        version = "2.8.1";
         edition = "2021";
-        sha256 = "0y9zzxcqxvdqg6wyag7vc3h0blhdn7hkq164bxyx2vph8zs5ijpq";
+        sha256 = "1n448jx01h5z2xknj6x2dhxgr8s8fb717cf6vfqj5lmhkpj7m53b";
         authors = [
           "Andrew Gallant <jamslam@gmail.com>"
           "bluss"
@@ -5700,9 +5758,9 @@ rec {
       };
       "mio" = rec {
         crateName = "mio";
-        version = "1.1.1";
+        version = "1.2.1";
         edition = "2021";
-        sha256 = "1z2phpalqbdgihrcjp8y09l3kgq6309jnhnr6h11l9s7mnqcm6x6";
+        sha256 = "1nkggmrlnjs93w8rja4lvjj4aml1xqahgimv1h0p7d373kvhmg82";
         authors = [
           "Carl Lerche <me@carllerche.com>"
           "Thomas de Zeeuw <thomasdezeeuw@gmail.com>"
@@ -5712,17 +5770,7 @@ rec {
           {
             name = "libc";
             packageId = "libc";
-            target = { target, features }: ("hermit" == target."os" or null);
-          }
-          {
-            name = "libc";
-            packageId = "libc";
-            target = { target, features }: ("wasi" == target."os" or null);
-          }
-          {
-            name = "libc";
-            packageId = "libc";
-            target = { target, features }: (target."unix" or false);
+            target = { target, features }: ((target."unix" or false) || ("hermit" == target."os" or null) || ("wasi" == target."os" or null));
           }
           {
             name = "wasi";
@@ -5811,7 +5859,7 @@ rec {
           }
           {
             name = "rand";
-            packageId = "rand 0.8.5";
+            packageId = "rand 0.8.6";
             optional = true;
             usesDefaultFeatures = false;
           }
@@ -5830,7 +5878,7 @@ rec {
         devDependencies = [
           {
             name = "rand";
-            packageId = "rand 0.8.5";
+            packageId = "rand 0.8.6";
             features = [ "small_rng" ];
           }
         ];
@@ -5848,9 +5896,9 @@ rec {
       };
       "num-conv" = rec {
         crateName = "num-conv";
-        version = "0.2.0";
+        version = "0.2.2";
         edition = "2021";
-        sha256 = "0l4hj7lp8zbb9am4j3p7vlcv47y9bbazinvnxx9zjhiwkibyr5yg";
+        sha256 = "0hg4f9bwmy7cwpxdkm165dmkfc8jhkkayci234jsmi5ssb33j5sj";
         libName = "num_conv";
         authors = [
           "Jacob Pratt <jacob@jhpratt.dev>"
@@ -5944,9 +5992,9 @@ rec {
       };
       "once_cell" = rec {
         crateName = "once_cell";
-        version = "1.21.3";
+        version = "1.21.4";
         edition = "2021";
-        sha256 = "0b9x77lb9f1j6nqgf5aka4s2qj0nly176bpbrv6f9iakk5ff3xa2";
+        sha256 = "0l1v676wf71kjg2khch4dphwh1jp3291ffiymr2mvy1kxd5kwz4z";
         authors = [
           "Aleksey Kladov <aleksey.kladov@gmail.com>"
         ];
@@ -6136,9 +6184,9 @@ rec {
       };
       "opentelemetry-otlp" = rec {
         crateName = "opentelemetry-otlp";
-        version = "0.31.0";
+        version = "0.31.1";
         edition = "2021";
-        sha256 = "1gv3h75z8c0p9b85mbq7f1rgsi18wip1xlfa6g82lkfa5pdnc8vs";
+        sha256 = "07zp0b62b9dajnvvcd6j2ppw5zg7wp4ixka9z6fr3bxrrdmcss8z";
         libName = "opentelemetry_otlp";
         dependencies = [
           {
@@ -6250,6 +6298,9 @@ rec {
           "serde_json" = [ "dep:serde_json" ];
           "serialize" = [ "serde" "serde_json" ];
           "tls" = [ "tonic/tls-ring" ];
+          "tls-aws-lc" = [ "tonic/tls-aws-lc" ];
+          "tls-provider-agnostic" = [ "tonic/_tls-any" ];
+          "tls-ring" = [ "tonic/tls-ring" ];
           "tls-roots" = [ "tls" "tonic/tls-native-roots" ];
           "tls-webpki-roots" = [ "tls" "tonic/tls-webpki-roots" ];
           "tokio" = [ "dep:tokio" ];
@@ -6371,7 +6422,7 @@ rec {
           }
           {
             name = "rand";
-            packageId = "rand 0.9.2";
+            packageId = "rand 0.9.4";
             optional = true;
             usesDefaultFeatures = false;
             features = [ "std" "std_rng" "small_rng" "os_rng" "thread_rng" ];
@@ -6795,9 +6846,9 @@ rec {
       };
       "pin-project" = rec {
         crateName = "pin-project";
-        version = "1.1.10";
+        version = "1.1.13";
         edition = "2021";
-        sha256 = "12kadbnfm1f43cyadw9gsbyln1cy7vj764wz5c8wxaiza3filzv7";
+        sha256 = "09091qp946lpmjz4yp0xil1r5v4hgc91fi19dg5csayhdqrv4ri4";
         libName = "pin_project";
         dependencies = [
           {
@@ -6809,9 +6860,9 @@ rec {
       };
       "pin-project-internal" = rec {
         crateName = "pin-project-internal";
-        version = "1.1.10";
+        version = "1.1.13";
         edition = "2021";
-        sha256 = "0qgqzfl0f4lzaz7yl5llhbg97g68r15kljzihaw9wm64z17qx4bf";
+        sha256 = "12rzlh07i1sdgrvzj6wgkka5bjqyvbfsl8knq6qi7g16m7q9aqy9";
         procMacro = true;
         libName = "pin_project_internal";
         dependencies = [
@@ -6834,22 +6885,11 @@ rec {
       };
       "pin-project-lite" = rec {
         crateName = "pin-project-lite";
-        version = "0.2.16";
+        version = "0.2.17";
         edition = "2018";
-        sha256 = "16wzc7z7dfkf9bmjin22f5282783f6mdksnr0nv0j5ym5f9gyg1v";
+        sha256 = "1kfmwvs271si96zay4mm8887v5khw0c27jc9srw1a75ykvgj54x8";
         libName = "pin_project_lite";
 
-      };
-      "pin-utils" = rec {
-        crateName = "pin-utils";
-        version = "0.1.0";
-        edition = "2018";
-        sha256 = "117ir7vslsl2z1a7qzhws4pd01cg2d3338c47swjyvqv2n60v1wb";
-        libName = "pin_utils";
-        authors = [
-          "Josef Brandl <mail@josefbrandl.de>"
-        ];
-
       };
       "pkcs1" = rec {
         crateName = "pkcs1";
@@ -6921,9 +6961,9 @@ rec {
       };
       "pkg-config" = rec {
         crateName = "pkg-config";
-        version = "0.3.32";
+        version = "0.3.33";
         edition = "2018";
-        sha256 = "0k4h3gnzs94sjb2ix6jyksacs52cf1fanpwsmlhjnwrdnp8dppby";
+        sha256 = "17jnqmcbxsnwhg9gjf0nh6dj5k0x3hgwi3mb9krjnmfa9v435w8r";
         libName = "pkg_config";
         authors = [
           "Alex Crichton <alex@alexcrichton.com>"
@@ -6945,9 +6985,9 @@ rec {
       };
       "portable-atomic-util" = rec {
         crateName = "portable-atomic-util";
-        version = "0.2.5";
+        version = "0.2.7";
         edition = "2018";
-        sha256 = "1xcm0ia8756k6hdgafx4g3lx3fw0hvz2zqswq7c2sy58gxnvk7bs";
+        sha256 = "0616j0fhy6y71hyxg3n86f6hng0fmsc269s3wp4gl8ww4p8hd8f2";
         libName = "portable_atomic_util";
         dependencies = [
           {
@@ -6958,15 +6998,16 @@ rec {
           }
         ];
         features = {
+          "serde" = [ "dep:serde" ];
           "std" = [ "alloc" ];
         };
         resolvedDefaultFeatures = [ "alloc" ];
       };
       "potential_utf" = rec {
         crateName = "potential_utf";
-        version = "0.1.4";
+        version = "0.1.5";
         edition = "2021";
-        sha256 = "0xxg0pkfpq299wvwln409z4fk80rbv55phh3f1jhjajy5x1ljfdp";
+        sha256 = "0r0518fr32xbkgzqap509s3r60cr0iancsg9j1jgf37cyz7b20q1";
         authors = [
           "The ICU4X Project Developers"
         ];
@@ -7048,9 +7089,9 @@ rec {
       };
       "proc-macro-crate" = rec {
         crateName = "proc-macro-crate";
-        version = "3.4.0";
+        version = "3.5.0";
         edition = "2021";
-        sha256 = "10v9qi51n4phn1lrj5r94kjq7yhci9jrkqnn6wpan05yjsgb3711";
+        sha256 = "0kv1g1d1zjwxlgcaba2qlshzyy32j03xic8rskqlcr5mnblsfyz6";
         libName = "proc_macro_crate";
         authors = [
           "Bastian Köcher <git@kchr.de>"
@@ -7210,9 +7251,9 @@ rec {
       };
       "quote" = rec {
         crateName = "quote";
-        version = "1.0.44";
+        version = "1.0.45";
         edition = "2021";
-        sha256 = "1r7c7hxl66vz3q9qizgjhy77pdrrypqgk4ghc7260xvvfb7ypci1";
+        sha256 = "095rb5rg7pbnwdp6v8w5jw93wndwyijgci1b5lw8j1h5cscn3wj1";
         authors = [
           "David Tolnay <dtolnay@gmail.com>"
         ];
@@ -7241,11 +7282,11 @@ rec {
           "rustc-dep-of-std" = [ "core" ];
         };
       };
-      "rand 0.8.5" = rec {
+      "rand 0.8.6" = rec {
         crateName = "rand";
-        version = "0.8.5";
+        version = "0.8.6";
         edition = "2018";
-        sha256 = "013l6931nn7gkc23jz5mm3qdhf93jjf0fg64nz2lp4i51qd8vbrl";
+        sha256 = "12kd4rljn86m00rcaz4c1rcya4mb4gk5ig6i8xq00a8wjgxfr82w";
         authors = [
           "The Rand Project Developers"
           "The Rust Project Developers"
@@ -7267,22 +7308,19 @@ rec {
           "default" = [ "std" "std_rng" ];
           "getrandom" = [ "rand_core/getrandom" ];
           "libc" = [ "dep:libc" ];
-          "log" = [ "dep:log" ];
-          "packed_simd" = [ "dep:packed_simd" ];
           "rand_chacha" = [ "dep:rand_chacha" ];
           "serde" = [ "dep:serde" ];
           "serde1" = [ "serde" "rand_core/serde1" ];
-          "simd_support" = [ "packed_simd" ];
           "std" = [ "rand_core/std" "rand_chacha/std" "alloc" "getrandom" "libc" ];
           "std_rng" = [ "rand_chacha" ];
         };
         resolvedDefaultFeatures = [ "rand_chacha" "std_rng" ];
       };
-      "rand 0.9.2" = rec {
+      "rand 0.9.4" = rec {
         crateName = "rand";
-        version = "0.9.2";
+        version = "0.9.4";
         edition = "2021";
-        sha256 = "1lah73ainvrgl7brcxx0pwhpnqa3sm3qaj672034jz8i0q7pgckd";
+        sha256 = "1sknbxgs6nfg0nxdd7689lwbyr2i4vaswchrv4b34z8vpc3azia4";
         authors = [
           "The Rand Project Developers"
           "The Rust Project Developers"
@@ -7302,7 +7340,6 @@ rec {
         ];
         features = {
           "default" = [ "std" "std_rng" "os_rng" "small_rng" "thread_rng" ];
-          "log" = [ "dep:log" ];
           "os_rng" = [ "rand_core/os_rng" ];
           "serde" = [ "dep:serde" "rand_core/serde" ];
           "std" = [ "rand_core/std" "rand_chacha?/std" "alloc" ];
@@ -8177,9 +8214,9 @@ rec {
       };
       "rustls" = rec {
         crateName = "rustls";
-        version = "0.23.37";
+        version = "0.23.40";
         edition = "2021";
-        sha256 = "193k5h0wcih6ghvkrxyzwncivr1bd3a8yw3lzp13pzfcbz5jb03m";
+        sha256 = "12qnv3ag4wrw7aj8jng74kgrilpjm2b1rfcjaac8h691frccv1pg";
         dependencies = [
           {
             name = "log";
@@ -8246,9 +8283,9 @@ rec {
       };
       "rustls-native-certs" = rec {
         crateName = "rustls-native-certs";
-        version = "0.8.3";
+        version = "0.8.4";
         edition = "2021";
-        sha256 = "0qrajg2n90bcr3bcq6j95gjm7a9lirfkkdmjj32419dyyzan0931";
+        sha256 = "0kgazl8zc1sv63qg179bz96ilzh56lzfa5k92ji7d265f4kibdfs";
         libName = "rustls_native_certs";
         dependencies = [
           {
@@ -8277,9 +8314,9 @@ rec {
       };
       "rustls-pki-types" = rec {
         crateName = "rustls-pki-types";
-        version = "1.14.0";
+        version = "1.14.1";
         edition = "2021";
-        sha256 = "1p9zsgslvwzzkzhm6bqicffqndr4jpx67992b0vl0pi21a5hy15y";
+        sha256 = "1a9pr54y0f3qr97bxpd3ahjldq0gqdld0h799xbnwdzbwxx1k9rh";
         libName = "rustls_pki_types";
         dependencies = [
           {
@@ -8358,9 +8395,9 @@ rec {
       };
       "schannel" = rec {
         crateName = "schannel";
-        version = "0.1.28";
+        version = "0.1.29";
         edition = "2018";
-        sha256 = "1qb6s5gyxfz2inz753a4z3mc1d266mwvz0c5w7ppd3h44swq27c9";
+        sha256 = "0ffrzz5vf2s3gnzvphgb5gg8fqifvryl07qcf7q3x1scj3jbghci";
         authors = [
           "Steven Fackler <sfackler@gmail.com>"
           "Steffen Butzer <steffen.butzer@outlook.com>"
@@ -8656,9 +8693,9 @@ rec {
       };
       "semver" = rec {
         crateName = "semver";
-        version = "1.0.27";
-        edition = "2018";
-        sha256 = "1qmi3akfrnqc2hfkdgcxhld5bv961wbk8my3ascv5068mc5fnryp";
+        version = "1.0.28";
+        edition = "2021";
+        sha256 = "1kaimrpy876bcgi8bfj0qqfxk77zm9iz2zhn1hp9hj685z854y4a";
         authors = [
           "David Tolnay <dtolnay@gmail.com>"
         ];
@@ -8815,9 +8852,9 @@ rec {
       };
       "serde_json" = rec {
         crateName = "serde_json";
-        version = "1.0.149";
+        version = "1.0.150";
         edition = "2021";
-        sha256 = "11jdx4vilzrjjd1dpgy67x5lgzr0laplz30dhv75lnf5ffa07z43";
+        sha256 = "1ffgfhy9kndjnrz8lmy95pr758p2zk8dxv6yi99x0vkkni24w0g8";
         authors = [
           "Erick Tryzelaar <erick.tryzelaar@gmail.com>"
           "David Tolnay <dtolnay@gmail.com>"
@@ -9069,9 +9106,9 @@ rec {
       };
       "shlex" = rec {
         crateName = "shlex";
-        version = "1.3.0";
-        edition = "2015";
-        sha256 = "0r1y6bv26c1scpxvhg2cabimrmwgbp4p3wy6syj9n0c4s3q2znhg";
+        version = "2.0.1";
+        edition = "2018";
+        sha256 = "1fjsll1cd7d2bcpdij9kd6w62rpbc7qqzvydvs021vsmr1cxvypq";
         authors = [
           "comex <comexk@gmail.com>"
           "Fenhl <fenhl@fenhl.net>"
@@ -9139,9 +9176,9 @@ rec {
       };
       "simd-adler32" = rec {
         crateName = "simd-adler32";
-        version = "0.3.8";
+        version = "0.3.9";
         edition = "2018";
-        sha256 = "18lx2gdgislabbvlgw5q3j5ssrr77v8kmkrxaanp3liimp2sc873";
+        sha256 = "0532ysdwcvzyp2bwpk8qz0hijplcdwpssr5gy5r7qwqqy5z5qgbh";
         libName = "simd_adler32";
         authors = [
           "Marvin Countryman <me@maar.vin>"
@@ -9250,29 +9287,25 @@ rec {
         };
         resolvedDefaultFeatures = [ "alloc" "default" "rust_1_61" "rust_1_65" "std" ];
       };
-      "snafu 0.9.0" = rec {
+      "snafu 0.9.1" = rec {
         crateName = "snafu";
-        version = "0.9.0";
+        version = "0.9.1";
         edition = "2018";
-        sha256 = "1ii9r99x5qcn754m624yzgb9hzvkqkrcygf0aqh0pyb9dbnvrm6i";
+        sha256 = "08k5yfydxdlshivfhrdq9km8qn02r93q28gkyvazbqz2icr1586i";
         authors = [
           "Jake Goulding <jake.goulding@gmail.com>"
         ];
         dependencies = [
           {
             name = "snafu-derive";
-            packageId = "snafu-derive 0.9.0";
+            packageId = "snafu-derive 0.9.1";
           }
         ];
         features = {
-          "backtrace" = [ "dep:backtrace" ];
-          "backtraces-impl-backtrace-crate" = [ "backtrace" ];
+          "backtraces-impl-backtrace-crate" = [ "dep:backtrace" ];
           "default" = [ "std" "rust_1_81" ];
-          "futures" = [ "futures-core-crate" "pin-project" ];
-          "futures-core-crate" = [ "dep:futures-core-crate" ];
-          "futures-crate" = [ "dep:futures-crate" ];
-          "internal-dev-dependencies" = [ "futures-crate" ];
-          "pin-project" = [ "dep:pin-project" ];
+          "futures" = [ "dep:futures-core" "dep:pin-project" ];
+          "internal-dev-dependencies" = [ "dep:futures" ];
           "std" = [ "alloc" ];
           "unstable-provider-api" = [ "snafu-derive/unstable-provider-api" ];
         };
@@ -9340,11 +9373,11 @@ rec {
         };
         resolvedDefaultFeatures = [ "rust_1_61" ];
       };
-      "snafu-derive 0.9.0" = rec {
+      "snafu-derive 0.9.1" = rec {
         crateName = "snafu-derive";
-        version = "0.9.0";
+        version = "0.9.1";
         edition = "2018";
-        sha256 = "0h0x61kyj4fvilcr2nj02l85shw1ika64vq9brf2gyna662ln9al";
+        sha256 = "1nkfi7bis72pz3w7vb64m79w49qsv20sbf19jkd471vbhr83q42z";
         procMacro = true;
         libName = "snafu_derive";
         authors = [
@@ -9370,7 +9403,7 @@ rec {
             name = "syn";
             packageId = "syn 2.0.117";
             usesDefaultFeatures = false;
-            features = [ "clone-impls" "derive" "full" "parsing" "printing" "proc-macro" ];
+            features = [ "clone-impls" "derive" "full" "parsing" "printing" "proc-macro" "visit-mut" ];
           }
         ];
         features = {
@@ -9378,9 +9411,9 @@ rec {
       };
       "socket2" = rec {
         crateName = "socket2";
-        version = "0.6.2";
+        version = "0.6.4";
         edition = "2021";
-        sha256 = "1q073zkvz96h216mfz6niqk2kjqrgqv2va6zj34qh84zv4xamx46";
+        sha256 = "0ldyp5rhba15spwxj1n94xh7sjks1398c3vwpwkxkd1087nwzlaj";
         authors = [
           "Alex Crichton <alex@alexcrichton.com>"
           "Thomas de Zeeuw <thomasdezeeuw@gmail.com>"
@@ -9389,11 +9422,11 @@ rec {
           {
             name = "libc";
             packageId = "libc";
-            target = { target, features }: (target."unix" or false);
+            target = { target, features }: ((target."unix" or false) || ("wasi" == target."os" or null));
           }
           {
             name = "windows-sys";
-            packageId = "windows-sys 0.60.2";
+            packageId = "windows-sys 0.61.2";
             target = { target, features }: (target."windows" or false);
             features = [ "Win32_Foundation" "Win32_Networking_WinSock" "Win32_System_IO" "Win32_System_Threading" "Win32_System_WindowsProgramming" ];
           }
@@ -9478,8 +9511,8 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "7a5f0c3fbcd091340214a23f0607fcd4b4fcc152";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
           sha256 = "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk";
         };
         libName = "stackable_certs";
@@ -9516,7 +9549,7 @@ rec {
           }
           {
             name = "rand";
-            packageId = "rand 0.9.2";
+            packageId = "rand 0.9.4";
           }
           {
             name = "rand_core";
@@ -9538,7 +9571,7 @@ rec {
           }
           {
             name = "snafu";
-            packageId = "snafu 0.9.0";
+            packageId = "snafu 0.9.1";
           }
           {
             name = "stackable-shared";
@@ -9617,8 +9650,8 @@ rec {
             packageId = "indoc";
           }
           {
-            name = "product-config";
-            packageId = "product-config";
+            name = "java-properties";
+            packageId = "java-properties";
           }
           {
             name = "serde";
@@ -9635,7 +9668,7 @@ rec {
           }
           {
             name = "snafu";
-            packageId = "snafu 0.9.0";
+            packageId = "snafu 0.9.1";
           }
           {
             name = "stackable-operator";
@@ -9656,6 +9689,10 @@ rec {
             name = "tracing";
             packageId = "tracing";
           }
+          {
+            name = "xml";
+            packageId = "xml";
+          }
         ];
         buildDependencies = [
           {
@@ -9682,8 +9719,8 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "7a5f0c3fbcd091340214a23f0607fcd4b4fcc152";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
           sha256 = "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk";
         };
         libName = "stackable_operator";
@@ -9741,6 +9778,7 @@ rec {
           {
             name = "json-patch";
             packageId = "json-patch";
+            features = [ "schemars" ];
           }
           {
             name = "k8s-openapi";
@@ -9760,7 +9798,7 @@ rec {
           }
           {
             name = "rand";
-            packageId = "rand 0.9.2";
+            packageId = "rand 0.9.4";
           }
           {
             name = "regex";
@@ -9790,7 +9828,7 @@ rec {
           }
           {
             name = "snafu";
-            packageId = "snafu 0.9.0";
+            packageId = "snafu 0.9.1";
           }
           {
             name = "stackable-operator-derive";
@@ -9844,6 +9882,10 @@ rec {
             packageId = "url";
             features = [ "serde" ];
           }
+          {
+            name = "uuid";
+            packageId = "uuid";
+          }
         ];
         features = {
           "certs" = [ "dep:stackable-certs" ];
@@ -9862,8 +9904,8 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "7a5f0c3fbcd091340214a23f0607fcd4b4fcc152";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
           sha256 = "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk";
         };
         procMacro = true;
@@ -9897,8 +9939,8 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "7a5f0c3fbcd091340214a23f0607fcd4b4fcc152";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
           sha256 = "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk";
         };
         libName = "stackable_shared";
@@ -9943,7 +9985,7 @@ rec {
           }
           {
             name = "snafu";
-            packageId = "snafu 0.9.0";
+            packageId = "snafu 0.9.1";
           }
           {
             name = "strum";
@@ -9978,8 +10020,8 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "7a5f0c3fbcd091340214a23f0607fcd4b4fcc152";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
           sha256 = "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk";
         };
         libName = "stackable_telemetry";
@@ -10031,7 +10073,7 @@ rec {
           }
           {
             name = "snafu";
-            packageId = "snafu 0.9.0";
+            packageId = "snafu 0.9.1";
           }
           {
             name = "strum";
@@ -10088,8 +10130,8 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "7a5f0c3fbcd091340214a23f0607fcd4b4fcc152";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
           sha256 = "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk";
         };
         libName = "stackable_versioned";
@@ -10123,7 +10165,7 @@ rec {
           }
           {
             name = "snafu";
-            packageId = "snafu 0.9.0";
+            packageId = "snafu 0.9.1";
           }
           {
             name = "stackable-versioned-macros";
@@ -10138,8 +10180,8 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "7a5f0c3fbcd091340214a23f0607fcd4b4fcc152";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
           sha256 = "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk";
         };
         procMacro = true;
@@ -10206,8 +10248,8 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "7a5f0c3fbcd091340214a23f0607fcd4b4fcc152";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
           sha256 = "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk";
         };
         libName = "stackable_webhook";
@@ -10267,7 +10309,7 @@ rec {
           }
           {
             name = "rand";
-            packageId = "rand 0.9.2";
+            packageId = "rand 0.9.4";
           }
           {
             name = "serde";
@@ -10280,7 +10322,7 @@ rec {
           }
           {
             name = "snafu";
-            packageId = "snafu 0.9.0";
+            packageId = "snafu 0.9.1";
           }
           {
             name = "stackable-certs";
@@ -10410,6 +10452,16 @@ rec {
         };
         resolvedDefaultFeatures = [ "i128" ];
       };
+      "symlink" = rec {
+        crateName = "symlink";
+        version = "0.1.0";
+        edition = "2015";
+        sha256 = "02h1i0b81mxb4vns4xrvrfibpcvs7jqqav8p3yilwik8cv73r5x7";
+        authors = [
+          "Chris Morgan <me@chrismorgan.info>"
+        ];
+
+      };
       "syn 1.0.109" = rec {
         crateName = "syn";
         version = "1.0.109";
@@ -10750,9 +10802,9 @@ rec {
       };
       "tinystr" = rec {
         crateName = "tinystr";
-        version = "0.8.2";
+        version = "0.8.3";
         edition = "2021";
-        sha256 = "0sa8z88axdsf088hgw5p4xcyi6g3w3sgbb6qdp81bph9bk2fkls2";
+        sha256 = "0vfr8x285w6zsqhna0a9jyhylwiafb2kc8pj2qaqaahw48236cn8";
         authors = [
           "The ICU4X Project Developers"
         ];
@@ -10842,9 +10894,9 @@ rec {
       };
       "tokio" = rec {
         crateName = "tokio";
-        version = "1.49.0";
+        version = "1.52.3";
         edition = "2021";
-        sha256 = "11ix3pl03s0bp71q3wddrbf8xr0cpn47d7fzr6m42r3kswy918kj";
+        sha256 = "1zpzazypkg61sw91na1m85x5s4rsjym335fwwhwm1hcs70dz1iwg";
         authors = [
           "Tokio Contributors <team@tokio.rs>"
         ];
@@ -10860,6 +10912,12 @@ rec {
             optional = true;
             target = { target, features }: ((target."tokio_unstable" or false) && ("linux" == target."os" or null));
           }
+          {
+            name = "libc";
+            packageId = "libc";
+            optional = true;
+            target = { target, features }: ("wasi" == target."os" or null);
+          }
           {
             name = "libc";
             packageId = "libc";
@@ -10899,7 +10957,7 @@ rec {
             name = "socket2";
             packageId = "socket2";
             optional = true;
-            target = { target, features }: (!(builtins.elem "wasm" target."family"));
+            target = { target, features }: ((!(builtins.elem "wasm" target."family")) || (("wasi" == target."os" or null) && (!("p1" == target."env" or null))));
             features = [ "all" ];
           }
           {
@@ -10957,9 +11015,9 @@ rec {
       };
       "tokio-macros" = rec {
         crateName = "tokio-macros";
-        version = "2.6.0";
+        version = "2.7.0";
         edition = "2021";
-        sha256 = "19czvgliginbzyhhfbmj77wazqn2y8g27y2nirfajdlm41bphh5g";
+        sha256 = "15m4f37mdafs0gg36sh0rskm1i768lb7zmp8bw67kaxr3avnqniq";
         procMacro = true;
         libName = "tokio_macros";
         authors = [
@@ -11127,9 +11185,9 @@ rec {
       };
       "toml_datetime" = rec {
         crateName = "toml_datetime";
-        version = "0.7.5+spec-1.1.0";
-        edition = "2021";
-        sha256 = "0iqkgvgsxmszpai53dbip7sf2igic39s4dby29dbqf1h9bnwzqcj";
+        version = "1.1.1+spec-1.1.0";
+        edition = "2024";
+        sha256 = "1mws2mkkf46l7inn77azhm0vdwxngv9vsbhbl0ah33p2c9gzcr9i";
         dependencies = [
           {
             name = "serde_core";
@@ -11148,9 +11206,9 @@ rec {
       };
       "toml_edit" = rec {
         crateName = "toml_edit";
-        version = "0.23.10+spec-1.0.0";
-        edition = "2021";
-        sha256 = "0saj5c676j8a3sqaj9akkp09wambg8aflji4zblwwa70azvvkj44";
+        version = "0.25.12+spec-1.1.0";
+        edition = "2024";
+        sha256 = "1mx5paq837rjw7w51zprrjynk1vaig9yzxfqz9ac79jmd7f3w5fj";
         dependencies = [
           {
             name = "indexmap";
@@ -11183,9 +11241,9 @@ rec {
       };
       "toml_parser" = rec {
         crateName = "toml_parser";
-        version = "1.0.9+spec-1.1.0";
-        edition = "2021";
-        sha256 = "1i54qpvvcppy8ybdn9gssas81vfzq0kmgkcnxzhyf8w9w0al8bbh";
+        version = "1.1.2+spec-1.1.0";
+        edition = "2024";
+        sha256 = "09kmzc55a0j21whm290wlf5a8b18a0qc87a1s8sncrckc6wfkax2";
         dependencies = [
           {
             name = "winnow";
@@ -11203,9 +11261,9 @@ rec {
       };
       "tonic" = rec {
         crateName = "tonic";
-        version = "0.14.5";
-        edition = "2021";
-        sha256 = "1v4k7aa28m7722gz9qak2jiy7lis1ycm4fdmq63iip4m0qdcdizy";
+        version = "0.14.6";
+        edition = "2024";
+        sha256 = "1vs5ci6z6b9xhfsnx4s8qx6bqi1zzcrxncjp71147a0gqwc5aamc";
         authors = [
           "Lucio Franco <luciofranco14@gmail.com>"
         ];
@@ -11332,9 +11390,9 @@ rec {
       };
       "tonic-prost" = rec {
         crateName = "tonic-prost";
-        version = "0.14.5";
-        edition = "2021";
-        sha256 = "02fkg2bv87q0yds2wz3w0s7i1x6qcgbrl00dy6ipajdapfh7clx5";
+        version = "0.14.6";
+        edition = "2024";
+        sha256 = "184y40nf0iyzc5rg32ivgd88snv68sqy1kchynn55r1vhml9z12h";
         libName = "tonic_prost";
         authors = [
           "Lucio Franco <luciofranco14@gmail.com>"
@@ -11476,9 +11534,9 @@ rec {
       };
       "tower-http" = rec {
         crateName = "tower-http";
-        version = "0.6.8";
+        version = "0.6.11";
         edition = "2018";
-        sha256 = "1y514jwzbyrmrkbaajpwmss4rg0mak82k16d6588w9ncaffmbrnl";
+        sha256 = "0h08wjgs3hwnq11iwwzlmnabn1h4cl0fzd48svaccvqffkiggz2c";
         libName = "tower_http";
         authors = [
           "Tower Maintainers <team@tower-rs.com>"
@@ -11512,11 +11570,6 @@ rec {
             packageId = "http-body";
             optional = true;
           }
-          {
-            name = "iri-string";
-            packageId = "iri-string";
-            optional = true;
-          }
           {
             name = "mime";
             packageId = "mime";
@@ -11546,6 +11599,11 @@ rec {
             optional = true;
             usesDefaultFeatures = false;
           }
+          {
+            name = "url";
+            packageId = "url";
+            optional = true;
+          }
         ];
         devDependencies = [
           {
@@ -11567,35 +11625,33 @@ rec {
           }
         ];
         features = {
-          "async-compression" = [ "dep:async-compression" ];
           "auth" = [ "base64" "validate-request" ];
           "base64" = [ "dep:base64" ];
           "catch-panic" = [ "tracing" "futures-util/std" "dep:http-body" "dep:http-body-util" ];
-          "compression-br" = [ "async-compression/brotli" "futures-core" "dep:http-body" "tokio-util" "tokio" ];
-          "compression-deflate" = [ "async-compression/zlib" "futures-core" "dep:http-body" "tokio-util" "tokio" ];
+          "compression-br" = [ "dep:async-compression" "async-compression?/brotli" "futures-core" "dep:http-body" "tokio-util" "dep:tokio" ];
+          "compression-deflate" = [ "dep:async-compression" "async-compression?/zlib" "futures-core" "dep:http-body" "tokio-util" "dep:tokio" ];
           "compression-full" = [ "compression-br" "compression-deflate" "compression-gzip" "compression-zstd" ];
-          "compression-gzip" = [ "async-compression/gzip" "futures-core" "dep:http-body" "tokio-util" "tokio" ];
-          "compression-zstd" = [ "async-compression/zstd" "futures-core" "dep:http-body" "tokio-util" "tokio" ];
-          "decompression-br" = [ "async-compression/brotli" "futures-core" "dep:http-body" "dep:http-body-util" "tokio-util" "tokio" ];
-          "decompression-deflate" = [ "async-compression/zlib" "futures-core" "dep:http-body" "dep:http-body-util" "tokio-util" "tokio" ];
+          "compression-gzip" = [ "dep:async-compression" "async-compression?/gzip" "futures-core" "dep:http-body" "tokio-util" "dep:tokio" ];
+          "compression-zstd" = [ "dep:async-compression" "async-compression?/zstd" "futures-core" "dep:http-body" "tokio-util" "dep:tokio" ];
+          "decompression-br" = [ "dep:async-compression" "async-compression?/brotli" "futures-core" "dep:http-body" "dep:http-body-util" "tokio-util" "dep:tokio" ];
+          "decompression-deflate" = [ "dep:async-compression" "async-compression?/zlib" "futures-core" "dep:http-body" "dep:http-body-util" "tokio-util" "dep:tokio" ];
           "decompression-full" = [ "decompression-br" "decompression-deflate" "decompression-gzip" "decompression-zstd" ];
-          "decompression-gzip" = [ "async-compression/gzip" "futures-core" "dep:http-body" "dep:http-body-util" "tokio-util" "tokio" ];
-          "decompression-zstd" = [ "async-compression/zstd" "futures-core" "dep:http-body" "dep:http-body-util" "tokio-util" "tokio" ];
-          "follow-redirect" = [ "futures-util" "dep:http-body" "iri-string" "tower/util" ];
-          "fs" = [ "futures-core" "futures-util" "dep:http-body" "dep:http-body-util" "tokio/fs" "tokio-util/io" "tokio/io-util" "dep:http-range-header" "mime_guess" "mime" "percent-encoding" "httpdate" "set-status" "futures-util/alloc" "tracing" ];
-          "full" = [ "add-extension" "auth" "catch-panic" "compression-full" "cors" "decompression-full" "follow-redirect" "fs" "limit" "map-request-body" "map-response-body" "metrics" "normalize-path" "propagate-header" "redirect" "request-id" "sensitive-headers" "set-header" "set-status" "timeout" "trace" "util" "validate-request" ];
+          "decompression-gzip" = [ "dep:async-compression" "async-compression?/gzip" "futures-core" "dep:http-body" "dep:http-body-util" "tokio-util" "dep:tokio" ];
+          "decompression-zstd" = [ "dep:async-compression" "async-compression?/zstd" "futures-core" "dep:http-body" "dep:http-body-util" "tokio-util" "dep:tokio" ];
+          "follow-redirect" = [ "futures-util" "dep:http-body" "dep:url" "tower/util" ];
+          "fs" = [ "dep:tokio" "tokio?/fs" "tokio?/io-util" "futures-core" "futures-util" "dep:http-body" "dep:http-body-util" "tokio-util/io" "dep:http-range-header" "mime_guess" "mime" "percent-encoding" "httpdate" "set-status" "futures-util/alloc" ];
+          "full" = [ "add-extension" "auth" "catch-panic" "compression-full" "cors" "decompression-full" "follow-redirect" "fs" "limit" "map-request-body" "map-response-body" "metrics" "normalize-path" "on-early-drop" "propagate-header" "redirect" "request-id" "sensitive-headers" "set-header" "set-status" "timeout" "trace" "util" "validate-request" ];
           "futures-core" = [ "dep:futures-core" ];
           "futures-util" = [ "dep:futures-util" ];
           "httpdate" = [ "dep:httpdate" ];
-          "iri-string" = [ "dep:iri-string" ];
           "limit" = [ "dep:http-body" "dep:http-body-util" ];
-          "metrics" = [ "dep:http-body" "tokio/time" ];
+          "metrics" = [ "dep:http-body" "dep:tokio" "tokio?/time" ];
           "mime" = [ "dep:mime" ];
           "mime_guess" = [ "dep:mime_guess" ];
+          "on-early-drop" = [ "dep:http-body" ];
           "percent-encoding" = [ "dep:percent-encoding" ];
           "request-id" = [ "uuid" ];
-          "timeout" = [ "dep:http-body" "tokio/time" ];
-          "tokio" = [ "dep:tokio" ];
+          "timeout" = [ "dep:http-body" "dep:tokio" "tokio?/time" ];
           "tokio-util" = [ "dep:tokio-util" ];
           "tower" = [ "dep:tower" ];
           "trace" = [ "dep:http-body" "tracing" ];
@@ -11604,7 +11660,7 @@ rec {
           "uuid" = [ "dep:uuid" ];
           "validate-request" = [ "mime" ];
         };
-        resolvedDefaultFeatures = [ "auth" "base64" "default" "follow-redirect" "futures-util" "iri-string" "map-response-body" "mime" "tower" "trace" "tracing" "util" "validate-request" ];
+        resolvedDefaultFeatures = [ "auth" "base64" "default" "follow-redirect" "futures-util" "map-response-body" "mime" "tower" "trace" "tracing" "util" "validate-request" ];
       };
       "tower-layer" = rec {
         crateName = "tower-layer";
@@ -11677,9 +11733,9 @@ rec {
       };
       "tracing-appender" = rec {
         crateName = "tracing-appender";
-        version = "0.2.4";
+        version = "0.2.5";
         edition = "2018";
-        sha256 = "1bxf7xvsr89glbq174cx0b9pinaacbhlmc85y1ssniv2rq5lhvbq";
+        sha256 = "0g4a6q5s3wafid5lqw1ljzvh1nhk3a4zmb627fxv96dr7qcqc1h5";
         libName = "tracing_appender";
         authors = [
           "Zeki Sherif <zekshi@amazon.com>"
@@ -11690,6 +11746,10 @@ rec {
             name = "crossbeam-channel";
             packageId = "crossbeam-channel";
           }
+          {
+            name = "symlink";
+            packageId = "symlink";
+          }
           {
             name = "thiserror";
             packageId = "thiserror 2.0.18";
@@ -11911,9 +11971,9 @@ rec {
       };
       "tracing-subscriber" = rec {
         crateName = "tracing-subscriber";
-        version = "0.3.22";
+        version = "0.3.23";
         edition = "2018";
-        sha256 = "07hz575a0p1c2i4xw3gs3hkrykhndnkbfhyqdwjhvayx4ww18c1g";
+        sha256 = "06fkr0qhggvrs861d7f74pn3i3a10h5jsp4n70jj9ys5b675fzyb";
         libName = "tracing_subscriber";
         authors = [
           "Eliza Weisman <eliza@buoyant.io>"
@@ -12044,13 +12104,9 @@ rec {
       };
       "typenum" = rec {
         crateName = "typenum";
-        version = "1.19.0";
+        version = "1.20.1";
         edition = "2018";
-        sha256 = "1fw2mpbn2vmqan56j1b3fbpcdg80mz26fm53fs16bq5xcq84hban";
-        authors = [
-          "Paho Lurie-Gregg <paho@paholg.com>"
-          "Andre Bogus <bogusandre@gmail.com>"
-        ];
+        sha256 = "086s9ly0906kw5yw41249fba97w5zfxf03pyfwdkffvcprqfixdn";
         features = {
           "scale-info" = [ "dep:scale-info" ];
           "scale_info" = [ "scale-info/derive" ];
@@ -12083,9 +12139,9 @@ rec {
       };
       "unicode-segmentation" = rec {
         crateName = "unicode-segmentation";
-        version = "1.12.0";
+        version = "1.13.3";
         edition = "2018";
-        sha256 = "14qla2jfx74yyb9ds3d2mpwpa4l4lzb9z57c6d2ba511458z5k7n";
+        sha256 = "1a47zaq83p386r3baq4m018xd5q4q0grdg56i1x042dzn71x7xf6";
         libName = "unicode_segmentation";
         authors = [
           "kwantam <kwantam@gmail.com>"
@@ -12211,6 +12267,66 @@ rec {
         };
         resolvedDefaultFeatures = [ "default" ];
       };
+      "uuid" = rec {
+        crateName = "uuid";
+        version = "1.23.2";
+        edition = "2021";
+        sha256 = "1xy942s4z0bi8p3441wvd4ry3hx6ry1c7s6fgrr38462xqybhn6j";
+        authors = [
+          "Ashley Mannix<ashleymannix@live.com.au>"
+          "Dylan DPC<dylan.dpc@gmail.com>"
+          "Hunar Roop Kahlon<hunar.roop@gmail.com>"
+        ];
+        dependencies = [
+          {
+            name = "js-sys";
+            packageId = "js-sys";
+            optional = true;
+            usesDefaultFeatures = false;
+            target = { target, features }: (("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null)) && (builtins.elem "atomics" targetFeatures));
+          }
+          {
+            name = "wasm-bindgen";
+            packageId = "wasm-bindgen";
+            optional = true;
+            usesDefaultFeatures = false;
+            target = { target, features }: (("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null)));
+          }
+        ];
+        devDependencies = [
+          {
+            name = "wasm-bindgen";
+            packageId = "wasm-bindgen";
+            target = { target, features }: (("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null)));
+          }
+        ];
+        features = {
+          "arbitrary" = [ "dep:arbitrary" ];
+          "atomic" = [ "dep:atomic" ];
+          "borsh" = [ "dep:borsh" "dep:borsh-derive" ];
+          "bytemuck" = [ "dep:bytemuck" ];
+          "default" = [ "std" ];
+          "fast-rng" = [ "rng" "dep:rand" ];
+          "js" = [ "dep:wasm-bindgen" "dep:js-sys" ];
+          "md5" = [ "dep:md-5" ];
+          "rng" = [ "dep:getrandom" ];
+          "rng-getrandom" = [ "rng" "dep:getrandom" "uuid-rng-internal-lib" "uuid-rng-internal-lib/getrandom" ];
+          "rng-rand" = [ "rng" "dep:rand" "uuid-rng-internal-lib" "uuid-rng-internal-lib/rand" ];
+          "serde" = [ "dep:serde_core" ];
+          "sha1" = [ "dep:sha1_smol" ];
+          "slog" = [ "dep:slog" ];
+          "std" = [ "wasm-bindgen?/std" "js-sys?/std" ];
+          "uuid-rng-internal-lib" = [ "dep:uuid-rng-internal-lib" ];
+          "v1" = [ "atomic" ];
+          "v3" = [ "md5" ];
+          "v4" = [ "rng" ];
+          "v5" = [ "sha1" ];
+          "v6" = [ "atomic" ];
+          "v7" = [ "rng" ];
+          "zerocopy" = [ "dep:zerocopy" ];
+        };
+        resolvedDefaultFeatures = [ "default" "std" ];
+      };
       "valuable" = rec {
         crateName = "valuable";
         version = "0.1.1";
@@ -12278,9 +12394,9 @@ rec {
       };
       "wasip2" = rec {
         crateName = "wasip2";
-        version = "1.0.2+wasi-0.2.9";
+        version = "1.0.3+wasi-0.2.9";
         edition = "2021";
-        sha256 = "1xdw7v08jpfjdg94sp4lbdgzwa587m5ifpz6fpdnkh02kwizj5wm";
+        sha256 = "1mi3w855dz99xzjqc4aa8c9q5b6z1y5c963pkk4cvmr6vdr4c1i0";
         dependencies = [
           {
             name = "wit-bindgen";
@@ -12298,9 +12414,9 @@ rec {
       };
       "wasm-bindgen" = rec {
         crateName = "wasm-bindgen";
-        version = "0.2.113";
+        version = "0.2.122";
         edition = "2021";
-        sha256 = "1wpg101a5rqqilv4cz4929kbph9g15y4v2fvkbg7yjsrgy9jlwk0";
+        sha256 = "02flix96brsb2r1i3grnikii302iqpdm337kl3xv5lklz5v4bl1y";
         libName = "wasm_bindgen";
         authors = [
           "The wasm-bindgen Developers"
@@ -12349,62 +12465,37 @@ rec {
       };
       "wasm-bindgen-futures" = rec {
         crateName = "wasm-bindgen-futures";
-        version = "0.4.63";
+        version = "0.4.72";
         edition = "2021";
-        sha256 = "06j4hyxvlfvas7lhvgai44vh8izd59774wv5m8hla3kp1djz92ca";
+        sha256 = "03qb24gfr072rk8hb69glfdc8yhqqqq2rhy3j5i0ps8sk79dnwwl";
         libName = "wasm_bindgen_futures";
         authors = [
           "The wasm-bindgen Developers"
         ];
         dependencies = [
-          {
-            name = "cfg-if";
-            packageId = "cfg-if";
-          }
-          {
-            name = "futures-util";
-            packageId = "futures-util";
-            optional = true;
-            usesDefaultFeatures = false;
-            features = [ "std" ];
-          }
           {
             name = "js-sys";
             packageId = "js-sys";
             usesDefaultFeatures = false;
           }
-          {
-            name = "once_cell";
-            packageId = "once_cell";
-            usesDefaultFeatures = false;
-          }
           {
             name = "wasm-bindgen";
             packageId = "wasm-bindgen";
             usesDefaultFeatures = false;
           }
-          {
-            name = "web-sys";
-            packageId = "web-sys";
-            usesDefaultFeatures = false;
-            target = { target, features }: (builtins.elem "atomics" targetFeatures);
-            features = [ "MessageEvent" "Worker" ];
-          }
         ];
         features = {
           "default" = [ "std" ];
-          "futures-core" = [ "dep:futures-core" ];
-          "futures-core-03-stream" = [ "futures-core" ];
-          "futures-util" = [ "dep:futures-util" ];
-          "std" = [ "wasm-bindgen/std" "js-sys/std" "web-sys/std" "futures-util" ];
+          "futures-core-03-stream" = [ "js-sys/futures-core-03-stream" ];
+          "std" = [ "wasm-bindgen/std" "js-sys/std" ];
         };
-        resolvedDefaultFeatures = [ "default" "futures-util" "std" ];
+        resolvedDefaultFeatures = [ "default" "std" ];
       };
       "wasm-bindgen-macro" = rec {
         crateName = "wasm-bindgen-macro";
-        version = "0.2.113";
+        version = "0.2.122";
         edition = "2021";
-        sha256 = "0l1rbylzb1cs5i6ihmkgk8zic71pg563yadgqj8nnjq9jmiqrb0g";
+        sha256 = "1inyl55bvdifx7l60q9wl0ivmw7236jg7jqmcqpxhsx3knq52qci";
         procMacro = true;
         libName = "wasm_bindgen_macro";
         authors = [
@@ -12426,9 +12517,9 @@ rec {
       };
       "wasm-bindgen-macro-support" = rec {
         crateName = "wasm-bindgen-macro-support";
-        version = "0.2.113";
+        version = "0.2.122";
         edition = "2021";
-        sha256 = "0q4xmjmq1c80drv84hz9i9l7fj3yi0v2d11kh1r21p2rc77angxb";
+        sha256 = "0pjw5kc2mbfz59agk5l21kh4hxzp94rygdvsnr4f3z6b5hv4g419";
         libName = "wasm_bindgen_macro_support";
         authors = [
           "The wasm-bindgen Developers"
@@ -12462,10 +12553,10 @@ rec {
       };
       "wasm-bindgen-shared" = rec {
         crateName = "wasm-bindgen-shared";
-        version = "0.2.113";
+        version = "0.2.122";
         edition = "2021";
         links = "wasm_bindgen";
-        sha256 = "1d9vdqrzksbfv30bvwy4kc57l08di24775hxq1yshkc2vcdhj3ny";
+        sha256 = "0ds4mmfqvxwc5fp33hn0jblf0f6b4lghrd9mpkls66zic4n9p4ls";
         libName = "wasm_bindgen_shared";
         authors = [
           "The wasm-bindgen Developers"
@@ -12480,9 +12571,9 @@ rec {
       };
       "web-sys" = rec {
         crateName = "web-sys";
-        version = "0.3.90";
+        version = "0.3.99";
         edition = "2021";
-        sha256 = "15wsyn0bmhgf4nkgl23l9fzcqml029jxdlavcbw304lhrsscwpkh";
+        sha256 = "0dilfvl9jnyhi4skl6cry9wc300r693j0w82jjbq8yy3rx0i8qkd";
         libName = "web_sys";
         authors = [
           "The wasm-bindgen Developers"
@@ -12566,6 +12657,7 @@ rec {
           "CssStyleSheet" = [ "StyleSheet" ];
           "CssSupportsRule" = [ "CssConditionRule" "CssGroupingRule" "CssRule" ];
           "CssTransition" = [ "Animation" "EventTarget" ];
+          "CssViewTransitionRule" = [ "CssRule" ];
           "CustomEvent" = [ "Event" ];
           "DedicatedWorkerGlobalScope" = [ "EventTarget" "WorkerGlobalScope" ];
           "DelayNode" = [ "AudioNode" "EventTarget" ];
@@ -12972,7 +13064,7 @@ rec {
           "default" = [ "std" ];
           "std" = [ "wasm-bindgen/std" "js-sys/std" ];
         };
-        resolvedDefaultFeatures = [ "AbortController" "AbortSignal" "Blob" "BlobPropertyBag" "Event" "EventTarget" "File" "FormData" "Headers" "MessageEvent" "ReadableStream" "Request" "RequestCache" "RequestCredentials" "RequestInit" "RequestMode" "Response" "ServiceWorkerGlobalScope" "Window" "Worker" "WorkerGlobalScope" "default" "std" ];
+        resolvedDefaultFeatures = [ "AbortController" "AbortSignal" "Blob" "BlobPropertyBag" "EventTarget" "File" "FormData" "Headers" "ReadableStream" "Request" "RequestCache" "RequestCredentials" "RequestInit" "RequestMode" "Response" "ServiceWorkerGlobalScope" "Window" "WorkerGlobalScope" "default" "std" ];
       };
       "web-time" = rec {
         crateName = "web-time";
@@ -13146,7 +13238,7 @@ rec {
         dependencies = [
           {
             name = "windows-targets";
-            packageId = "windows-targets 0.52.6";
+            packageId = "windows-targets";
           }
         ];
         features = {
@@ -13382,271 +13474,6 @@ rec {
         };
         resolvedDefaultFeatures = [ "Win32" "Win32_Foundation" "Win32_System" "Win32_System_Threading" "default" ];
       };
-      "windows-sys 0.60.2" = rec {
-        crateName = "windows-sys";
-        version = "0.60.2";
-        edition = "2021";
-        sha256 = "1jrbc615ihqnhjhxplr2kw7rasrskv9wj3lr80hgfd42sbj01xgj";
-        libName = "windows_sys";
-        authors = [
-          "Microsoft"
-        ];
-        dependencies = [
-          {
-            name = "windows-targets";
-            packageId = "windows-targets 0.53.5";
-            usesDefaultFeatures = false;
-          }
-        ];
-        features = {
-          "Wdk" = [ "Win32_Foundation" ];
-          "Wdk_Devices" = [ "Wdk" ];
-          "Wdk_Devices_Bluetooth" = [ "Wdk_Devices" ];
-          "Wdk_Devices_HumanInterfaceDevice" = [ "Wdk_Devices" ];
-          "Wdk_Foundation" = [ "Wdk" ];
-          "Wdk_Graphics" = [ "Wdk" ];
-          "Wdk_Graphics_Direct3D" = [ "Wdk_Graphics" ];
-          "Wdk_NetworkManagement" = [ "Wdk" ];
-          "Wdk_NetworkManagement_Ndis" = [ "Wdk_NetworkManagement" ];
-          "Wdk_NetworkManagement_WindowsFilteringPlatform" = [ "Wdk_NetworkManagement" ];
-          "Wdk_Storage" = [ "Wdk" ];
-          "Wdk_Storage_FileSystem" = [ "Wdk_Storage" ];
-          "Wdk_Storage_FileSystem_Minifilters" = [ "Wdk_Storage_FileSystem" ];
-          "Wdk_System" = [ "Wdk" ];
-          "Wdk_System_IO" = [ "Wdk_System" ];
-          "Wdk_System_Memory" = [ "Wdk_System" ];
-          "Wdk_System_OfflineRegistry" = [ "Wdk_System" ];
-          "Wdk_System_Registry" = [ "Wdk_System" ];
-          "Wdk_System_SystemInformation" = [ "Wdk_System" ];
-          "Wdk_System_SystemServices" = [ "Wdk_System" ];
-          "Wdk_System_Threading" = [ "Wdk_System" ];
-          "Win32" = [ "Win32_Foundation" ];
-          "Win32_Data" = [ "Win32" ];
-          "Win32_Data_HtmlHelp" = [ "Win32_Data" ];
-          "Win32_Data_RightsManagement" = [ "Win32_Data" ];
-          "Win32_Devices" = [ "Win32" ];
-          "Win32_Devices_AllJoyn" = [ "Win32_Devices" ];
-          "Win32_Devices_Beep" = [ "Win32_Devices" ];
-          "Win32_Devices_BiometricFramework" = [ "Win32_Devices" ];
-          "Win32_Devices_Bluetooth" = [ "Win32_Devices" ];
-          "Win32_Devices_Cdrom" = [ "Win32_Devices" ];
-          "Win32_Devices_Communication" = [ "Win32_Devices" ];
-          "Win32_Devices_DeviceAndDriverInstallation" = [ "Win32_Devices" ];
-          "Win32_Devices_DeviceQuery" = [ "Win32_Devices" ];
-          "Win32_Devices_Display" = [ "Win32_Devices" ];
-          "Win32_Devices_Dvd" = [ "Win32_Devices" ];
-          "Win32_Devices_Enumeration" = [ "Win32_Devices" ];
-          "Win32_Devices_Enumeration_Pnp" = [ "Win32_Devices_Enumeration" ];
-          "Win32_Devices_Fax" = [ "Win32_Devices" ];
-          "Win32_Devices_HumanInterfaceDevice" = [ "Win32_Devices" ];
-          "Win32_Devices_Nfc" = [ "Win32_Devices" ];
-          "Win32_Devices_Nfp" = [ "Win32_Devices" ];
-          "Win32_Devices_PortableDevices" = [ "Win32_Devices" ];
-          "Win32_Devices_Properties" = [ "Win32_Devices" ];
-          "Win32_Devices_Pwm" = [ "Win32_Devices" ];
-          "Win32_Devices_Sensors" = [ "Win32_Devices" ];
-          "Win32_Devices_SerialCommunication" = [ "Win32_Devices" ];
-          "Win32_Devices_Tapi" = [ "Win32_Devices" ];
-          "Win32_Devices_Usb" = [ "Win32_Devices" ];
-          "Win32_Devices_WebServicesOnDevices" = [ "Win32_Devices" ];
-          "Win32_Foundation" = [ "Win32" ];
-          "Win32_Gaming" = [ "Win32" ];
-          "Win32_Globalization" = [ "Win32" ];
-          "Win32_Graphics" = [ "Win32" ];
-          "Win32_Graphics_Dwm" = [ "Win32_Graphics" ];
-          "Win32_Graphics_Gdi" = [ "Win32_Graphics" ];
-          "Win32_Graphics_GdiPlus" = [ "Win32_Graphics" ];
-          "Win32_Graphics_Hlsl" = [ "Win32_Graphics" ];
-          "Win32_Graphics_OpenGL" = [ "Win32_Graphics" ];
-          "Win32_Graphics_Printing" = [ "Win32_Graphics" ];
-          "Win32_Graphics_Printing_PrintTicket" = [ "Win32_Graphics_Printing" ];
-          "Win32_Management" = [ "Win32" ];
-          "Win32_Management_MobileDeviceManagementRegistration" = [ "Win32_Management" ];
-          "Win32_Media" = [ "Win32" ];
-          "Win32_Media_Audio" = [ "Win32_Media" ];
-          "Win32_Media_DxMediaObjects" = [ "Win32_Media" ];
-          "Win32_Media_KernelStreaming" = [ "Win32_Media" ];
-          "Win32_Media_Multimedia" = [ "Win32_Media" ];
-          "Win32_Media_Streaming" = [ "Win32_Media" ];
-          "Win32_Media_WindowsMediaFormat" = [ "Win32_Media" ];
-          "Win32_NetworkManagement" = [ "Win32" ];
-          "Win32_NetworkManagement_Dhcp" = [ "Win32_NetworkManagement" ];
-          "Win32_NetworkManagement_Dns" = [ "Win32_NetworkManagement" ];
-          "Win32_NetworkManagement_InternetConnectionWizard" = [ "Win32_NetworkManagement" ];
-          "Win32_NetworkManagement_IpHelper" = [ "Win32_NetworkManagement" ];
-          "Win32_NetworkManagement_Multicast" = [ "Win32_NetworkManagement" ];
-          "Win32_NetworkManagement_Ndis" = [ "Win32_NetworkManagement" ];
-          "Win32_NetworkManagement_NetBios" = [ "Win32_NetworkManagement" ];
-          "Win32_NetworkManagement_NetManagement" = [ "Win32_NetworkManagement" ];
-          "Win32_NetworkManagement_NetShell" = [ "Win32_NetworkManagement" ];
-          "Win32_NetworkManagement_NetworkDiagnosticsFramework" = [ "Win32_NetworkManagement" ];
-          "Win32_NetworkManagement_P2P" = [ "Win32_NetworkManagement" ];
-          "Win32_NetworkManagement_QoS" = [ "Win32_NetworkManagement" ];
-          "Win32_NetworkManagement_Rras" = [ "Win32_NetworkManagement" ];
-          "Win32_NetworkManagement_Snmp" = [ "Win32_NetworkManagement" ];
-          "Win32_NetworkManagement_WNet" = [ "Win32_NetworkManagement" ];
-          "Win32_NetworkManagement_WebDav" = [ "Win32_NetworkManagement" ];
-          "Win32_NetworkManagement_WiFi" = [ "Win32_NetworkManagement" ];
-          "Win32_NetworkManagement_WindowsConnectionManager" = [ "Win32_NetworkManagement" ];
-          "Win32_NetworkManagement_WindowsFilteringPlatform" = [ "Win32_NetworkManagement" ];
-          "Win32_NetworkManagement_WindowsFirewall" = [ "Win32_NetworkManagement" ];
-          "Win32_NetworkManagement_WindowsNetworkVirtualization" = [ "Win32_NetworkManagement" ];
-          "Win32_Networking" = [ "Win32" ];
-          "Win32_Networking_ActiveDirectory" = [ "Win32_Networking" ];
-          "Win32_Networking_Clustering" = [ "Win32_Networking" ];
-          "Win32_Networking_HttpServer" = [ "Win32_Networking" ];
-          "Win32_Networking_Ldap" = [ "Win32_Networking" ];
-          "Win32_Networking_WebSocket" = [ "Win32_Networking" ];
-          "Win32_Networking_WinHttp" = [ "Win32_Networking" ];
-          "Win32_Networking_WinInet" = [ "Win32_Networking" ];
-          "Win32_Networking_WinSock" = [ "Win32_Networking" ];
-          "Win32_Networking_WindowsWebServices" = [ "Win32_Networking" ];
-          "Win32_Security" = [ "Win32" ];
-          "Win32_Security_AppLocker" = [ "Win32_Security" ];
-          "Win32_Security_Authentication" = [ "Win32_Security" ];
-          "Win32_Security_Authentication_Identity" = [ "Win32_Security_Authentication" ];
-          "Win32_Security_Authorization" = [ "Win32_Security" ];
-          "Win32_Security_Credentials" = [ "Win32_Security" ];
-          "Win32_Security_Cryptography" = [ "Win32_Security" ];
-          "Win32_Security_Cryptography_Catalog" = [ "Win32_Security_Cryptography" ];
-          "Win32_Security_Cryptography_Certificates" = [ "Win32_Security_Cryptography" ];
-          "Win32_Security_Cryptography_Sip" = [ "Win32_Security_Cryptography" ];
-          "Win32_Security_Cryptography_UI" = [ "Win32_Security_Cryptography" ];
-          "Win32_Security_DiagnosticDataQuery" = [ "Win32_Security" ];
-          "Win32_Security_DirectoryServices" = [ "Win32_Security" ];
-          "Win32_Security_EnterpriseData" = [ "Win32_Security" ];
-          "Win32_Security_ExtensibleAuthenticationProtocol" = [ "Win32_Security" ];
-          "Win32_Security_Isolation" = [ "Win32_Security" ];
-          "Win32_Security_LicenseProtection" = [ "Win32_Security" ];
-          "Win32_Security_NetworkAccessProtection" = [ "Win32_Security" ];
-          "Win32_Security_WinTrust" = [ "Win32_Security" ];
-          "Win32_Security_WinWlx" = [ "Win32_Security" ];
-          "Win32_Storage" = [ "Win32" ];
-          "Win32_Storage_Cabinets" = [ "Win32_Storage" ];
-          "Win32_Storage_CloudFilters" = [ "Win32_Storage" ];
-          "Win32_Storage_Compression" = [ "Win32_Storage" ];
-          "Win32_Storage_DistributedFileSystem" = [ "Win32_Storage" ];
-          "Win32_Storage_FileHistory" = [ "Win32_Storage" ];
-          "Win32_Storage_FileSystem" = [ "Win32_Storage" ];
-          "Win32_Storage_Imapi" = [ "Win32_Storage" ];
-          "Win32_Storage_IndexServer" = [ "Win32_Storage" ];
-          "Win32_Storage_InstallableFileSystems" = [ "Win32_Storage" ];
-          "Win32_Storage_IscsiDisc" = [ "Win32_Storage" ];
-          "Win32_Storage_Jet" = [ "Win32_Storage" ];
-          "Win32_Storage_Nvme" = [ "Win32_Storage" ];
-          "Win32_Storage_OfflineFiles" = [ "Win32_Storage" ];
-          "Win32_Storage_OperationRecorder" = [ "Win32_Storage" ];
-          "Win32_Storage_Packaging" = [ "Win32_Storage" ];
-          "Win32_Storage_Packaging_Appx" = [ "Win32_Storage_Packaging" ];
-          "Win32_Storage_ProjectedFileSystem" = [ "Win32_Storage" ];
-          "Win32_Storage_StructuredStorage" = [ "Win32_Storage" ];
-          "Win32_Storage_Vhd" = [ "Win32_Storage" ];
-          "Win32_Storage_Xps" = [ "Win32_Storage" ];
-          "Win32_System" = [ "Win32" ];
-          "Win32_System_AddressBook" = [ "Win32_System" ];
-          "Win32_System_Antimalware" = [ "Win32_System" ];
-          "Win32_System_ApplicationInstallationAndServicing" = [ "Win32_System" ];
-          "Win32_System_ApplicationVerifier" = [ "Win32_System" ];
-          "Win32_System_ClrHosting" = [ "Win32_System" ];
-          "Win32_System_Com" = [ "Win32_System" ];
-          "Win32_System_Com_Marshal" = [ "Win32_System_Com" ];
-          "Win32_System_Com_StructuredStorage" = [ "Win32_System_Com" ];
-          "Win32_System_Com_Urlmon" = [ "Win32_System_Com" ];
-          "Win32_System_ComponentServices" = [ "Win32_System" ];
-          "Win32_System_Console" = [ "Win32_System" ];
-          "Win32_System_CorrelationVector" = [ "Win32_System" ];
-          "Win32_System_DataExchange" = [ "Win32_System" ];
-          "Win32_System_DeploymentServices" = [ "Win32_System" ];
-          "Win32_System_DeveloperLicensing" = [ "Win32_System" ];
-          "Win32_System_Diagnostics" = [ "Win32_System" ];
-          "Win32_System_Diagnostics_Ceip" = [ "Win32_System_Diagnostics" ];
-          "Win32_System_Diagnostics_Debug" = [ "Win32_System_Diagnostics" ];
-          "Win32_System_Diagnostics_Debug_Extensions" = [ "Win32_System_Diagnostics_Debug" ];
-          "Win32_System_Diagnostics_Etw" = [ "Win32_System_Diagnostics" ];
-          "Win32_System_Diagnostics_ProcessSnapshotting" = [ "Win32_System_Diagnostics" ];
-          "Win32_System_Diagnostics_ToolHelp" = [ "Win32_System_Diagnostics" ];
-          "Win32_System_Diagnostics_TraceLogging" = [ "Win32_System_Diagnostics" ];
-          "Win32_System_DistributedTransactionCoordinator" = [ "Win32_System" ];
-          "Win32_System_Environment" = [ "Win32_System" ];
-          "Win32_System_ErrorReporting" = [ "Win32_System" ];
-          "Win32_System_EventCollector" = [ "Win32_System" ];
-          "Win32_System_EventLog" = [ "Win32_System" ];
-          "Win32_System_EventNotificationService" = [ "Win32_System" ];
-          "Win32_System_GroupPolicy" = [ "Win32_System" ];
-          "Win32_System_HostCompute" = [ "Win32_System" ];
-          "Win32_System_HostComputeNetwork" = [ "Win32_System" ];
-          "Win32_System_HostComputeSystem" = [ "Win32_System" ];
-          "Win32_System_Hypervisor" = [ "Win32_System" ];
-          "Win32_System_IO" = [ "Win32_System" ];
-          "Win32_System_Iis" = [ "Win32_System" ];
-          "Win32_System_Ioctl" = [ "Win32_System" ];
-          "Win32_System_JobObjects" = [ "Win32_System" ];
-          "Win32_System_Js" = [ "Win32_System" ];
-          "Win32_System_Kernel" = [ "Win32_System" ];
-          "Win32_System_LibraryLoader" = [ "Win32_System" ];
-          "Win32_System_Mailslots" = [ "Win32_System" ];
-          "Win32_System_Mapi" = [ "Win32_System" ];
-          "Win32_System_Memory" = [ "Win32_System" ];
-          "Win32_System_Memory_NonVolatile" = [ "Win32_System_Memory" ];
-          "Win32_System_MessageQueuing" = [ "Win32_System" ];
-          "Win32_System_MixedReality" = [ "Win32_System" ];
-          "Win32_System_Ole" = [ "Win32_System" ];
-          "Win32_System_PasswordManagement" = [ "Win32_System" ];
-          "Win32_System_Performance" = [ "Win32_System" ];
-          "Win32_System_Performance_HardwareCounterProfiling" = [ "Win32_System_Performance" ];
-          "Win32_System_Pipes" = [ "Win32_System" ];
-          "Win32_System_Power" = [ "Win32_System" ];
-          "Win32_System_ProcessStatus" = [ "Win32_System" ];
-          "Win32_System_Recovery" = [ "Win32_System" ];
-          "Win32_System_Registry" = [ "Win32_System" ];
-          "Win32_System_RemoteDesktop" = [ "Win32_System" ];
-          "Win32_System_RemoteManagement" = [ "Win32_System" ];
-          "Win32_System_RestartManager" = [ "Win32_System" ];
-          "Win32_System_Restore" = [ "Win32_System" ];
-          "Win32_System_Rpc" = [ "Win32_System" ];
-          "Win32_System_Search" = [ "Win32_System" ];
-          "Win32_System_Search_Common" = [ "Win32_System_Search" ];
-          "Win32_System_SecurityCenter" = [ "Win32_System" ];
-          "Win32_System_Services" = [ "Win32_System" ];
-          "Win32_System_SetupAndMigration" = [ "Win32_System" ];
-          "Win32_System_Shutdown" = [ "Win32_System" ];
-          "Win32_System_StationsAndDesktops" = [ "Win32_System" ];
-          "Win32_System_SubsystemForLinux" = [ "Win32_System" ];
-          "Win32_System_SystemInformation" = [ "Win32_System" ];
-          "Win32_System_SystemServices" = [ "Win32_System" ];
-          "Win32_System_Threading" = [ "Win32_System" ];
-          "Win32_System_Time" = [ "Win32_System" ];
-          "Win32_System_TpmBaseServices" = [ "Win32_System" ];
-          "Win32_System_UserAccessLogging" = [ "Win32_System" ];
-          "Win32_System_Variant" = [ "Win32_System" ];
-          "Win32_System_VirtualDosMachines" = [ "Win32_System" ];
-          "Win32_System_WindowsProgramming" = [ "Win32_System" ];
-          "Win32_System_Wmi" = [ "Win32_System" ];
-          "Win32_UI" = [ "Win32" ];
-          "Win32_UI_Accessibility" = [ "Win32_UI" ];
-          "Win32_UI_ColorSystem" = [ "Win32_UI" ];
-          "Win32_UI_Controls" = [ "Win32_UI" ];
-          "Win32_UI_Controls_Dialogs" = [ "Win32_UI_Controls" ];
-          "Win32_UI_HiDpi" = [ "Win32_UI" ];
-          "Win32_UI_Input" = [ "Win32_UI" ];
-          "Win32_UI_Input_Ime" = [ "Win32_UI_Input" ];
-          "Win32_UI_Input_KeyboardAndMouse" = [ "Win32_UI_Input" ];
-          "Win32_UI_Input_Pointer" = [ "Win32_UI_Input" ];
-          "Win32_UI_Input_Touch" = [ "Win32_UI_Input" ];
-          "Win32_UI_Input_XboxController" = [ "Win32_UI_Input" ];
-          "Win32_UI_InteractionContext" = [ "Win32_UI" ];
-          "Win32_UI_Magnification" = [ "Win32_UI" ];
-          "Win32_UI_Shell" = [ "Win32_UI" ];
-          "Win32_UI_Shell_Common" = [ "Win32_UI_Shell" ];
-          "Win32_UI_Shell_PropertiesSystem" = [ "Win32_UI_Shell" ];
-          "Win32_UI_TabletPC" = [ "Win32_UI" ];
-          "Win32_UI_TextServices" = [ "Win32_UI" ];
-          "Win32_UI_WindowsAndMessaging" = [ "Win32_UI" ];
-          "Win32_Web" = [ "Win32" ];
-          "Win32_Web_InternetExplorer" = [ "Win32_Web" ];
-        };
-        resolvedDefaultFeatures = [ "Win32" "Win32_Foundation" "Win32_Networking" "Win32_Networking_WinSock" "Win32_System" "Win32_System_IO" "Win32_System_Threading" "Win32_System_WindowsProgramming" "default" ];
-      };
       "windows-sys 0.61.2" = rec {
         crateName = "windows-sys";
         version = "0.61.2";
@@ -13907,9 +13734,9 @@ rec {
           "Win32_Web" = [ "Win32" ];
           "Win32_Web_InternetExplorer" = [ "Win32_Web" ];
         };
-        resolvedDefaultFeatures = [ "Wdk" "Wdk_Foundation" "Wdk_Storage" "Wdk_Storage_FileSystem" "Wdk_System" "Wdk_System_IO" "Win32" "Win32_Foundation" "Win32_Networking" "Win32_Networking_WinSock" "Win32_Security" "Win32_Security_Authentication" "Win32_Security_Authentication_Identity" "Win32_Security_Credentials" "Win32_Security_Cryptography" "Win32_Storage" "Win32_Storage_FileSystem" "Win32_System" "Win32_System_Console" "Win32_System_Diagnostics" "Win32_System_Diagnostics_Debug" "Win32_System_IO" "Win32_System_LibraryLoader" "Win32_System_Memory" "Win32_System_Pipes" "Win32_System_SystemInformation" "Win32_System_SystemServices" "Win32_System_Threading" "Win32_System_Time" "Win32_System_WindowsProgramming" "default" ];
+        resolvedDefaultFeatures = [ "Wdk" "Wdk_Foundation" "Wdk_Storage" "Wdk_Storage_FileSystem" "Wdk_System" "Wdk_System_IO" "Win32" "Win32_Foundation" "Win32_Networking" "Win32_Networking_WinSock" "Win32_Security" "Win32_Security_Authentication" "Win32_Security_Authentication_Identity" "Win32_Security_Credentials" "Win32_Security_Cryptography" "Win32_Storage" "Win32_Storage_FileSystem" "Win32_System" "Win32_System_Console" "Win32_System_Diagnostics" "Win32_System_Diagnostics_Debug" "Win32_System_IO" "Win32_System_LibraryLoader" "Win32_System_Memory" "Win32_System_Pipes" "Win32_System_SystemInformation" "Win32_System_SystemServices" "Win32_System_Threading" "Win32_System_WindowsProgramming" "default" ];
       };
-      "windows-targets 0.52.6" = rec {
+      "windows-targets" = rec {
         crateName = "windows-targets";
         version = "0.52.6";
         edition = "2021";
@@ -13921,104 +13748,48 @@ rec {
         dependencies = [
           {
             name = "windows_aarch64_gnullvm";
-            packageId = "windows_aarch64_gnullvm 0.52.6";
+            packageId = "windows_aarch64_gnullvm";
             target = { target, features }: (target.name == "aarch64-pc-windows-gnullvm");
           }
           {
             name = "windows_aarch64_msvc";
-            packageId = "windows_aarch64_msvc 0.52.6";
+            packageId = "windows_aarch64_msvc";
             target = { target, features }: (("aarch64" == target."arch" or null) && ("msvc" == target."env" or null) && (!(target."windows_raw_dylib" or false)));
           }
           {
             name = "windows_i686_gnu";
-            packageId = "windows_i686_gnu 0.52.6";
+            packageId = "windows_i686_gnu";
             target = { target, features }: (("x86" == target."arch" or null) && ("gnu" == target."env" or null) && (!("llvm" == target."abi" or null)) && (!(target."windows_raw_dylib" or false)));
           }
           {
             name = "windows_i686_gnullvm";
-            packageId = "windows_i686_gnullvm 0.52.6";
+            packageId = "windows_i686_gnullvm";
             target = { target, features }: (target.name == "i686-pc-windows-gnullvm");
           }
           {
             name = "windows_i686_msvc";
-            packageId = "windows_i686_msvc 0.52.6";
+            packageId = "windows_i686_msvc";
             target = { target, features }: (("x86" == target."arch" or null) && ("msvc" == target."env" or null) && (!(target."windows_raw_dylib" or false)));
           }
           {
             name = "windows_x86_64_gnu";
-            packageId = "windows_x86_64_gnu 0.52.6";
+            packageId = "windows_x86_64_gnu";
             target = { target, features }: (("x86_64" == target."arch" or null) && ("gnu" == target."env" or null) && (!("llvm" == target."abi" or null)) && (!(target."windows_raw_dylib" or false)));
           }
           {
             name = "windows_x86_64_gnullvm";
-            packageId = "windows_x86_64_gnullvm 0.52.6";
+            packageId = "windows_x86_64_gnullvm";
             target = { target, features }: (target.name == "x86_64-pc-windows-gnullvm");
           }
           {
             name = "windows_x86_64_msvc";
-            packageId = "windows_x86_64_msvc 0.52.6";
+            packageId = "windows_x86_64_msvc";
             target = { target, features }: ((("x86_64" == target."arch" or null) || ("arm64ec" == target."arch" or null)) && ("msvc" == target."env" or null) && (!(target."windows_raw_dylib" or false)));
           }
         ];
 
       };
-      "windows-targets 0.53.5" = rec {
-        crateName = "windows-targets";
-        version = "0.53.5";
-        edition = "2021";
-        sha256 = "1wv9j2gv3l6wj3gkw5j1kr6ymb5q6dfc42yvydjhv3mqa7szjia9";
-        libName = "windows_targets";
-        dependencies = [
-          {
-            name = "windows-link";
-            packageId = "windows-link";
-            usesDefaultFeatures = false;
-            target = { target, features }: (target."windows_raw_dylib" or false);
-          }
-          {
-            name = "windows_aarch64_gnullvm";
-            packageId = "windows_aarch64_gnullvm 0.53.1";
-            target = { target, features }: (target.name == "aarch64-pc-windows-gnullvm");
-          }
-          {
-            name = "windows_aarch64_msvc";
-            packageId = "windows_aarch64_msvc 0.53.1";
-            target = { target, features }: (("aarch64" == target."arch" or null) && ("msvc" == target."env" or null) && (!(target."windows_raw_dylib" or false)));
-          }
-          {
-            name = "windows_i686_gnu";
-            packageId = "windows_i686_gnu 0.53.1";
-            target = { target, features }: (("x86" == target."arch" or null) && ("gnu" == target."env" or null) && (!("llvm" == target."abi" or null)) && (!(target."windows_raw_dylib" or false)));
-          }
-          {
-            name = "windows_i686_gnullvm";
-            packageId = "windows_i686_gnullvm 0.53.1";
-            target = { target, features }: (target.name == "i686-pc-windows-gnullvm");
-          }
-          {
-            name = "windows_i686_msvc";
-            packageId = "windows_i686_msvc 0.53.1";
-            target = { target, features }: (("x86" == target."arch" or null) && ("msvc" == target."env" or null) && (!(target."windows_raw_dylib" or false)));
-          }
-          {
-            name = "windows_x86_64_gnu";
-            packageId = "windows_x86_64_gnu 0.53.1";
-            target = { target, features }: (("x86_64" == target."arch" or null) && ("gnu" == target."env" or null) && (!("llvm" == target."abi" or null)) && (!(target."windows_raw_dylib" or false)));
-          }
-          {
-            name = "windows_x86_64_gnullvm";
-            packageId = "windows_x86_64_gnullvm 0.53.1";
-            target = { target, features }: (target.name == "x86_64-pc-windows-gnullvm");
-          }
-          {
-            name = "windows_x86_64_msvc";
-            packageId = "windows_x86_64_msvc 0.53.1";
-            target = { target, features }: ((("x86_64" == target."arch" or null) || ("arm64ec" == target."arch" or null)) && ("msvc" == target."env" or null) && (!(target."windows_raw_dylib" or false)));
-          }
-        ];
-
-      };
-      "windows_aarch64_gnullvm 0.52.6" = rec {
+      "windows_aarch64_gnullvm" = rec {
         crateName = "windows_aarch64_gnullvm";
         version = "0.52.6";
         edition = "2021";
@@ -14028,14 +13799,7 @@ rec {
         ];
 
       };
-      "windows_aarch64_gnullvm 0.53.1" = rec {
-        crateName = "windows_aarch64_gnullvm";
-        version = "0.53.1";
-        edition = "2021";
-        sha256 = "0lqvdm510mka9w26vmga7hbkmrw9glzc90l4gya5qbxlm1pl3n59";
-
-      };
-      "windows_aarch64_msvc 0.52.6" = rec {
+      "windows_aarch64_msvc" = rec {
         crateName = "windows_aarch64_msvc";
         version = "0.52.6";
         edition = "2021";
@@ -14045,14 +13809,7 @@ rec {
         ];
 
       };
-      "windows_aarch64_msvc 0.53.1" = rec {
-        crateName = "windows_aarch64_msvc";
-        version = "0.53.1";
-        edition = "2021";
-        sha256 = "01jh2adlwx043rji888b22whx4bm8alrk3khjpik5xn20kl85mxr";
-
-      };
-      "windows_i686_gnu 0.52.6" = rec {
+      "windows_i686_gnu" = rec {
         crateName = "windows_i686_gnu";
         version = "0.52.6";
         edition = "2021";
@@ -14062,14 +13819,7 @@ rec {
         ];
 
       };
-      "windows_i686_gnu 0.53.1" = rec {
-        crateName = "windows_i686_gnu";
-        version = "0.53.1";
-        edition = "2021";
-        sha256 = "18wkcm82ldyg4figcsidzwbg1pqd49jpm98crfz0j7nqd6h6s3ln";
-
-      };
-      "windows_i686_gnullvm 0.52.6" = rec {
+      "windows_i686_gnullvm" = rec {
         crateName = "windows_i686_gnullvm";
         version = "0.52.6";
         edition = "2021";
@@ -14079,14 +13829,7 @@ rec {
         ];
 
       };
-      "windows_i686_gnullvm 0.53.1" = rec {
-        crateName = "windows_i686_gnullvm";
-        version = "0.53.1";
-        edition = "2021";
-        sha256 = "030qaxqc4salz6l4immfb6sykc6gmhyir9wzn2w8mxj8038mjwzs";
-
-      };
-      "windows_i686_msvc 0.52.6" = rec {
+      "windows_i686_msvc" = rec {
         crateName = "windows_i686_msvc";
         version = "0.52.6";
         edition = "2021";
@@ -14096,14 +13839,7 @@ rec {
         ];
 
       };
-      "windows_i686_msvc 0.53.1" = rec {
-        crateName = "windows_i686_msvc";
-        version = "0.53.1";
-        edition = "2021";
-        sha256 = "1hi6scw3mn2pbdl30ji5i4y8vvspb9b66l98kkz350pig58wfyhy";
-
-      };
-      "windows_x86_64_gnu 0.52.6" = rec {
+      "windows_x86_64_gnu" = rec {
         crateName = "windows_x86_64_gnu";
         version = "0.52.6";
         edition = "2021";
@@ -14113,14 +13849,7 @@ rec {
         ];
 
       };
-      "windows_x86_64_gnu 0.53.1" = rec {
-        crateName = "windows_x86_64_gnu";
-        version = "0.53.1";
-        edition = "2021";
-        sha256 = "16d4yiysmfdlsrghndr97y57gh3kljkwhfdbcs05m1jasz6l4f4w";
-
-      };
-      "windows_x86_64_gnullvm 0.52.6" = rec {
+      "windows_x86_64_gnullvm" = rec {
         crateName = "windows_x86_64_gnullvm";
         version = "0.52.6";
         edition = "2021";
@@ -14130,14 +13859,7 @@ rec {
         ];
 
       };
-      "windows_x86_64_gnullvm 0.53.1" = rec {
-        crateName = "windows_x86_64_gnullvm";
-        version = "0.53.1";
-        edition = "2021";
-        sha256 = "1qbspgv4g3q0vygkg8rnql5c6z3caqv38japiynyivh75ng1gyhg";
-
-      };
-      "windows_x86_64_msvc 0.52.6" = rec {
+      "windows_x86_64_msvc" = rec {
         crateName = "windows_x86_64_msvc";
         version = "0.52.6";
         edition = "2021";
@@ -14146,19 +13868,12 @@ rec {
           "Microsoft"
         ];
 
-      };
-      "windows_x86_64_msvc 0.53.1" = rec {
-        crateName = "windows_x86_64_msvc";
-        version = "0.53.1";
-        edition = "2021";
-        sha256 = "0l6npq76vlq4ksn4bwsncpr8508mk0gmznm6wnhjg95d19gzzfyn";
-
       };
       "winnow" = rec {
         crateName = "winnow";
-        version = "0.7.14";
+        version = "1.0.3";
         edition = "2021";
-        sha256 = "0a88ahjqhyn2ln1yplq2xsigm09kxqkdkkk2c2mfxkbzszln8lss";
+        sha256 = "1wajycd3krn6h699vydjv7hm0ll5l31p899qzpk59y2is74y34h5";
         dependencies = [
           {
             name = "memchr";
@@ -14168,38 +13883,42 @@ rec {
           }
         ];
         features = {
+          "ascii" = [ "parser" ];
+          "binary" = [ "parser" ];
           "debug" = [ "std" "dep:anstream" "dep:anstyle" "dep:is_terminal_polyfill" "dep:terminal_size" ];
-          "default" = [ "std" ];
+          "default" = [ "std" "ascii" "binary" ];
           "simd" = [ "dep:memchr" ];
           "std" = [ "alloc" "memchr?/std" ];
-          "unstable-doc" = [ "alloc" "std" "simd" "unstable-recover" ];
+          "unstable-doc" = [ "alloc" "std" "ascii" "binary" "simd" "unstable-recover" ];
+          "unstable-recover" = [ "parser" ];
         };
-        resolvedDefaultFeatures = [ "alloc" "default" "std" ];
+        resolvedDefaultFeatures = [ "alloc" "ascii" "binary" "default" "parser" "std" ];
       };
       "wit-bindgen" = rec {
         crateName = "wit-bindgen";
-        version = "0.51.0";
+        version = "0.57.1";
         edition = "2024";
-        sha256 = "19fazgch8sq5cvjv3ynhhfh5d5x08jq2pkw8jfb05vbcyqcr496p";
+        sha256 = "0vjk2jb593ri9k1aq4iqs2si9mrw5q46wxnn78im7hm7hx799gqy";
         libName = "wit_bindgen";
         authors = [
           "Alex Crichton <alex@alexcrichton.com>"
         ];
         features = {
-          "async" = [ "std" "wit-bindgen-rust-macro?/async" ];
-          "async-spawn" = [ "async" "dep:futures" ];
+          "async-spawn" = [ "async" "dep:futures" "std" ];
           "bitflags" = [ "dep:bitflags" ];
-          "default" = [ "macros" "realloc" "async" "std" "bitflags" ];
+          "default" = [ "macros" "realloc" "async" "std" "bitflags" "macro-string" ];
+          "futures-stream" = [ "async" "dep:futures" ];
           "inter-task-wakeup" = [ "async" ];
+          "macro-string" = [ "wit-bindgen-rust-macro?/macro-string" ];
           "macros" = [ "dep:wit-bindgen-rust-macro" ];
           "rustc-dep-of-std" = [ "dep:core" "dep:alloc" ];
         };
       };
       "writeable" = rec {
         crateName = "writeable";
-        version = "0.6.2";
+        version = "0.6.3";
         edition = "2021";
-        sha256 = "1fg08y97n6vk7l0rnjggw3xyrii6dcqg54wqaxldrlk98zdy1pcy";
+        sha256 = "1i54d13h9bpap2hf13xcry1s4lxh7ap3923g8f3c0grd7c9fbyhz";
         authors = [
           "The ICU4X Project Developers"
         ];
@@ -14266,9 +13985,9 @@ rec {
       };
       "xml" = rec {
         crateName = "xml";
-        version = "1.2.1";
+        version = "1.3.0";
         edition = "2021";
-        sha256 = "0ak4k990faralbli5a0rb8kvwihccb2rp0r94d4azfy94a6lkamq";
+        sha256 = "128s58qhq8whrx90zbw8r5algr7lakgbf7mn05jfk234rbjqavv3";
         authors = [
           "Vladimir Matveev <vmatveev@citrine.cc>"
           "Kornel (https://github.com/kornelski)"
@@ -14277,9 +13996,9 @@ rec {
       };
       "yoke" = rec {
         crateName = "yoke";
-        version = "0.8.1";
+        version = "0.8.2";
         edition = "2021";
-        sha256 = "0m29dm0bf5iakxgma0bj6dbmc3b8qi9b1vaw9sa76kdqmz3fbmkj";
+        sha256 = "1jprcs7a98a5whvfs6r3jvfh1nnfp6zyijl7y4ywmn88lzywbs5b";
         authors = [
           "Manish Goregaokar <manishsmail@gmail.com>"
         ];
@@ -14312,9 +14031,9 @@ rec {
       };
       "yoke-derive" = rec {
         crateName = "yoke-derive";
-        version = "0.8.1";
+        version = "0.8.2";
         edition = "2021";
-        sha256 = "0pbyja133jnng4mrhimzdq4a0y26421g734ybgz8wsgbfhl0andn";
+        sha256 = "13l5y5sz4lqm7rmyakjbh6vwgikxiql51xfff9hq2j485hk4r16y";
         procMacro = true;
         libName = "yoke_derive";
         authors = [
@@ -14343,9 +14062,9 @@ rec {
       };
       "zerocopy" = rec {
         crateName = "zerocopy";
-        version = "0.8.40";
+        version = "0.8.50";
         edition = "2021";
-        sha256 = "1r9j2mlb54q1l9pgall3mk0gg6cprhdncvbbgsgxnxmmj3jcd2d7";
+        sha256 = "1laahnfxs4qyfb1fdf5nbb2qfshi72b1hbi0ffp2zy2m1r7ms1iv";
         authors = [
           "Joshua Liebow-Feeser <joshlf@google.com>"
           "Jack Wrenn <jswrenn@amazon.com>"
@@ -14379,9 +14098,9 @@ rec {
       };
       "zerocopy-derive" = rec {
         crateName = "zerocopy-derive";
-        version = "0.8.40";
+        version = "0.8.50";
         edition = "2021";
-        sha256 = "0lsrhg5nvf0c40z644a014l2nrvh7xw0ff3i9744k9vif2d4hp7n";
+        sha256 = "0fdnr9qslx1hbn2i9rsvy9s95mychfy2vj90ajsjm2basccinqqb";
         procMacro = true;
         libName = "zerocopy_derive";
         authors = [
@@ -14414,11 +14133,11 @@ rec {
       };
       "zerofrom" = rec {
         crateName = "zerofrom";
-        version = "0.1.6";
+        version = "0.1.8";
         edition = "2021";
-        sha256 = "19dyky67zkjichsb7ykhv0aqws3q0jfvzww76l66c19y6gh45k2h";
+        sha256 = "0wjjdj7gdmd0iq91gzkxl7dlv0nhkk80l4bmdpzh3a1yh48mmh0f";
         authors = [
-          "Manish Goregaokar <manishsmail@gmail.com>"
+          "The ICU4X Project Developers"
         ];
         dependencies = [
           {
@@ -14436,9 +14155,9 @@ rec {
       };
       "zerofrom-derive" = rec {
         crateName = "zerofrom-derive";
-        version = "0.1.6";
+        version = "0.1.7";
         edition = "2021";
-        sha256 = "00l5niw7c1b0lf1vhvajpjmcnbdp2vn96jg4nmkhq2db0rp5s7np";
+        sha256 = "18c4wsnznhdxx6m80piil1lbyszdiwsshgjrybqcm4b6qic22lqi";
         procMacro = true;
         libName = "zerofrom_derive";
         authors = [
@@ -14517,9 +14236,9 @@ rec {
       };
       "zerotrie" = rec {
         crateName = "zerotrie";
-        version = "0.2.3";
+        version = "0.2.4";
         edition = "2021";
-        sha256 = "0lbqznlqazmrwwzslw0ci7p3pqxykrbfhq29npj0gmb2amxc2n9a";
+        sha256 = "1gr0pkcn3qsr6in6iixqyp0vbzwf2j1jzyvh7yl2yydh3p9m548g";
         authors = [
           "The ICU4X Project Developers"
         ];
@@ -14544,7 +14263,9 @@ rec {
           }
         ];
         features = {
+          "alloc" = [ "zerovec?/alloc" ];
           "databake" = [ "dep:databake" "zerovec?/databake" ];
+          "dense" = [ "dep:zerovec" ];
           "litemap" = [ "dep:litemap" "alloc" ];
           "serde" = [ "dep:serde_core" "dep:litemap" "alloc" "litemap/serde" "zerovec?/serde" ];
           "yoke" = [ "dep:yoke" ];
@@ -14555,9 +14276,9 @@ rec {
       };
       "zerovec" = rec {
         crateName = "zerovec";
-        version = "0.11.5";
+        version = "0.11.6";
         edition = "2021";
-        sha256 = "00m0p47k2g9mkv505hky5xh3r6ps7v8qc0dy4pspg542jj972a3c";
+        sha256 = "0fdjsy6b31q9i0d73sl7xjd12xadbwi45lkpfgqnmasrqg5i3ych";
         authors = [
           "The ICU4X Project Developers"
         ];
@@ -14580,11 +14301,20 @@ rec {
             usesDefaultFeatures = false;
           }
         ];
+        devDependencies = [
+          {
+            name = "yoke";
+            packageId = "yoke";
+            usesDefaultFeatures = false;
+            features = [ "derive" ];
+          }
+        ];
         features = {
           "alloc" = [ "serde?/alloc" ];
           "databake" = [ "dep:databake" ];
           "derive" = [ "dep:zerovec-derive" ];
           "hashmap" = [ "dep:twox-hash" "alloc" ];
+          "schemars" = [ "dep:schemars" "alloc" ];
           "serde" = [ "dep:serde" ];
           "yoke" = [ "dep:yoke" ];
         };
@@ -14592,9 +14322,9 @@ rec {
       };
       "zerovec-derive" = rec {
         crateName = "zerovec-derive";
-        version = "0.11.2";
+        version = "0.11.3";
         edition = "2021";
-        sha256 = "1wsig4h5j7a1scd5hrlnragnazjny9qjc44hancb6p6a76ay7p7a";
+        sha256 = "0m85qj92mmfvhjra6ziqky5b1p4kcmp5069k7kfadp5hr8jw8pb2";
         procMacro = true;
         libName = "zerovec_derive";
         authors = [
diff --git a/crate-hashes.json b/crate-hashes.json
index 86f2b840..5564a89e 100644
--- a/crate-hashes.json
+++ b/crate-hashes.json
@@ -1,12 +1,12 @@
 {
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.111.1#k8s-version@0.1.3": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.111.1#stackable-certs@0.4.0": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.111.1#stackable-operator-derive@0.3.1": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.111.1#stackable-operator@0.111.1": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.111.1#stackable-shared@0.1.0": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.111.1#stackable-telemetry@0.6.3": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.111.1#stackable-versioned-macros@0.10.0": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.111.1#stackable-versioned@0.10.0": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.111.1#stackable-webhook@0.9.1": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#k8s-version@0.1.3": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-certs@0.4.0": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-operator-derive@0.3.1": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-operator@0.111.1": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-shared@0.1.0": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-telemetry@0.6.3": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-versioned-macros@0.10.0": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-versioned@0.10.0": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-webhook@0.9.1": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
   "git+https://github.com/stackabletech/product-config.git?tag=0.8.0#product-config@0.8.0": "1dz70kapm2wdqcr7ndyjji0lhsl98bsq95gnb2lw487wf6yr7987"
 }
\ No newline at end of file
diff --git a/deploy/helm/hbase-operator/configs/properties.yaml b/deploy/helm/hbase-operator/configs/properties.yaml
index c3840065..9bd8c3b2 100644
--- a/deploy/helm/hbase-operator/configs/properties.yaml
+++ b/deploy/helm/hbase-operator/configs/properties.yaml
@@ -2,270 +2,4 @@
 version: 0.1.0
 spec:
   units: []
-
-properties:
-
-  #################################################################################################
-  # security.properties
-  #################################################################################################
-
-  - property:
-      propertyNames:
-        - name: "networkaddress.cache.ttl"
-          kind:
-            type: "file"
-            file: "security.properties"
-      datatype:
-        type: "integer"
-        min: "0"
-      recommendedValues:
-        - fromVersion: "0.0.0"
-          value: "5"
-      roles:
-        - name: "master"
-          required: true
-      asOfVersion: "0.0.0"
-      comment: "master - TTL for successfully resolved domain names."
-      description: "master - TTL for successfully resolved domain names."
-
-  - property:
-      propertyNames:
-        - name: "networkaddress.cache.ttl"
-          kind:
-            type: "file"
-            file: "security.properties"
-      datatype:
-        type: "integer"
-        min: "0"
-      recommendedValues:
-        - fromVersion: "0.0.0"
-          value: "10"
-      roles:
-        - name: "regionserver"
-          required: true
-      asOfVersion: "0.0.0"
-      comment: "regionserver - TTL for successfully resolved domain names."
-      description: "regionserver - TTL for successfully resolved domain names."
-
-  - property:
-      propertyNames:
-        - name: "networkaddress.cache.ttl"
-          kind:
-            type: "file"
-            file: "security.properties"
-      datatype:
-        type: "integer"
-        min: "0"
-      recommendedValues:
-        - fromVersion: "0.0.0"
-          value: "30"
-      roles:
-        - name: "restserver"
-          required: true
-      asOfVersion: "0.0.0"
-      comment: "restserver - TTL for successfully resolved domain names."
-      description: "restserver - TTL for successfully resolved domain names."
-
-  - property:
-      propertyNames:
-        - name: "networkaddress.cache.negative.ttl"
-          kind:
-            type: "file"
-            file: "security.properties"
-      datatype:
-        type: "integer"
-        min: "0"
-      recommendedValues:
-        - fromVersion: "0.0.0"
-          value: "0"
-      roles:
-        - name: "master"
-          required: true
-      asOfVersion: "0.0.0"
-      comment: "master - TTL for domain names that cannot be resolved."
-      description: "master - TTL for domain names that cannot be resolved."
-
-  - property:
-      propertyNames:
-        - name: "networkaddress.cache.negative.ttl"
-          kind:
-            type: "file"
-            file: "security.properties"
-      datatype:
-        type: "integer"
-        min: "0"
-      recommendedValues:
-        - fromVersion: "0.0.0"
-          value: "0"
-      roles:
-        - name: "regionserver"
-          required: true
-      asOfVersion: "0.0.0"
-      comment: "regionserver - TTL for domain names that cannot be resolved."
-      description: "regionserver - TTL for domain names that cannot be resolved."
-
-  - property:
-      propertyNames:
-        - name: "networkaddress.cache.negative.ttl"
-          kind:
-            type: "file"
-            file: "security.properties"
-      datatype:
-        type: "integer"
-        min: "0"
-      recommendedValues:
-        - fromVersion: "0.0.0"
-          value: "0"
-      roles:
-        - name: "restserver"
-          required: true
-      asOfVersion: "0.0.0"
-      comment: "restserver - TTL for domain names that cannot be resolved."
-      description: "restserver - TTL for domain names that cannot be resolved."
-
-
-  #################################################################################################
-  # hbase-env.sh
-  #################################################################################################
-
-  - property: &hbaseManagesZk
-      propertyNames:
-        - name: "HBASE_MANAGES_ZK"
-          kind:
-            type: "file"
-            file: "hbase-env.sh"
-      datatype:
-        type: "bool"
-      defaultValues:
-        - fromVersion: "0.0.0"
-          value: "true"
-      recommendedValues:
-        - fromVersion: "0.0.0"
-          value: "false"
-      roles:
-        - name: "master"
-          required: false
-        - name: "regionserver"
-          required: false
-        - name: "restserver"
-          required: false
-      asOfVersion: "0.0.0"
-      description: "This variable tells HBase whether to start/stop the ZooKeeper ensemble servers as part of HBase start/stop."
-  - property: &hbaseOpts
-      propertyNames:
-        - name: "HBASE_OPTS"
-          kind:
-            type: "file"
-            file: "hbase-env.sh"
-      datatype:
-        type: "string"
-      defaultValues:
-        - fromVersion: "0.0.0"
-          value: ""
-      recommendedValues:
-        - fromVersion: "0.0.0"
-          value: ""
-      roles:
-        - name: "master"
-          required: false
-        - name: "regionserver"
-          required: false
-        - name: "restserver"
-          required: false
-      asOfVersion: "0.0.0"
-      description: "This variable allows to pass VM options to HBase."
-
-  #################################################################################################
-  # hbase-site.xml
-  #################################################################################################
-
-  - property: &hbaseClusterDistributed
-      propertyNames:
-        - name: "hbase.cluster.distributed"
-          kind:
-            type: "file"
-            file: "hbase-site.xml"
-      datatype:
-        type: "bool"
-      defaultValues:
-        - fromVersion: "0.0.0"
-          value: "false"
-      recommendedValues:
-        - fromVersion: "0.0.0"
-          value: "true"
-      roles:
-        - name: "master"
-          required: false
-        - name: "regionserver"
-          required: false
-        - name: "restserver"
-          required: false
-      asOfVersion: "0.0.0"
-      description: "The mode the cluster will be in. Possible values are false for standalone mode and true for distributed mode. If false, startup will run all HBase and ZooKeeper daemons together in the one JVM."
-
-  - property: &hbaseRootdir
-      propertyNames:
-        - name: "hbase.rootdir"
-          kind:
-            type: "file"
-            file: "hbase-site.xml"
-      datatype:
-        type: "string"
-      defaultValues:
-        - fromVersion: "0.0.0"
-          value: "/hbase"
-      roles:
-        - name: "master"
-          required: true
-        - name: "regionserver"
-          required: true # this can be false (only required for master) - kept for compatibility (avoid restarts)
-        - name: "restserver"
-          required: true # this can be false (only required for master) - kept for compatibility (avoid restarts)
-      asOfVersion: "0.0.0"
-      description: "The directory shared by region servers and into which HBase persists. The URL should be 'fully-qualified' to include the filesystem scheme. For example, to specify the HDFS directory '/hbase' where the HDFS instance's namenode is running at namenode.example.org on port 9000, set this value to: hdfs://namenode.example.org:9000/hbase. By default, we write to whatever ${hbase.tmp.dir} is set too -- usually /tmp -- so change this configuration or else all data will be lost on machine restart."
-
-  - property: &hbaseZookeeperQuorum
-      propertyNames:
-        - name: "hbase.zookeeper.quorum"
-          kind:
-            type: "file"
-            file: "hbase-site.xml"
-      datatype:
-        type: "string"
-      defaultValues:
-        - fromVersion: "0.0.0"
-          value: "127.0.0.1"
-      roles:
-        - name: "master"
-          required: false
-        - name: "regionserver"
-          required: false
-        - name: "restserver"
-          required: false
-      asOfVersion: "0.0.0"
-      description: "Comma separated list of servers in the ZooKeeper ensemble (This config. should have been named hbase.zookeeper.ensemble). For example, \"host1.mydomain.com,host2.mydomain.com,host3.mydomain.com\". By default this is set to localhost for local and pseudo-distributed modes of operation. For a fully-distributed setup, this should be set to a full list of ZooKeeper ensemble servers. If HBASE_MANAGES_ZK is set in hbase-env.sh this is the list of servers which hbase will start/stop ZooKeeper on as part of cluster start/stop. Client-side, we will take this list of ensemble members and put it together with the hbase.zookeeper.property.clientPort config. and pass it into zookeeper constructor as the connectString parameter."
-
-  #################################################################################################
-  # hdfs-site.xml
-  #################################################################################################
-
-  - property: &hdfsConfig
-      propertyNames:
-        - name: "content"
-          kind:
-            type: "file"
-            file: "hbase-site.xml"
-      datatype:
-        type: "string"
-      defaultValues:
-        - fromVersion: "0.0.0"
-          value: ""
-      roles:
-        - name: "master"
-          required: false
-        - name: "regionserver"
-          required: false
-        - name: "restserver"
-          required: false
-      asOfVersion: "0.0.0"
-      description: "The HDFS configuration file"
+properties: []
diff --git a/extra/crds.yaml b/extra/crds.yaml
index fc3180bb..80a33e12 100644
--- a/extra/crds.yaml
+++ b/extra/crds.yaml
@@ -494,53 +494,58 @@ spec:
                     properties:
                       hbase-env.sh:
                         additionalProperties:
+                          nullable: true
                           type: string
+                        default: {}
                         description: |-
                           Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                           This is backwards-compatible with the existing flat key-value YAML format
                           used by `HashMap<String, String>`.
-                        nullable: true
                         type: object
                       hbase-site.xml:
                         additionalProperties:
+                          nullable: true
                           type: string
+                        default: {}
                         description: |-
                           Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                           This is backwards-compatible with the existing flat key-value YAML format
                           used by `HashMap<String, String>`.
-                        nullable: true
                         type: object
                       security.properties:
                         additionalProperties:
+                          nullable: true
                           type: string
+                        default: {}
                         description: |-
                           Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                           This is backwards-compatible with the existing flat key-value YAML format
                           used by `HashMap<String, String>`.
-                        nullable: true
                         type: object
                       ssl-client.xml:
                         additionalProperties:
+                          nullable: true
                           type: string
+                        default: {}
                         description: |-
                           Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                           This is backwards-compatible with the existing flat key-value YAML format
                           used by `HashMap<String, String>`.
-                        nullable: true
                         type: object
                       ssl-server.xml:
                         additionalProperties:
+                          nullable: true
                           type: string
+                        default: {}
                         description: |-
                           Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                           This is backwards-compatible with the existing flat key-value YAML format
                           used by `HashMap<String, String>`.
-                        nullable: true
                         type: object
                     type: object
                   envOverrides:
@@ -934,53 +939,58 @@ spec:
                           properties:
                             hbase-env.sh:
                               additionalProperties:
+                                nullable: true
                                 type: string
+                              default: {}
                               description: |-
                                 Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                                 This is backwards-compatible with the existing flat key-value YAML format
                                 used by `HashMap<String, String>`.
-                              nullable: true
                               type: object
                             hbase-site.xml:
                               additionalProperties:
+                                nullable: true
                                 type: string
+                              default: {}
                               description: |-
                                 Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                                 This is backwards-compatible with the existing flat key-value YAML format
                                 used by `HashMap<String, String>`.
-                              nullable: true
                               type: object
                             security.properties:
                               additionalProperties:
+                                nullable: true
                                 type: string
+                              default: {}
                               description: |-
                                 Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                                 This is backwards-compatible with the existing flat key-value YAML format
                                 used by `HashMap<String, String>`.
-                              nullable: true
                               type: object
                             ssl-client.xml:
                               additionalProperties:
+                                nullable: true
                                 type: string
+                              default: {}
                               description: |-
                                 Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                                 This is backwards-compatible with the existing flat key-value YAML format
                                 used by `HashMap<String, String>`.
-                              nullable: true
                               type: object
                             ssl-server.xml:
                               additionalProperties:
+                                nullable: true
                                 type: string
+                              default: {}
                               description: |-
                                 Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                                 This is backwards-compatible with the existing flat key-value YAML format
                                 used by `HashMap<String, String>`.
-                              nullable: true
                               type: object
                           type: object
                         envOverrides:
@@ -1397,53 +1407,58 @@ spec:
                     properties:
                       hbase-env.sh:
                         additionalProperties:
+                          nullable: true
                           type: string
+                        default: {}
                         description: |-
                           Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                           This is backwards-compatible with the existing flat key-value YAML format
                           used by `HashMap<String, String>`.
-                        nullable: true
                         type: object
                       hbase-site.xml:
                         additionalProperties:
+                          nullable: true
                           type: string
+                        default: {}
                         description: |-
                           Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                           This is backwards-compatible with the existing flat key-value YAML format
                           used by `HashMap<String, String>`.
-                        nullable: true
                         type: object
                       security.properties:
                         additionalProperties:
+                          nullable: true
                           type: string
+                        default: {}
                         description: |-
                           Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                           This is backwards-compatible with the existing flat key-value YAML format
                           used by `HashMap<String, String>`.
-                        nullable: true
                         type: object
                       ssl-client.xml:
                         additionalProperties:
+                          nullable: true
                           type: string
+                        default: {}
                         description: |-
                           Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                           This is backwards-compatible with the existing flat key-value YAML format
                           used by `HashMap<String, String>`.
-                        nullable: true
                         type: object
                       ssl-server.xml:
                         additionalProperties:
+                          nullable: true
                           type: string
+                        default: {}
                         description: |-
                           Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                           This is backwards-compatible with the existing flat key-value YAML format
                           used by `HashMap<String, String>`.
-                        nullable: true
                         type: object
                     type: object
                   envOverrides:
@@ -1873,53 +1888,58 @@ spec:
                           properties:
                             hbase-env.sh:
                               additionalProperties:
+                                nullable: true
                                 type: string
+                              default: {}
                               description: |-
                                 Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                                 This is backwards-compatible with the existing flat key-value YAML format
                                 used by `HashMap<String, String>`.
-                              nullable: true
                               type: object
                             hbase-site.xml:
                               additionalProperties:
+                                nullable: true
                                 type: string
+                              default: {}
                               description: |-
                                 Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                                 This is backwards-compatible with the existing flat key-value YAML format
                                 used by `HashMap<String, String>`.
-                              nullable: true
                               type: object
                             security.properties:
                               additionalProperties:
+                                nullable: true
                                 type: string
+                              default: {}
                               description: |-
                                 Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                                 This is backwards-compatible with the existing flat key-value YAML format
                                 used by `HashMap<String, String>`.
-                              nullable: true
                               type: object
                             ssl-client.xml:
                               additionalProperties:
+                                nullable: true
                                 type: string
+                              default: {}
                               description: |-
                                 Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                                 This is backwards-compatible with the existing flat key-value YAML format
                                 used by `HashMap<String, String>`.
-                              nullable: true
                               type: object
                             ssl-server.xml:
                               additionalProperties:
+                                nullable: true
                                 type: string
+                              default: {}
                               description: |-
                                 Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                                 This is backwards-compatible with the existing flat key-value YAML format
                                 used by `HashMap<String, String>`.
-                              nullable: true
                               type: object
                           type: object
                         envOverrides:
@@ -2286,53 +2306,58 @@ spec:
                     properties:
                       hbase-env.sh:
                         additionalProperties:
+                          nullable: true
                           type: string
+                        default: {}
                         description: |-
                           Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                           This is backwards-compatible with the existing flat key-value YAML format
                           used by `HashMap<String, String>`.
-                        nullable: true
                         type: object
                       hbase-site.xml:
                         additionalProperties:
+                          nullable: true
                           type: string
+                        default: {}
                         description: |-
                           Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                           This is backwards-compatible with the existing flat key-value YAML format
                           used by `HashMap<String, String>`.
-                        nullable: true
                         type: object
                       security.properties:
                         additionalProperties:
+                          nullable: true
                           type: string
+                        default: {}
                         description: |-
                           Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                           This is backwards-compatible with the existing flat key-value YAML format
                           used by `HashMap<String, String>`.
-                        nullable: true
                         type: object
                       ssl-client.xml:
                         additionalProperties:
+                          nullable: true
                           type: string
+                        default: {}
                         description: |-
                           Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                           This is backwards-compatible with the existing flat key-value YAML format
                           used by `HashMap<String, String>`.
-                        nullable: true
                         type: object
                       ssl-server.xml:
                         additionalProperties:
+                          nullable: true
                           type: string
+                        default: {}
                         description: |-
                           Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                           This is backwards-compatible with the existing flat key-value YAML format
                           used by `HashMap<String, String>`.
-                        nullable: true
                         type: object
                     type: object
                   envOverrides:
@@ -2726,53 +2751,58 @@ spec:
                           properties:
                             hbase-env.sh:
                               additionalProperties:
+                                nullable: true
                                 type: string
+                              default: {}
                               description: |-
                                 Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                                 This is backwards-compatible with the existing flat key-value YAML format
                                 used by `HashMap<String, String>`.
-                              nullable: true
                               type: object
                             hbase-site.xml:
                               additionalProperties:
+                                nullable: true
                                 type: string
+                              default: {}
                               description: |-
                                 Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                                 This is backwards-compatible with the existing flat key-value YAML format
                                 used by `HashMap<String, String>`.
-                              nullable: true
                               type: object
                             security.properties:
                               additionalProperties:
+                                nullable: true
                                 type: string
+                              default: {}
                               description: |-
                                 Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                                 This is backwards-compatible with the existing flat key-value YAML format
                                 used by `HashMap<String, String>`.
-                              nullable: true
                               type: object
                             ssl-client.xml:
                               additionalProperties:
+                                nullable: true
                                 type: string
+                              default: {}
                               description: |-
                                 Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                                 This is backwards-compatible with the existing flat key-value YAML format
                                 used by `HashMap<String, String>`.
-                              nullable: true
                               type: object
                             ssl-server.xml:
                               additionalProperties:
+                                nullable: true
                                 type: string
+                              default: {}
                               description: |-
                                 Flat key-value overrides for `*.properties`, Hadoop XML, etc.
 
                                 This is backwards-compatible with the existing flat key-value YAML format
                                 used by `HashMap<String, String>`.
-                              nullable: true
                               type: object
                           type: object
                         envOverrides:

From 90dfbcdd908877aa60259f71eee0316c13e48c6f Mon Sep 17 00:00:00 2001
From: Malte Sander <malte.sander.it@gmail.com>
Date: Wed, 3 Jun 2026 19:28:49 +0200
Subject: [PATCH 09/21] fix: change paramter order & fmt

---
 .../src/controller/build/config_map.rs        | 29 ++++++++++---------
 .../controller/build/properties/hbase_env.rs  |  5 +---
 .../controller/build/properties/hbase_site.rs |  4 +--
 .../controller/build/properties/ssl_server.rs |  5 +---
 .../src/controller/validate.rs                | 11 ++++---
 rust/operator-binary/src/discovery.rs         |  2 +-
 rust/operator-binary/src/hbase_controller.rs  |  2 +-
 7 files changed, 28 insertions(+), 30 deletions(-)

diff --git a/rust/operator-binary/src/controller/build/config_map.rs b/rust/operator-binary/src/controller/build/config_map.rs
index 796650fc..3d9103d9 100644
--- a/rust/operator-binary/src/controller/build/config_map.rs
+++ b/rust/operator-binary/src/controller/build/config_map.rs
@@ -58,12 +58,12 @@ pub enum Error {
 type Result<T, E = Error> = std::result::Result<T, E>;
 
 pub fn build_rolegroup_config_map(
-    // `hbase` is retained only for the ConfigMap ObjectMeta / owner reference; the rendered
-    // content comes entirely from `cluster`. To be decoupled in a follow-up.
-    hbase: &v1alpha1::HbaseCluster,
     cluster: &ValidatedCluster,
     role: &HbaseRole,
     rolegroup_ref: &RoleGroupRef<v1alpha1::HbaseCluster>,
+    // `owner` is retained only for the ConfigMap ObjectMeta / owner reference; the rendered
+    // content comes entirely from `cluster`. To be decoupled in a follow-up.
+    owner_ref: &v1alpha1::HbaseCluster,
 ) -> Result<ConfigMap> {
     tracing::info!("Setting up ConfigMap for {:?}", rolegroup_ref);
 
@@ -108,18 +108,20 @@ pub fn build_rolegroup_config_map(
         overrides.ssl_client_xml.clone(),
     );
 
-    let security_properties = security_properties::build(role, overrides.security_properties.clone())
-        .with_context(|_| JvmSecurityPropertiesSnafu {
-            role_group: rolegroup_ref.role_group.clone(),
-        })?;
+    let security_properties =
+        security_properties::build(role, overrides.security_properties.clone()).with_context(
+            |_| JvmSecurityPropertiesSnafu {
+                role_group: rolegroup_ref.role_group.clone(),
+            },
+        )?;
 
     let cm_metadata = ObjectMetaBuilder::new()
-        .name_and_namespace(hbase)
+        .name_and_namespace(owner_ref)
         .name(rolegroup_ref.object_name())
-        .ownerreference_from_resource(hbase, None, Some(true))
+        .ownerreference_from_resource(owner_ref, None, Some(true))
         .context(ObjectMissingMetadataForOwnerRefSnafu)?
         .with_recommended_labels(&build_recommended_labels(
-            hbase,
+            owner_ref,
             &cluster.image.app_version_label_value,
             &rolegroup_ref.role,
             &rolegroup_ref.role_group,
@@ -143,10 +145,11 @@ pub fn build_rolegroup_config_map(
         builder.add_data(ConfigFileName::SslClient.to_string(), ssl_client_xml);
     }
 
-    extend_role_group_config_map(rolegroup_ref, rg.merged_config.logging(), &mut builder)
-        .context(InvalidLoggingConfigSnafu {
+    extend_role_group_config_map(rolegroup_ref, rg.merged_config.logging(), &mut builder).context(
+        InvalidLoggingConfigSnafu {
             cm_name: rolegroup_ref.object_name(),
-        })?;
+        },
+    )?;
 
     builder.build().with_context(|_| AssembleSnafu {
         role: rolegroup_ref.role.clone(),
diff --git a/rust/operator-binary/src/controller/build/properties/hbase_env.rs b/rust/operator-binary/src/controller/build/properties/hbase_env.rs
index 42fc905e..bed4d356 100644
--- a/rust/operator-binary/src/controller/build/properties/hbase_env.rs
+++ b/rust/operator-binary/src/controller/build/properties/hbase_env.rs
@@ -123,9 +123,6 @@ mod tests {
             config_overrides(&[("CUSTOM_VAR", "custom_value")]),
         )
         .unwrap();
-        assert!(
-            env.contains("export CUSTOM_VAR=\"custom_value\""),
-            "{env}"
-        );
+        assert!(env.contains("export CUSTOM_VAR=\"custom_value\""), "{env}");
     }
 }
diff --git a/rust/operator-binary/src/controller/build/properties/hbase_site.rs b/rust/operator-binary/src/controller/build/properties/hbase_site.rs
index 4bae593c..39e16420 100644
--- a/rust/operator-binary/src/controller/build/properties/hbase_site.rs
+++ b/rust/operator-binary/src/controller/build/properties/hbase_site.rs
@@ -183,9 +183,7 @@ mod tests {
             config_overrides(&[]),
         );
         assert!(
-            xml.contains(
-                "<name>hbase.regionserver.ipc.address</name>\n    <value>0.0.0.0</value>"
-            ),
+            xml.contains("<name>hbase.regionserver.ipc.address</name>\n    <value>0.0.0.0</value>"),
             "{xml}"
         );
         assert!(
diff --git a/rust/operator-binary/src/controller/build/properties/ssl_server.rs b/rust/operator-binary/src/controller/build/properties/ssl_server.rs
index 36da52ea..bd3bd911 100644
--- a/rust/operator-binary/src/controller/build/properties/ssl_server.rs
+++ b/rust/operator-binary/src/controller/build/properties/ssl_server.rs
@@ -29,10 +29,7 @@ mod tests {
     #[test]
     fn settings_appear_in_xml() {
         let xml = build(
-            BTreeMap::from([(
-                "ssl.server.keystore.type".to_string(),
-                "pkcs12".to_string(),
-            )]),
+            BTreeMap::from([("ssl.server.keystore.type".to_string(), "pkcs12".to_string())]),
             config_overrides(&[]),
         );
         assert!(
diff --git a/rust/operator-binary/src/controller/validate.rs b/rust/operator-binary/src/controller/validate.rs
index bdc610da..c44e31b3 100644
--- a/rust/operator-binary/src/controller/validate.rs
+++ b/rust/operator-binary/src/controller/validate.rs
@@ -20,7 +20,8 @@ use crate::{
         ValidatedRoleGroupConfig,
     },
     kerberos::{
-        self, kerberos_config_properties, kerberos_ssl_client_settings, kerberos_ssl_server_settings,
+        self, kerberos_config_properties, kerberos_ssl_client_settings,
+        kerberos_ssl_server_settings,
     },
 };
 
@@ -130,8 +131,7 @@ pub fn validate_cluster(
         name: ClusterName::from_str(&hbase.name_any()).context(InvalidClusterNameSnafu)?,
         image: resolved_product_image,
         cluster_config: ValidatedClusterConfig {
-            zookeeper_connection_information: dereferenced_objects
-                .zookeeper_connection_information,
+            zookeeper_connection_information: dereferenced_objects.zookeeper_connection_information,
             hbase_opa_config: dereferenced_objects.hbase_opa_config,
             kerberos_enabled: hbase.has_kerberos_enabled(),
             hbase_site_kerberos_config,
@@ -334,7 +334,10 @@ spec:
 
         let env_overrides = merged_env_overrides(&hbase, &HbaseRole::Master, "default");
 
-        assert_eq!(env_overrides.get("TEST_VAR"), Some(&"MASTER_RG".to_string()));
+        assert_eq!(
+            env_overrides.get("TEST_VAR"),
+            Some(&"MASTER_RG".to_string())
+        );
         assert_eq!(
             env_overrides.get("TEST_VAR_FROM_MASTER"),
             Some(&"MASTER".to_string())
diff --git a/rust/operator-binary/src/discovery.rs b/rust/operator-binary/src/discovery.rs
index 4023085b..73ac145b 100644
--- a/rust/operator-binary/src/discovery.rs
+++ b/rust/operator-binary/src/discovery.rs
@@ -1,6 +1,5 @@
 use std::collections::BTreeMap;
 
-use crate::config::writer::to_hadoop_xml;
 use snafu::{ResultExt, Snafu};
 use stackable_operator::{
     builder::{configmap::ConfigMapBuilder, meta::ObjectMetaBuilder},
@@ -11,6 +10,7 @@ use stackable_operator::{
 };
 
 use crate::{
+    config::writer::to_hadoop_xml,
     crd::{HBASE_SITE_XML, HbaseRole, v1alpha1},
     hbase_controller::build_recommended_labels,
     kerberos::{self, kerberos_discovery_config_properties},
diff --git a/rust/operator-binary/src/hbase_controller.rs b/rust/operator-binary/src/hbase_controller.rs
index 41df54be..3492a078 100644
--- a/rust/operator-binary/src/hbase_controller.rs
+++ b/rust/operator-binary/src/hbase_controller.rs
@@ -345,10 +345,10 @@ pub async fn reconcile_hbase(
             )?;
 
             let rg_configmap = crate::controller::build::config_map::build_rolegroup_config_map(
-                hbase,
                 &validated_cluster,
                 hbase_role,
                 &rolegroup,
+                hbase,
             )
             .context(BuildRolegroupConfigMapSnafu)?;
             let rg_statefulset = build_rolegroup_statefulset(

From 86fc9ae475afb6ed95e9c076a023526056aa3d98 Mon Sep 17 00:00:00 2001
From: Malte Sander <malte.sander.it@gmail.com>
Date: Thu, 4 Jun 2026 12:36:39 +0200
Subject: [PATCH 10/21] fix: use builder pattern for discovery configmap

---
 .../src/{ => controller/build}/discovery.rs   | 48 +++++++++----------
 .../src/controller/build/mod.rs               |  1 +
 .../src/controller/validate.rs                |  7 ++-
 rust/operator-binary/src/crd/mod.rs           |  2 -
 rust/operator-binary/src/hbase_controller.rs  | 20 ++++----
 rust/operator-binary/src/main.rs              |  1 -
 6 files changed, 38 insertions(+), 41 deletions(-)
 rename rust/operator-binary/src/{ => controller/build}/discovery.rs (60%)

diff --git a/rust/operator-binary/src/discovery.rs b/rust/operator-binary/src/controller/build/discovery.rs
similarity index 60%
rename from rust/operator-binary/src/discovery.rs
rename to rust/operator-binary/src/controller/build/discovery.rs
index 73ac145b..bf746e25 100644
--- a/rust/operator-binary/src/discovery.rs
+++ b/rust/operator-binary/src/controller/build/discovery.rs
@@ -1,20 +1,19 @@
+//! Build the discovery `ConfigMap` for the HbaseCluster.
+
 use std::collections::BTreeMap;
 
 use snafu::{ResultExt, Snafu};
 use stackable_operator::{
     builder::{configmap::ConfigMapBuilder, meta::ObjectMetaBuilder},
-    commons::product_image_selection::ResolvedProductImage,
     k8s_openapi::api::core::v1::ConfigMap,
     kube::runtime::reflector::ObjectRef,
-    utils::cluster_info::KubernetesClusterInfo,
 };
 
 use crate::{
     config::writer::to_hadoop_xml,
-    crd::{HBASE_SITE_XML, HbaseRole, v1alpha1},
-    hbase_controller::build_recommended_labels,
-    kerberos::{self, kerberos_discovery_config_properties},
-    zookeeper::ZookeeperConnectionInformation,
+    controller::build::properties::ConfigFileName,
+    crd::{HbaseRole, v1alpha1},
+    hbase_controller::{ValidatedCluster, build_recommended_labels},
 };
 
 type Result<T, E = Error> = std::result::Result<T, E>;
@@ -36,35 +35,34 @@ pub enum Error {
     ObjectMeta {
         source: stackable_operator::builder::meta::Error,
     },
-
-    #[snafu(display("failed to add Kerberos discovery"))]
-    AddKerberosDiscovery { source: kerberos::Error },
 }
 
 /// Creates a discovery config map containing the `hbase-site.xml` for clients.
-pub fn build_discovery_configmap(
-    hbase: &v1alpha1::HbaseCluster,
-    cluster_info: &KubernetesClusterInfo,
-    zookeeper_connection_information: &ZookeeperConnectionInformation,
-    resolved_product_image: &ResolvedProductImage,
+///
+/// The rendered content comes entirely from `cluster`; `owner_ref` is retained only for the
+/// ConfigMap ObjectMeta / owner reference.
+pub fn build_discovery_config_map(
+    cluster: &ValidatedCluster,
+    owner_ref: &v1alpha1::HbaseCluster,
 ) -> Result<ConfigMap> {
-    let mut hbase_site = zookeeper_connection_information.as_hbase_settings();
-    hbase_site.extend(
-        kerberos_discovery_config_properties(hbase, cluster_info)
-            .context(AddKerberosDiscoverySnafu)?,
-    );
+    let cluster_config = &cluster.cluster_config;
+
+    let mut hbase_site = cluster_config
+        .zookeeper_connection_information
+        .as_hbase_settings();
+    hbase_site.extend(cluster_config.discovery_kerberos_config.clone());
 
     ConfigMapBuilder::new()
         .metadata(
             ObjectMetaBuilder::new()
-                .name_and_namespace(hbase)
-                .ownerreference_from_resource(hbase, None, Some(true))
+                .name_and_namespace(owner_ref)
+                .ownerreference_from_resource(owner_ref, None, Some(true))
                 .with_context(|_| ObjectMissingMetadataForOwnerRefSnafu {
-                    hbase: ObjectRef::from_obj(hbase),
+                    hbase: ObjectRef::from_obj(owner_ref),
                 })?
                 .with_recommended_labels(&build_recommended_labels(
-                    hbase,
-                    &resolved_product_image.app_version_label_value,
+                    owner_ref,
+                    &cluster.image.app_version_label_value,
                     &HbaseRole::RegionServer.to_string(),
                     "discovery",
                 ))
@@ -72,7 +70,7 @@ pub fn build_discovery_configmap(
                 .build(),
         )
         .add_data(
-            HBASE_SITE_XML,
+            ConfigFileName::HbaseSite.to_string(),
             to_hadoop_xml(
                 hbase_site
                     .into_iter()
diff --git a/rust/operator-binary/src/controller/build/mod.rs b/rust/operator-binary/src/controller/build/mod.rs
index 933a20b9..4a7bba72 100644
--- a/rust/operator-binary/src/controller/build/mod.rs
+++ b/rust/operator-binary/src/controller/build/mod.rs
@@ -1,2 +1,3 @@
 pub mod config_map;
+pub mod discovery;
 pub mod properties;
diff --git a/rust/operator-binary/src/controller/validate.rs b/rust/operator-binary/src/controller/validate.rs
index c44e31b3..6d5fdd9a 100644
--- a/rust/operator-binary/src/controller/validate.rs
+++ b/rust/operator-binary/src/controller/validate.rs
@@ -20,8 +20,8 @@ use crate::{
         ValidatedRoleGroupConfig,
     },
     kerberos::{
-        self, kerberos_config_properties, kerberos_ssl_client_settings,
-        kerberos_ssl_server_settings,
+        self, kerberos_config_properties, kerberos_discovery_config_properties,
+        kerberos_ssl_client_settings, kerberos_ssl_server_settings,
     },
 };
 
@@ -124,6 +124,8 @@ pub fn validate_cluster(
 
     let hbase_site_kerberos_config =
         kerberos_config_properties(hbase, cluster_info).context(AddKerberosConfigSnafu)?;
+    let discovery_kerberos_config = kerberos_discovery_config_properties(hbase, cluster_info)
+        .context(AddKerberosConfigSnafu)?;
     let ssl_server_settings = kerberos_ssl_server_settings(hbase);
     let ssl_client_settings = kerberos_ssl_client_settings(hbase);
 
@@ -135,6 +137,7 @@ pub fn validate_cluster(
             hbase_opa_config: dereferenced_objects.hbase_opa_config,
             kerberos_enabled: hbase.has_kerberos_enabled(),
             hbase_site_kerberos_config,
+            discovery_kerberos_config,
             ssl_server_settings,
             ssl_client_settings,
         },
diff --git a/rust/operator-binary/src/crd/mod.rs b/rust/operator-binary/src/crd/mod.rs
index 937d24c8..564544d9 100644
--- a/rust/operator-binary/src/crd/mod.rs
+++ b/rust/operator-binary/src/crd/mod.rs
@@ -58,8 +58,6 @@ pub const TLS_STORE_PASSWORD: &str = "changeit";
 
 pub const JVM_SECURITY_PROPERTIES_FILE: &str = "security.properties";
 
-pub const HBASE_SITE_XML: &str = "hbase-site.xml";
-
 pub const HBASE_CLUSTER_DISTRIBUTED: &str = "hbase.cluster.distributed";
 pub const HBASE_ROOTDIR: &str = "hbase.rootdir";
 
diff --git a/rust/operator-binary/src/hbase_controller.rs b/rust/operator-binary/src/hbase_controller.rs
index 3492a078..c1282dbe 100644
--- a/rust/operator-binary/src/hbase_controller.rs
+++ b/rust/operator-binary/src/hbase_controller.rs
@@ -56,11 +56,11 @@ use strum::{EnumDiscriminants, IntoStaticStr};
 
 use crate::{
     OPERATOR_NAME,
+    controller::build::discovery::build_discovery_config_map,
     crd::{
         APP_NAME, AnyServiceConfig, CONFIG_DIR_NAME, Container, HbaseClusterStatus, HbaseRole,
         LISTENER_VOLUME_DIR, LISTENER_VOLUME_NAME, merged_env, v1alpha1,
     },
-    discovery::build_discovery_configmap,
     kerberos::{self, add_kerberos_pod_config},
     operations::{graceful_shutdown::add_graceful_shutdown_config, pdb::add_pdbs},
     product_logging::{CONTAINERDEBUG_LOG_DIRECTORY, STACKABLE_LOG_DIR},
@@ -110,6 +110,9 @@ pub struct ValidatedClusterConfig {
     pub kerberos_enabled: bool,
     /// Pre-resolved kerberos properties for hbase-site.xml (empty when kerberos is disabled).
     pub hbase_site_kerberos_config: BTreeMap<String, String>,
+    /// Pre-resolved kerberos properties for the discovery `hbase-site.xml` exposed to clients
+    /// (empty when kerberos is disabled).
+    pub discovery_kerberos_config: BTreeMap<String, String>,
     /// Pre-resolved ssl-server.xml settings (empty when HTTPS is disabled).
     pub ssl_server_settings: BTreeMap<String, String>,
     /// Pre-resolved ssl-client.xml settings (empty when HTTPS is disabled).
@@ -161,7 +164,9 @@ pub enum Error {
     },
 
     #[snafu(display("failed to build discovery configmap"))]
-    BuildDiscoveryConfigMap { source: super::discovery::Error },
+    BuildDiscoveryConfigMap {
+        source: crate::controller::build::discovery::Error,
+    },
 
     #[snafu(display("failed to build rolegroup ConfigMap"))]
     BuildRolegroupConfigMap {
@@ -406,15 +411,8 @@ pub async fn reconcile_hbase(
 
     // Discovery CM will fail to build until the rest of the cluster has been deployed, so do it last
     // so that failure won't inhibit the rest of the cluster from booting up.
-    let discovery_cm = build_discovery_configmap(
-        hbase,
-        &client.kubernetes_cluster_info,
-        &validated_cluster
-            .cluster_config
-            .zookeeper_connection_information,
-        &validated_cluster.image,
-    )
-    .context(BuildDiscoveryConfigMapSnafu)?;
+    let discovery_cm = build_discovery_config_map(&validated_cluster, hbase)
+        .context(BuildDiscoveryConfigMapSnafu)?;
     cluster_resources
         .add(client, discovery_cm)
         .await
diff --git a/rust/operator-binary/src/main.rs b/rust/operator-binary/src/main.rs
index 6a97d872..97cfaba3 100644
--- a/rust/operator-binary/src/main.rs
+++ b/rust/operator-binary/src/main.rs
@@ -40,7 +40,6 @@ use crate::{
 mod config;
 mod controller;
 mod crd;
-mod discovery;
 mod hbase_controller;
 mod kerberos;
 mod operations;

From 6740e26286ece64dfa707b09770856a618fc9d77 Mon Sep 17 00:00:00 2001
From: Malte Sander <malte.sander.it@gmail.com>
Date: Thu, 4 Jun 2026 12:45:09 +0200
Subject: [PATCH 11/21] chore: rebuild hashes

---
 Cargo.nix         | 18 +++++++++---------
 crate-hashes.json | 18 +++++++++---------
 2 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/Cargo.nix b/Cargo.nix
index 55fc2419..cd85e73e 100644
--- a/Cargo.nix
+++ b/Cargo.nix
@@ -4832,7 +4832,7 @@ rec {
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
           rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
-          sha256 = "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk";
+          sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         libName = "k8s_version";
         authors = [
@@ -9513,7 +9513,7 @@ rec {
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
           rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
-          sha256 = "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk";
+          sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         libName = "stackable_certs";
         authors = [
@@ -9721,7 +9721,7 @@ rec {
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
           rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
-          sha256 = "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk";
+          sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         libName = "stackable_operator";
         authors = [
@@ -9906,7 +9906,7 @@ rec {
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
           rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
-          sha256 = "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk";
+          sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         procMacro = true;
         libName = "stackable_operator_derive";
@@ -9941,7 +9941,7 @@ rec {
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
           rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
-          sha256 = "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk";
+          sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         libName = "stackable_shared";
         authors = [
@@ -10022,7 +10022,7 @@ rec {
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
           rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
-          sha256 = "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk";
+          sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         libName = "stackable_telemetry";
         authors = [
@@ -10132,7 +10132,7 @@ rec {
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
           rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
-          sha256 = "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk";
+          sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         libName = "stackable_versioned";
         authors = [
@@ -10182,7 +10182,7 @@ rec {
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
           rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
-          sha256 = "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk";
+          sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         procMacro = true;
         libName = "stackable_versioned_macros";
@@ -10250,7 +10250,7 @@ rec {
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
           rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
-          sha256 = "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk";
+          sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         libName = "stackable_webhook";
         authors = [
diff --git a/crate-hashes.json b/crate-hashes.json
index 5564a89e..c76bf06c 100644
--- a/crate-hashes.json
+++ b/crate-hashes.json
@@ -1,12 +1,12 @@
 {
-  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#k8s-version@0.1.3": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
-  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-certs@0.4.0": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
-  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-operator-derive@0.3.1": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
-  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-operator@0.111.1": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
-  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-shared@0.1.0": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
-  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-telemetry@0.6.3": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
-  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-versioned-macros@0.10.0": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
-  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-versioned@0.10.0": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
-  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-webhook@0.9.1": "0lj969rjbxairjglrnaq0xhabvdrq5nd6wl1i0y9pr50nhh7zvgk",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#k8s-version@0.1.3": "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-certs@0.4.0": "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-operator-derive@0.3.1": "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-operator@0.111.1": "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-shared@0.1.0": "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-telemetry@0.6.3": "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-versioned-macros@0.10.0": "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-versioned@0.10.0": "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-webhook@0.9.1": "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96",
   "git+https://github.com/stackabletech/product-config.git?tag=0.8.0#product-config@0.8.0": "1dz70kapm2wdqcr7ndyjji0lhsl98bsq95gnb2lw487wf6yr7987"
 }
\ No newline at end of file

From 1cd040198c9ba3cca6010d91f9562c437508b73b Mon Sep 17 00:00:00 2001
From: Malte Sander <malte.sander.it@gmail.com>
Date: Thu, 4 Jun 2026 12:45:28 +0200
Subject: [PATCH 12/21] fix: remove result from product logging

---
 .../src/controller/build/config_map.rs        | 12 +------
 rust/operator-binary/src/product_logging.rs   | 31 +------------------
 2 files changed, 2 insertions(+), 41 deletions(-)

diff --git a/rust/operator-binary/src/controller/build/config_map.rs b/rust/operator-binary/src/controller/build/config_map.rs
index 3d9103d9..17bb3e94 100644
--- a/rust/operator-binary/src/controller/build/config_map.rs
+++ b/rust/operator-binary/src/controller/build/config_map.rs
@@ -41,12 +41,6 @@ pub enum Error {
         source: stackable_operator::builder::meta::Error,
     },
 
-    #[snafu(display("failed to add the logging configuration to the ConfigMap {cm_name:?}"))]
-    InvalidLoggingConfig {
-        source: crate::product_logging::Error,
-        cm_name: String,
-    },
-
     #[snafu(display("cannot build config map for role {role:?} and role group {role_group:?}"))]
     Assemble {
         source: stackable_operator::builder::configmap::Error,
@@ -145,11 +139,7 @@ pub fn build_rolegroup_config_map(
         builder.add_data(ConfigFileName::SslClient.to_string(), ssl_client_xml);
     }
 
-    extend_role_group_config_map(rolegroup_ref, rg.merged_config.logging(), &mut builder).context(
-        InvalidLoggingConfigSnafu {
-            cm_name: rolegroup_ref.object_name(),
-        },
-    )?;
+    extend_role_group_config_map(rolegroup_ref, rg.merged_config.logging(), &mut builder);
 
     builder.build().with_context(|_| AssembleSnafu {
         role: rolegroup_ref.role.clone(),
diff --git a/rust/operator-binary/src/product_logging.rs b/rust/operator-binary/src/product_logging.rs
index 61db3245..0ba89a87 100644
--- a/rust/operator-binary/src/product_logging.rs
+++ b/rust/operator-binary/src/product_logging.rs
@@ -1,4 +1,3 @@
-use snafu::Snafu;
 use stackable_operator::{
     builder::configmap::ConfigMapBuilder,
     memory::BinaryMultiple,
@@ -16,32 +15,6 @@ use crate::{
     hbase_controller::MAX_HBASE_LOG_FILES_SIZE,
 };
 
-#[derive(Snafu, Debug)]
-pub enum Error {
-    #[snafu(display("object has no namespace"))]
-    ObjectHasNoNamespace,
-
-    #[snafu(display("failed to retrieve the ConfigMap [{cm_name}]"))]
-    ConfigMapNotFound {
-        source: stackable_operator::client::Error,
-        cm_name: String,
-    },
-
-    #[snafu(display("failed to retrieve the entry [{entry}] for ConfigMap [{cm_name}]"))]
-    MissingConfigMapEntry {
-        entry: &'static str,
-        cm_name: String,
-    },
-
-    #[snafu(display("crd validation failure"))]
-    CrdValidationFailure { source: crate::crd::Error },
-
-    #[snafu(display("vectorAggregatorConfigMapName must be set"))]
-    MissingVectorAggregatorAddress,
-}
-
-type Result<T, E = Error> = std::result::Result<T, E>;
-
 const CONSOLE_CONVERSION_PATTERN: &str = "%d{ISO8601} %-5p [%t] %c{2}: %.1000m%n";
 const HBASE_LOG4J2_FILE: &str = "hbase.log4j2.xml";
 pub const LOG4J2_CONFIG_FILE: &str = "log4j2.properties";
@@ -54,7 +27,7 @@ pub fn extend_role_group_config_map(
     rolegroup: &RoleGroupRef<v1alpha1::HbaseCluster>,
     logging: &Logging<Container>,
     cm_builder: &mut ConfigMapBuilder,
-) -> Result<()> {
+) {
     if let Some(ContainerLogConfig {
         choice: Some(ContainerLogConfigChoice::Automatic(log_config)),
     }) = logging.containers.get(&Container::Hbase)
@@ -77,8 +50,6 @@ pub fn extend_role_group_config_map(
             product_logging::framework::create_vector_config(rolegroup, vector_log_config),
         );
     }
-
-    Ok(())
 }
 
 fn log4j_config(log_config: &AutomaticContainerLogConfig) -> String {

From 1027e54ac965a911646ae841d8fd21e18ffd7ce5 Mon Sep 17 00:00:00 2001
From: Malte Sander <malte.sander.it@gmail.com>
Date: Thu, 4 Jun 2026 12:52:40 +0200
Subject: [PATCH 13/21] fix: move product logging to build step

---
 rust/operator-binary/src/controller/build/config_map.rs  | 4 ++--
 .../build/properties/logging.rs}                         | 9 +++------
 .../src/controller/build/properties/mod.rs               | 4 ++++
 rust/operator-binary/src/hbase_controller.rs             | 5 ++++-
 rust/operator-binary/src/main.rs                         | 1 -
 5 files changed, 13 insertions(+), 10 deletions(-)
 rename rust/operator-binary/src/{product_logging.rs => controller/build/properties/logging.rs} (82%)

diff --git a/rust/operator-binary/src/controller/build/config_map.rs b/rust/operator-binary/src/controller/build/config_map.rs
index 17bb3e94..34b4476b 100644
--- a/rust/operator-binary/src/controller/build/config_map.rs
+++ b/rust/operator-binary/src/controller/build/config_map.rs
@@ -10,11 +10,11 @@ use stackable_operator::{
 use crate::{
     config::writer::PropertiesWriterError,
     controller::build::properties::{
-        ConfigFileName, hbase_env, hbase_site, security_properties, ssl_client, ssl_server,
+        ConfigFileName, hbase_env, hbase_site, logging::extend_role_group_config_map,
+        security_properties, ssl_client, ssl_server,
     },
     crd::{HbaseRole, v1alpha1},
     hbase_controller::{ValidatedCluster, build_recommended_labels},
-    product_logging::extend_role_group_config_map,
 };
 
 #[derive(Snafu, Debug)]
diff --git a/rust/operator-binary/src/product_logging.rs b/rust/operator-binary/src/controller/build/properties/logging.rs
similarity index 82%
rename from rust/operator-binary/src/product_logging.rs
rename to rust/operator-binary/src/controller/build/properties/logging.rs
index 0ba89a87..9a2d5828 100644
--- a/rust/operator-binary/src/product_logging.rs
+++ b/rust/operator-binary/src/controller/build/properties/logging.rs
@@ -11,16 +11,13 @@ use stackable_operator::{
 };
 
 use crate::{
+    controller::build::properties::ConfigFileName,
     crd::{Container, v1alpha1},
-    hbase_controller::MAX_HBASE_LOG_FILES_SIZE,
+    hbase_controller::{MAX_HBASE_LOG_FILES_SIZE, STACKABLE_LOG_DIR},
 };
 
 const CONSOLE_CONVERSION_PATTERN: &str = "%d{ISO8601} %-5p [%t] %c{2}: %.1000m%n";
 const HBASE_LOG4J2_FILE: &str = "hbase.log4j2.xml";
-pub const LOG4J2_CONFIG_FILE: &str = "log4j2.properties";
-pub const STACKABLE_LOG_DIR: &str = "/stackable/log";
-pub static CONTAINERDEBUG_LOG_DIRECTORY: std::sync::LazyLock<String> =
-    std::sync::LazyLock::new(|| format!("{STACKABLE_LOG_DIR}/containerdebug"));
 
 /// Extend the role group ConfigMap with logging and Vector configurations
 pub fn extend_role_group_config_map(
@@ -32,7 +29,7 @@ pub fn extend_role_group_config_map(
         choice: Some(ContainerLogConfigChoice::Automatic(log_config)),
     }) = logging.containers.get(&Container::Hbase)
     {
-        cm_builder.add_data(LOG4J2_CONFIG_FILE, log4j_config(log_config));
+        cm_builder.add_data(ConfigFileName::Log4j2.to_string(), log4j_config(log_config));
     }
 
     let vector_log_config = if let Some(ContainerLogConfig {
diff --git a/rust/operator-binary/src/controller/build/properties/mod.rs b/rust/operator-binary/src/controller/build/properties/mod.rs
index 31c7af24..db919037 100644
--- a/rust/operator-binary/src/controller/build/properties/mod.rs
+++ b/rust/operator-binary/src/controller/build/properties/mod.rs
@@ -9,6 +9,7 @@ use stackable_operator::v2::config_overrides::KeyValueConfigOverrides;
 
 pub mod hbase_env;
 pub mod hbase_site;
+pub mod logging;
 pub mod security_properties;
 pub mod ssl_client;
 pub mod ssl_server;
@@ -43,6 +44,8 @@ pub enum ConfigFileName {
     SslClient,
     #[strum(serialize = "security.properties")]
     Security,
+    #[strum(serialize = "log4j2.properties")]
+    Log4j2,
 }
 
 #[cfg(test)]
@@ -56,6 +59,7 @@ mod tests {
         assert_eq!(ConfigFileName::SslServer.to_string(), "ssl-server.xml");
         assert_eq!(ConfigFileName::SslClient.to_string(), "ssl-client.xml");
         assert_eq!(ConfigFileName::Security.to_string(), "security.properties");
+        assert_eq!(ConfigFileName::Log4j2.to_string(), "log4j2.properties");
     }
 }
 
diff --git a/rust/operator-binary/src/hbase_controller.rs b/rust/operator-binary/src/hbase_controller.rs
index c1282dbe..b6c5c9bd 100644
--- a/rust/operator-binary/src/hbase_controller.rs
+++ b/rust/operator-binary/src/hbase_controller.rs
@@ -63,7 +63,6 @@ use crate::{
     },
     kerberos::{self, add_kerberos_pod_config},
     operations::{graceful_shutdown::add_graceful_shutdown_config, pdb::add_pdbs},
-    product_logging::{CONTAINERDEBUG_LOG_DIRECTORY, STACKABLE_LOG_DIR},
     security::opa::HbaseOpaConfig,
     zookeeper::ZookeeperConnectionInformation,
 };
@@ -75,6 +74,10 @@ pub const MAX_HBASE_LOG_FILES_SIZE: MemoryQuantity = MemoryQuantity {
     unit: BinaryMultiple::Mebi,
 };
 
+pub const STACKABLE_LOG_DIR: &str = "/stackable/log";
+pub static CONTAINERDEBUG_LOG_DIRECTORY: std::sync::LazyLock<String> =
+    std::sync::LazyLock::new(|| format!("{STACKABLE_LOG_DIR}/containerdebug"));
+
 // These constants are hard coded in hbase-entrypoint.sh
 // You need to change them there too.
 const HDFS_DISCOVERY_TMP_DIR: &str = "/stackable/tmp/hdfs";
diff --git a/rust/operator-binary/src/main.rs b/rust/operator-binary/src/main.rs
index 97cfaba3..2bd815b8 100644
--- a/rust/operator-binary/src/main.rs
+++ b/rust/operator-binary/src/main.rs
@@ -43,7 +43,6 @@ mod crd;
 mod hbase_controller;
 mod kerberos;
 mod operations;
-mod product_logging;
 mod security;
 mod webhooks;
 mod zookeeper;

From 0fe526b11439f1a2243dc9b4111934fe0841e083 Mon Sep 17 00:00:00 2001
From: Malte Sander <malte.sander.it@gmail.com>
Date: Thu, 4 Jun 2026 13:01:55 +0200
Subject: [PATCH 14/21] fix: move constants

---
 .../controller/build/properties/logging.rs    |  9 +++++--
 .../src/controller/validate.rs                |  5 ++--
 rust/operator-binary/src/hbase_controller.rs  | 27 +++++++++----------
 3 files changed, 22 insertions(+), 19 deletions(-)

diff --git a/rust/operator-binary/src/controller/build/properties/logging.rs b/rust/operator-binary/src/controller/build/properties/logging.rs
index 9a2d5828..93195534 100644
--- a/rust/operator-binary/src/controller/build/properties/logging.rs
+++ b/rust/operator-binary/src/controller/build/properties/logging.rs
@@ -1,6 +1,6 @@
 use stackable_operator::{
     builder::configmap::ConfigMapBuilder,
-    memory::BinaryMultiple,
+    memory::{BinaryMultiple, MemoryQuantity},
     product_logging::{
         self,
         spec::{
@@ -13,7 +13,12 @@ use stackable_operator::{
 use crate::{
     controller::build::properties::ConfigFileName,
     crd::{Container, v1alpha1},
-    hbase_controller::{MAX_HBASE_LOG_FILES_SIZE, STACKABLE_LOG_DIR},
+};
+
+pub const STACKABLE_LOG_DIR: &str = "/stackable/log";
+pub const MAX_HBASE_LOG_FILES_SIZE: MemoryQuantity = MemoryQuantity {
+    value: 10.0,
+    unit: BinaryMultiple::Mebi,
 };
 
 const CONSOLE_CONVERSION_PATTERN: &str = "%d{ISO8601} %-5p [%t] %c{2}: %.1000m%n";
diff --git a/rust/operator-binary/src/controller/validate.rs b/rust/operator-binary/src/controller/validate.rs
index 6d5fdd9a..b4a8cba2 100644
--- a/rust/operator-binary/src/controller/validate.rs
+++ b/rust/operator-binary/src/controller/validate.rs
@@ -16,8 +16,7 @@ use crate::{
     controller::dereference::DereferencedObjects,
     crd::{HbaseRole, v1alpha1},
     hbase_controller::{
-        CONTAINER_IMAGE_BASE_NAME, ValidatedCluster, ValidatedClusterConfig, ValidatedRoleConfig,
-        ValidatedRoleGroupConfig,
+        ValidatedCluster, ValidatedClusterConfig, ValidatedRoleConfig, ValidatedRoleGroupConfig,
     },
     kerberos::{
         self, kerberos_config_properties, kerberos_discovery_config_properties,
@@ -25,6 +24,8 @@ use crate::{
     },
 };
 
+const CONTAINER_IMAGE_BASE_NAME: &str = "hbase";
+
 #[derive(Snafu, Debug)]
 pub enum Error {
     #[snafu(display("failed to resolve product image"))]
diff --git a/rust/operator-binary/src/hbase_controller.rs b/rust/operator-binary/src/hbase_controller.rs
index b6c5c9bd..c57f3f52 100644
--- a/rust/operator-binary/src/hbase_controller.rs
+++ b/rust/operator-binary/src/hbase_controller.rs
@@ -35,7 +35,6 @@ use stackable_operator::{
     },
     kvp::{Annotations, Label, LabelError, Labels, ObjectLabels},
     logging::controller::ReconcilerError,
-    memory::{BinaryMultiple, MemoryQuantity},
     product_logging::{
         self,
         framework::LoggingError,
@@ -56,7 +55,10 @@ use strum::{EnumDiscriminants, IntoStaticStr};
 
 use crate::{
     OPERATOR_NAME,
-    controller::build::discovery::build_discovery_config_map,
+    controller::build::{
+        discovery::build_discovery_config_map,
+        properties::logging::{MAX_HBASE_LOG_FILES_SIZE, STACKABLE_LOG_DIR},
+    },
     crd::{
         APP_NAME, AnyServiceConfig, CONFIG_DIR_NAME, Container, HbaseClusterStatus, HbaseRole,
         LISTENER_VOLUME_DIR, LISTENER_VOLUME_NAME, merged_env, v1alpha1,
@@ -69,12 +71,7 @@ use crate::{
 
 pub const HBASE_CONTROLLER_NAME: &str = "hbasecluster";
 pub const FULL_HBASE_CONTROLLER_NAME: &str = concatcp!(HBASE_CONTROLLER_NAME, '.', OPERATOR_NAME);
-pub const MAX_HBASE_LOG_FILES_SIZE: MemoryQuantity = MemoryQuantity {
-    value: 10.0,
-    unit: BinaryMultiple::Mebi,
-};
 
-pub const STACKABLE_LOG_DIR: &str = "/stackable/log";
 pub static CONTAINERDEBUG_LOG_DIRECTORY: std::sync::LazyLock<String> =
     std::sync::LazyLock::new(|| format!("{STACKABLE_LOG_DIR}/containerdebug"));
 
@@ -84,8 +81,6 @@ const HDFS_DISCOVERY_TMP_DIR: &str = "/stackable/tmp/hdfs";
 const HBASE_CONFIG_TMP_DIR: &str = "/stackable/tmp/hbase";
 const HBASE_LOG_CONFIG_TMP_DIR: &str = "/stackable/tmp/log_config";
 
-pub const CONTAINER_IMAGE_BASE_NAME: &str = "hbase";
-
 pub struct Ctx {
     pub client: stackable_operator::client::Client,
     pub operator_environment: OperatorEnvironmentOptions,
@@ -108,18 +103,20 @@ pub struct ValidatedCluster {
 /// Cluster-wide settings resolved once during validation.
 #[derive(Clone, Debug)]
 pub struct ValidatedClusterConfig {
-    pub zookeeper_connection_information: ZookeeperConnectionInformation,
+    // Pre-resolved OPA connection configuration.
     pub hbase_opa_config: Option<HbaseOpaConfig>,
     pub kerberos_enabled: bool,
-    /// Pre-resolved kerberos properties for hbase-site.xml (empty when kerberos is disabled).
+    // Pre-resolved kerberos properties for hbase-site.xml (empty when kerberos is disabled).
     pub hbase_site_kerberos_config: BTreeMap<String, String>,
-    /// Pre-resolved kerberos properties for the discovery `hbase-site.xml` exposed to clients
-    /// (empty when kerberos is disabled).
+    // Pre-resolved kerberos properties for the discovery `hbase-site.xml` exposed to clients
+    // (empty when kerberos is disabled).
     pub discovery_kerberos_config: BTreeMap<String, String>,
-    /// Pre-resolved ssl-server.xml settings (empty when HTTPS is disabled).
+    // Pre-resolved ssl-server.xml settings (empty when HTTPS is disabled).
     pub ssl_server_settings: BTreeMap<String, String>,
-    /// Pre-resolved ssl-client.xml settings (empty when HTTPS is disabled).
+    // Pre-resolved ssl-client.xml settings (empty when HTTPS is disabled).
     pub ssl_client_settings: BTreeMap<String, String>,
+    // Pre-resolved zookeeper connection settings.
+    pub zookeeper_connection_information: ZookeeperConnectionInformation,
 }
 
 /// Per-role configuration extracted during validation.

From f69955951421eade4f310b145012ad6a7d8ae7e8 Mon Sep 17 00:00:00 2001
From: Malte Sander <malte.sander.it@gmail.com>
Date: Thu, 4 Jun 2026 13:09:25 +0200
Subject: [PATCH 15/21] refactor: consolidate logging to build step

---
 .../src/controller/build/config_map.rs        | 13 ++++-
 .../controller/build/properties/logging.rs    | 58 ++++++++++---------
 2 files changed, 41 insertions(+), 30 deletions(-)

diff --git a/rust/operator-binary/src/controller/build/config_map.rs b/rust/operator-binary/src/controller/build/config_map.rs
index 34b4476b..374a650e 100644
--- a/rust/operator-binary/src/controller/build/config_map.rs
+++ b/rust/operator-binary/src/controller/build/config_map.rs
@@ -4,14 +4,14 @@ use snafu::{OptionExt, ResultExt, Snafu};
 use stackable_operator::{
     builder::{configmap::ConfigMapBuilder, meta::ObjectMetaBuilder},
     k8s_openapi::api::core::v1::ConfigMap,
+    product_logging::framework::VECTOR_CONFIG_FILE,
     role_utils::RoleGroupRef,
 };
 
 use crate::{
     config::writer::PropertiesWriterError,
     controller::build::properties::{
-        ConfigFileName, hbase_env, hbase_site, logging::extend_role_group_config_map,
-        security_properties, ssl_client, ssl_server,
+        ConfigFileName, hbase_env, hbase_site, logging, security_properties, ssl_client, ssl_server,
     },
     crd::{HbaseRole, v1alpha1},
     hbase_controller::{ValidatedCluster, build_recommended_labels},
@@ -139,7 +139,14 @@ pub fn build_rolegroup_config_map(
         builder.add_data(ConfigFileName::SslClient.to_string(), ssl_client_xml);
     }
 
-    extend_role_group_config_map(rolegroup_ref, rg.merged_config.logging(), &mut builder);
+    if let Some(log4j2_properties) = logging::build_log4j2(rg.merged_config.logging()) {
+        builder.add_data(ConfigFileName::Log4j2.to_string(), log4j2_properties);
+    }
+    if let Some(vector_config) =
+        logging::build_vector_config(rolegroup_ref, rg.merged_config.logging())
+    {
+        builder.add_data(VECTOR_CONFIG_FILE, vector_config);
+    }
 
     builder.build().with_context(|_| AssembleSnafu {
         role: rolegroup_ref.role.clone(),
diff --git a/rust/operator-binary/src/controller/build/properties/logging.rs b/rust/operator-binary/src/controller/build/properties/logging.rs
index 93195534..5e105d24 100644
--- a/rust/operator-binary/src/controller/build/properties/logging.rs
+++ b/rust/operator-binary/src/controller/build/properties/logging.rs
@@ -1,5 +1,4 @@
 use stackable_operator::{
-    builder::configmap::ConfigMapBuilder,
     memory::{BinaryMultiple, MemoryQuantity},
     product_logging::{
         self,
@@ -10,10 +9,7 @@ use stackable_operator::{
     role_utils::RoleGroupRef,
 };
 
-use crate::{
-    controller::build::properties::ConfigFileName,
-    crd::{Container, v1alpha1},
-};
+use crate::crd::{Container, v1alpha1};
 
 pub const STACKABLE_LOG_DIR: &str = "/stackable/log";
 pub const MAX_HBASE_LOG_FILES_SIZE: MemoryQuantity = MemoryQuantity {
@@ -24,34 +20,42 @@ pub const MAX_HBASE_LOG_FILES_SIZE: MemoryQuantity = MemoryQuantity {
 const CONSOLE_CONVERSION_PATTERN: &str = "%d{ISO8601} %-5p [%t] %c{2}: %.1000m%n";
 const HBASE_LOG4J2_FILE: &str = "hbase.log4j2.xml";
 
-/// Extend the role group ConfigMap with logging and Vector configurations
-pub fn extend_role_group_config_map(
+/// Renders `log4j2.properties` for the HBase container.
+///
+/// Returns `None` when the HBase container does not use the operator's automatic logging
+/// configuration (e.g. a custom log ConfigMap is referenced instead), in which case no
+/// `log4j2.properties` should be added to the rolegroup `ConfigMap`.
+pub fn build_log4j2(logging: &Logging<Container>) -> Option<String> {
+    match logging.containers.get(&Container::Hbase) {
+        Some(ContainerLogConfig {
+            choice: Some(ContainerLogConfigChoice::Automatic(log_config)),
+        }) => Some(log4j_config(log_config)),
+        _ => None,
+    }
+}
+
+/// Renders the Vector agent config (`vector.yaml`).
+///
+/// Returns `None` when the Vector agent is disabled for this role group.
+pub fn build_vector_config(
     rolegroup: &RoleGroupRef<v1alpha1::HbaseCluster>,
     logging: &Logging<Container>,
-    cm_builder: &mut ConfigMapBuilder,
-) {
-    if let Some(ContainerLogConfig {
-        choice: Some(ContainerLogConfigChoice::Automatic(log_config)),
-    }) = logging.containers.get(&Container::Hbase)
-    {
-        cm_builder.add_data(ConfigFileName::Log4j2.to_string(), log4j_config(log_config));
+) -> Option<String> {
+    if !logging.enable_vector_agent {
+        return None;
     }
 
-    let vector_log_config = if let Some(ContainerLogConfig {
-        choice: Some(ContainerLogConfigChoice::Automatic(log_config)),
-    }) = logging.containers.get(&Container::Vector)
-    {
-        Some(log_config)
-    } else {
-        None
+    let vector_log_config = match logging.containers.get(&Container::Vector) {
+        Some(ContainerLogConfig {
+            choice: Some(ContainerLogConfigChoice::Automatic(log_config)),
+        }) => Some(log_config),
+        _ => None,
     };
 
-    if logging.enable_vector_agent {
-        cm_builder.add_data(
-            product_logging::framework::VECTOR_CONFIG_FILE,
-            product_logging::framework::create_vector_config(rolegroup, vector_log_config),
-        );
-    }
+    Some(product_logging::framework::create_vector_config(
+        rolegroup,
+        vector_log_config,
+    ))
 }
 
 fn log4j_config(log_config: &AutomaticContainerLogConfig) -> String {

From 70b20e3a80181ca82d0bd0196dd0201de8867ad3 Mon Sep 17 00:00:00 2001
From: Malte Sander <malte.sander.it@gmail.com>
Date: Thu, 4 Jun 2026 13:11:35 +0200
Subject: [PATCH 16/21] chore: adapted changelog

---
 CHANGELOG.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0942934b..a6c906d1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,12 +16,15 @@
 - Internal operator refactoring: introduce dereference() and validate() steps in the reconciler ([#757]).
 - Removed the `product-config` dependency; configuration is now rendered from typed, validated inputs ([#757]).
 - test: Bump vector-aggregator to 0.55.0, replace /graphql call with gRPC call ([#762]).
+- BREAKING: Removed product-config machinery. This is a breaking change in terms of configuration.
+  Users relying on the product-config `properties.yaml` file have to set these properties via the CRD ([#765]).
 
 [#745]: https://github.com/stackabletech/hbase-operator/pull/745
 [#751]: https://github.com/stackabletech/hbase-operator/pull/751
 [#752]: https://github.com/stackabletech/hbase-operator/pull/752
 [#757]: https://github.com/stackabletech/hbase-operator/pull/757
 [#762]: https://github.com/stackabletech/hbase-operator/pull/762
+[#765]: https://github.com/stackabletech/hbase-operator/pull/765
 
 ## [26.3.0] - 2026-03-16
 

From aec271a1975ccc216800fc96c330078d0b568c5d Mon Sep 17 00:00:00 2001
From: Razvan-Daniel Mihai <84674+razvan@users.noreply.github.com>
Date: Thu, 4 Jun 2026 15:42:28 +0200
Subject: [PATCH 17/21] chore: replace json_pp with jq in getting started
 scripts

---
 .../hbase/examples/getting_started/getting_started.sh       | 6 +++---
 .../hbase/examples/getting_started/getting_started.sh.j2    | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/docs/modules/hbase/examples/getting_started/getting_started.sh b/docs/modules/hbase/examples/getting_started/getting_started.sh
index 319e36c8..580abc75 100755
--- a/docs/modules/hbase/examples/getting_started/getting_started.sh
+++ b/docs/modules/hbase/examples/getting_started/getting_started.sh
@@ -135,7 +135,7 @@ version() {
 echo "Check cluster status..."
 # tag::cluster-status[]
 kubectl exec -n default simple-hbase-restserver-default-0 \
--- curl -s -XGET -H "Accept: application/json" "http://simple-hbase-restserver-default-headless:8080/status/cluster" | json_pp
+-- curl -s -XGET -H "Accept: application/json" "http://simple-hbase-restserver-default-headless:8080/status/cluster" | jq
 # end::cluster-status[]
 
 echo "Check table via REST API..."
@@ -148,13 +148,13 @@ kubectl exec -n default simple-hbase-restserver-default-0 \
 
 # tag::get-table[]
 kubectl exec -n default simple-hbase-restserver-default-0 \
--- curl -s -XGET -H "Accept: application/json" "http://simple-hbase-restserver-default-headless:8080/users/schema" | json_pp
+-- curl -s -XGET -H "Accept: application/json" "http://simple-hbase-restserver-default-headless:8080/users/schema" | jq
 # end::get-table[]
 
 get_all() {
   # tag::get-tables[]
   kubectl exec -n default simple-hbase-restserver-default-0 \
-  -- curl -s -XGET -H "Accept: application/json" "http://simple-hbase-restserver-default-headless:8080/" |  json_pp
+  -- curl -s -XGET -H "Accept: application/json" "http://simple-hbase-restserver-default-headless:8080/" |  jq
   # end::get-tables[]
 }
 
diff --git a/docs/modules/hbase/examples/getting_started/getting_started.sh.j2 b/docs/modules/hbase/examples/getting_started/getting_started.sh.j2
index fefca39d..6852176c 100755
--- a/docs/modules/hbase/examples/getting_started/getting_started.sh.j2
+++ b/docs/modules/hbase/examples/getting_started/getting_started.sh.j2
@@ -135,7 +135,7 @@ version() {
 echo "Check cluster status..."
 # tag::cluster-status[]
 kubectl exec -n default simple-hbase-restserver-default-0 \
--- curl -s -XGET -H "Accept: application/json" "http://simple-hbase-restserver-default-headless:8080/status/cluster" | json_pp
+-- curl -s -XGET -H "Accept: application/json" "http://simple-hbase-restserver-default-headless:8080/status/cluster" | jq
 # end::cluster-status[]
 
 echo "Check table via REST API..."
@@ -148,13 +148,13 @@ kubectl exec -n default simple-hbase-restserver-default-0 \
 
 # tag::get-table[]
 kubectl exec -n default simple-hbase-restserver-default-0 \
--- curl -s -XGET -H "Accept: application/json" "http://simple-hbase-restserver-default-headless:8080/users/schema" | json_pp
+-- curl -s -XGET -H "Accept: application/json" "http://simple-hbase-restserver-default-headless:8080/users/schema" | jq
 # end::get-table[]
 
 get_all() {
   # tag::get-tables[]
   kubectl exec -n default simple-hbase-restserver-default-0 \
-  -- curl -s -XGET -H "Accept: application/json" "http://simple-hbase-restserver-default-headless:8080/" |  json_pp
+  -- curl -s -XGET -H "Accept: application/json" "http://simple-hbase-restserver-default-headless:8080/" |  jq
   # end::get-tables[]
 }
 

From 8b8c10447f1b3796b547ccd2c6cd297b759ad2be Mon Sep 17 00:00:00 2001
From: Razvan-Daniel Mihai <84674+razvan@users.noreply.github.com>
Date: Thu, 4 Jun 2026 19:28:19 +0200
Subject: [PATCH 18/21] add snapshot tests and make them succeed

---
 extra/crds.yaml                               |   4 +
 .../controller/build/properties/hbase_site.rs |   4 +-
 .../controller/build/properties/ssl_client.rs |  10 +-
 .../controller/build/properties/ssl_server.rs |  10 +-
 rust/operator-binary/src/crd/mod.rs           |  26 +++--
 tests/templates/kuttl/smoke/32-assert.yaml    |  40 +++++++
 .../32_cm-test-hbase-master-default.yaml.j2   | 105 ++++++++++++++++++
 ...cm-test-hbase-regionserver-default.yaml.j2 | 105 ++++++++++++++++++
 ...2_cm-test-hbase-restserver-default.yaml.j2 |  85 ++++++++++++++
 9 files changed, 358 insertions(+), 31 deletions(-)
 create mode 100644 tests/templates/kuttl/smoke/32-assert.yaml
 create mode 100644 tests/templates/kuttl/smoke/32_cm-test-hbase-master-default.yaml.j2
 create mode 100644 tests/templates/kuttl/smoke/32_cm-test-hbase-regionserver-default.yaml.j2
 create mode 100644 tests/templates/kuttl/smoke/32_cm-test-hbase-restserver-default.yaml.j2

diff --git a/extra/crds.yaml b/extra/crds.yaml
index 80a33e12..13eb43b5 100644
--- a/extra/crds.yaml
+++ b/extra/crds.yaml
@@ -242,6 +242,7 @@ spec:
                         nullable: true
                         type: string
                       hbaseRootdir:
+                        description: Root directory for Hbase on the filesystem (usually a path in HDFS). Default is `/hbase`.
                         nullable: true
                         type: string
                       listenerClass:
@@ -687,6 +688,7 @@ spec:
                               nullable: true
                               type: string
                             hbaseRootdir:
+                              description: Root directory for Hbase on the filesystem (usually a path in HDFS). Default is `/hbase`.
                               nullable: true
                               type: string
                             listenerClass:
@@ -2054,6 +2056,7 @@ spec:
                         nullable: true
                         type: string
                       hbaseRootdir:
+                        description: Root directory for Hbase on the filesystem (usually a path in HDFS). Default is `/hbase`.
                         nullable: true
                         type: string
                       listenerClass:
@@ -2499,6 +2502,7 @@ spec:
                               nullable: true
                               type: string
                             hbaseRootdir:
+                              description: Root directory for Hbase on the filesystem (usually a path in HDFS). Default is `/hbase`.
                               nullable: true
                               type: string
                             listenerClass:
diff --git a/rust/operator-binary/src/controller/build/properties/hbase_site.rs b/rust/operator-binary/src/controller/build/properties/hbase_site.rs
index 39e16420..3d7eea78 100644
--- a/rust/operator-binary/src/controller/build/properties/hbase_site.rs
+++ b/rust/operator-binary/src/controller/build/properties/hbase_site.rs
@@ -30,9 +30,7 @@ pub fn build(
 
     // Defaults previously injected by product-config's `compute_files`.
     config.insert(HBASE_CLUSTER_DISTRIBUTED.to_string(), "true".to_string());
-    if let Some(rootdir) = merged_config.hbase_rootdir() {
-        config.insert(HBASE_ROOTDIR.to_string(), rootdir);
-    }
+    config.insert(HBASE_ROOTDIR.to_string(), merged_config.hbase_rootdir());
 
     config.extend(zookeeper_config);
     config.extend(kerberos_config);
diff --git a/rust/operator-binary/src/controller/build/properties/ssl_client.rs b/rust/operator-binary/src/controller/build/properties/ssl_client.rs
index c6db3f50..83d0039d 100644
--- a/rust/operator-binary/src/controller/build/properties/ssl_client.rs
+++ b/rust/operator-binary/src/controller/build/properties/ssl_client.rs
@@ -5,14 +5,11 @@ use stackable_operator::v2::config_overrides::KeyValueConfigOverrides;
 
 use crate::{config::writer::to_hadoop_xml, controller::build::properties::resolved_overrides};
 
-/// Renders `ssl-client.xml`. Returns "" (HBase rejects empty XML files) when empty.
+/// Renders `ssl-client.xml`.
 pub fn build(settings: BTreeMap<String, String>, overrides: KeyValueConfigOverrides) -> String {
     let mut config: BTreeMap<String, Option<String>> = BTreeMap::new();
     config.extend(settings.into_iter().map(|(k, v)| (k, Some(v))));
     config.extend(resolved_overrides(overrides).map(|(k, v)| (k, Some(v))));
-    if config.is_empty() {
-        return String::new();
-    }
     to_hadoop_xml(config.iter())
 }
 
@@ -21,11 +18,6 @@ mod tests {
     use super::*;
     use crate::controller::build::properties::test_support::config_overrides;
 
-    #[test]
-    fn empty_settings_without_overrides_renders_empty_string() {
-        assert_eq!(build(BTreeMap::new(), config_overrides(&[])), "");
-    }
-
     #[test]
     fn settings_appear_in_xml() {
         let xml = build(
diff --git a/rust/operator-binary/src/controller/build/properties/ssl_server.rs b/rust/operator-binary/src/controller/build/properties/ssl_server.rs
index bd3bd911..2ae17e9b 100644
--- a/rust/operator-binary/src/controller/build/properties/ssl_server.rs
+++ b/rust/operator-binary/src/controller/build/properties/ssl_server.rs
@@ -5,14 +5,11 @@ use stackable_operator::v2::config_overrides::KeyValueConfigOverrides;
 
 use crate::{config::writer::to_hadoop_xml, controller::build::properties::resolved_overrides};
 
-/// Renders `ssl-server.xml`. Returns "" (HBase rejects empty XML files) when empty.
+/// Renders `ssl-server.xml`.
 pub fn build(settings: BTreeMap<String, String>, overrides: KeyValueConfigOverrides) -> String {
     let mut config: BTreeMap<String, Option<String>> = BTreeMap::new();
     config.extend(settings.into_iter().map(|(k, v)| (k, Some(v))));
     config.extend(resolved_overrides(overrides).map(|(k, v)| (k, Some(v))));
-    if config.is_empty() {
-        return String::new();
-    }
     to_hadoop_xml(config.iter())
 }
 
@@ -21,11 +18,6 @@ mod tests {
     use super::*;
     use crate::controller::build::properties::test_support::config_overrides;
 
-    #[test]
-    fn empty_settings_without_overrides_renders_empty_string() {
-        assert_eq!(build(BTreeMap::new(), config_overrides(&[])), "");
-    }
-
     #[test]
     fn settings_appear_in_xml() {
         let xml = build(
diff --git a/rust/operator-binary/src/crd/mod.rs b/rust/operator-binary/src/crd/mod.rs
index 564544d9..1d1a5036 100644
--- a/rust/operator-binary/src/crd/mod.rs
+++ b/rust/operator-binary/src/crd/mod.rs
@@ -60,6 +60,7 @@ pub const JVM_SECURITY_PROPERTIES_FILE: &str = "security.properties";
 
 pub const HBASE_CLUSTER_DISTRIBUTED: &str = "hbase.cluster.distributed";
 pub const HBASE_ROOTDIR: &str = "hbase.rootdir";
+const DEFAULT_HBASE_ROOTDIR: &str = "/hbase";
 
 const HBASE_UI_PORT_NAME_HTTP: &str = "ui-http";
 const HBASE_UI_PORT_NAME_HTTPS: &str = "ui-https";
@@ -87,6 +88,10 @@ const DEFAULT_REGION_MOVER_DELTA_TO_SHUTDOWN: Duration = Duration::from_minutes_
 
 const DEFAULT_LISTENER_CLASS: &str = "cluster-internal";
 
+fn default_hbase_rootdir() -> String {
+    DEFAULT_HBASE_ROOTDIR.to_string()
+}
+
 pub type MasterRoleType =
     Role<HbaseConfigFragment, v1alpha1::HbaseConfigOverrides, GenericRoleConfig, JavaCommonConfig>;
 
@@ -593,7 +598,7 @@ impl HbaseRole {
         };
 
         HbaseConfigFragment {
-            hbase_rootdir: None,
+            hbase_rootdir: Some(default_hbase_rootdir()),
             resources,
             logging: product_logging::spec::default_logging(),
             affinity: get_affinity(cluster_name, self, hdfs_discovery_cm_name),
@@ -796,7 +801,7 @@ impl AnyConfigFragment {
         match role {
             HbaseRole::RegionServer => {
                 AnyConfigFragment::RegionServer(RegionServerConfigFragment {
-                    hbase_rootdir: None,
+                    hbase_rootdir: Some(default_hbase_rootdir()),
                     resources: default_resources(role),
                     logging: product_logging::spec::default_logging(),
                     affinity: get_affinity(cluster_name, role, hdfs_discovery_cm_name),
@@ -814,7 +819,7 @@ impl AnyConfigFragment {
                 })
             }
             HbaseRole::RestServer => AnyConfigFragment::RestServer(HbaseConfigFragment {
-                hbase_rootdir: None,
+                hbase_rootdir: Some(default_hbase_rootdir()),
                 resources: default_resources(role),
                 logging: product_logging::spec::default_logging(),
                 affinity: get_affinity(cluster_name, role, hdfs_discovery_cm_name),
@@ -825,7 +830,7 @@ impl AnyConfigFragment {
                 listener_class: Some(DEFAULT_LISTENER_CLASS.to_string()),
             }),
             HbaseRole::Master => AnyConfigFragment::Master(HbaseConfigFragment {
-                hbase_rootdir: None,
+                hbase_rootdir: Some(default_hbase_rootdir()),
                 resources: default_resources(role),
                 logging: product_logging::spec::default_logging(),
                 affinity: get_affinity(cluster_name, role, hdfs_discovery_cm_name),
@@ -891,8 +896,9 @@ pub enum Container {
     serde(rename_all = "camelCase")
 )]
 pub struct HbaseConfig {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub hbase_rootdir: Option<String>,
+    /// Root directory for Hbase on the filesystem (usually a path in HDFS). Default is `/hbase`.
+    #[serde(default = "default_hbase_rootdir")]
+    pub hbase_rootdir: String,
 
     #[fragment_attrs(serde(default))]
     pub resources: Resources<HbaseStorageConfig, NoRuntimeLimits>,
@@ -971,8 +977,8 @@ impl Atomic for RegionMoverExtraCliOpts {}
     serde(rename_all = "camelCase")
 )]
 pub struct RegionServerConfig {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub hbase_rootdir: Option<String>,
+    #[serde(default = "default_hbase_rootdir")]
+    pub hbase_rootdir: String,
     #[fragment_attrs(serde(default))]
     pub resources: Resources<HbaseStorageConfig, NoRuntimeLimits>,
     #[fragment_attrs(serde(default))]
@@ -1064,9 +1070,9 @@ impl AnyServiceConfig {
         }
     }
 
-    /// The configured `hbase.rootdir`, if any. Previously injected into
+    /// The configured `hbase.rootdir`. Previously injected into
     /// `hbase-site.xml` via product-config's `compute_files`.
-    pub fn hbase_rootdir(&self) -> Option<String> {
+    pub fn hbase_rootdir(&self) -> String {
         match self {
             AnyServiceConfig::Master(config) => config.hbase_rootdir.clone(),
             AnyServiceConfig::RegionServer(config) => config.hbase_rootdir.clone(),
diff --git a/tests/templates/kuttl/smoke/32-assert.yaml b/tests/templates/kuttl/smoke/32-assert.yaml
new file mode 100644
index 00000000..230ffd91
--- /dev/null
+++ b/tests/templates/kuttl/smoke/32-assert.yaml
@@ -0,0 +1,40 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+timeout: 60
+commands:
+  #
+  # ConfigMap data snapshot: test-hbase-master-default
+  #
+  - script: |
+      export ZNODE_PATH=$(kubectl -n $NAMESPACE get zookeeperznode test-znode -o jsonpath='{.status.znodePath}')
+      envsubst '$NAMESPACE $ZNODE_PATH' < 32_cm-test-hbase-master-default.yaml > /tmp/$NAMESPACE-expected.yaml
+      kubectl -n $NAMESPACE get cm test-hbase-master-default -o yaml | yq '.data' > /tmp/$NAMESPACE-actual.yaml
+      if ! diff /tmp/$NAMESPACE-expected.yaml /tmp/$NAMESPACE-actual.yaml; then
+        echo "ERROR: ConfigMap test-hbase-master-default data drifted from snapshot."
+        exit 1
+      fi
+
+  #
+  # ConfigMap data snapshot: test-hbase-regionserver-default
+  #
+  - script: |
+      export ZNODE_PATH=$(kubectl -n $NAMESPACE get zookeeperznode test-znode -o jsonpath='{.status.znodePath}')
+      envsubst '$NAMESPACE $ZNODE_PATH' < 32_cm-test-hbase-regionserver-default.yaml > /tmp/$NAMESPACE-expected.yaml
+      kubectl -n $NAMESPACE get cm test-hbase-regionserver-default -o yaml | yq '.data' > /tmp/$NAMESPACE-actual.yaml
+      if ! diff /tmp/$NAMESPACE-expected.yaml /tmp/$NAMESPACE-actual.yaml; then
+        echo "ERROR: ConfigMap test-hbase-regionserver-default data drifted from snapshot."
+        exit 1
+      fi
+
+  #
+  # ConfigMap data snapshot: test-hbase-restserver-default
+  #
+  - script: |
+      export ZNODE_PATH=$(kubectl -n $NAMESPACE get zookeeperznode test-znode -o jsonpath='{.status.znodePath}')
+      envsubst '$NAMESPACE $ZNODE_PATH' < 32_cm-test-hbase-restserver-default.yaml > /tmp/$NAMESPACE-expected.yaml
+      kubectl -n $NAMESPACE get cm test-hbase-restserver-default -o yaml | yq '.data' > /tmp/$NAMESPACE-actual.yaml
+      if ! diff /tmp/$NAMESPACE-expected.yaml /tmp/$NAMESPACE-actual.yaml; then
+        echo "ERROR: ConfigMap test-hbase-restserver-default data drifted from snapshot."
+        exit 1
+      fi
diff --git a/tests/templates/kuttl/smoke/32_cm-test-hbase-master-default.yaml.j2 b/tests/templates/kuttl/smoke/32_cm-test-hbase-master-default.yaml.j2
new file mode 100644
index 00000000..adadeee8
--- /dev/null
+++ b/tests/templates/kuttl/smoke/32_cm-test-hbase-master-default.yaml.j2
@@ -0,0 +1,105 @@
+hbase-env.sh: |
+  export HBASE_HEAPSIZE="819m"
+  export HBASE_MANAGES_ZK="false"
+  export HBASE_MASTER_OPTS="-Djava.security.properties=/stackable/conf/security.properties"
+  export HBASE_OPTS=""
+hbase-site.xml: |-
+  <?xml version="1.0"?>
+  <configuration>
+    <property>
+      <name>hbase.client.rpc.bind.address</name>
+      <value>false</value>
+    </property>
+    <property>
+      <name>hbase.cluster.distributed</name>
+      <value>true</value>
+    </property>
+    <property>
+      <name>hbase.master.bound.info.port</name>
+      <value>16010</value>
+    </property>
+    <property>
+      <name>hbase.master.hostname</name>
+      <value>${env:HBASE_SERVICE_HOST}</value>
+    </property>
+    <property>
+      <name>hbase.master.info.port</name>
+      <value>${env:HBASE_INFO_PORT}</value>
+    </property>
+    <property>
+      <name>hbase.master.ipc.address</name>
+      <value>0.0.0.0</value>
+    </property>
+    <property>
+      <name>hbase.master.ipc.port</name>
+      <value>16000</value>
+    </property>
+    <property>
+      <name>hbase.master.port</name>
+      <value>${env:HBASE_SERVICE_PORT}</value>
+    </property>
+    <property>
+      <name>hbase.regionserver.wal.codec</name>
+      <value>org.apache.hadoop.hbase.regionserver.wal.IndexedWALEditCodec</value>
+    </property>
+    <property>
+      <name>hbase.rootdir</name>
+      <value>/hbase</value>
+    </property>
+    <property>
+      <name>hbase.zookeeper.property.clientPort</name>
+      <value>2282</value>
+    </property>
+    <property>
+      <name>hbase.zookeeper.quorum</name>
+      <value>test-zk-server.$NAMESPACE.svc.cluster.local:2282</value>
+    </property>
+    <property>
+      <name>phoenix.log.saltBuckets</name>
+      <value>2</value>
+    </property>
+    <property>
+      <name>zookeeper.znode.parent</name>
+      <value>$ZNODE_PATH/hbase</value>
+    </property>
+  </configuration>
+log4j2.properties: |-
+  appenders = FILE, CONSOLE
+
+  appender.CONSOLE.type = Console
+  appender.CONSOLE.name = CONSOLE
+  appender.CONSOLE.target = SYSTEM_ERR
+  appender.CONSOLE.layout.type = PatternLayout
+  appender.CONSOLE.layout.pattern = %d{ISO8601} %-5p [%t] %c{2}: %.1000m%n
+  appender.CONSOLE.filter.threshold.type = ThresholdFilter
+  appender.CONSOLE.filter.threshold.level = INFO
+
+  appender.FILE.type = RollingFile
+  appender.FILE.name = FILE
+  appender.FILE.fileName = /stackable/log/hbase/hbase.log4j2.xml
+  appender.FILE.filePattern = /stackable/log/hbase/hbase.log4j2.xml.%i
+  appender.FILE.layout.type = XMLLayout
+  appender.FILE.policies.type = Policies
+  appender.FILE.policies.size.type = SizeBasedTriggeringPolicy
+  appender.FILE.policies.size.size = 5MB
+  appender.FILE.strategy.type = DefaultRolloverStrategy
+  appender.FILE.strategy.max = 1
+  appender.FILE.filter.threshold.type = ThresholdFilter
+  appender.FILE.filter.threshold.level = INFO
+
+
+  rootLogger.level=INFO
+  rootLogger.appenderRefs = CONSOLE, FILE
+  rootLogger.appenderRef.CONSOLE.ref = CONSOLE
+  rootLogger.appenderRef.FILE.ref = FILE
+security.properties: |
+  networkaddress.cache.negative.ttl=0
+  networkaddress.cache.ttl=5
+ssl-client.xml: |-
+  <?xml version="1.0"?>
+  <configuration>
+  </configuration>
+ssl-server.xml: |-
+  <?xml version="1.0"?>
+  <configuration>
+  </configuration>
diff --git a/tests/templates/kuttl/smoke/32_cm-test-hbase-regionserver-default.yaml.j2 b/tests/templates/kuttl/smoke/32_cm-test-hbase-regionserver-default.yaml.j2
new file mode 100644
index 00000000..5b44d0ca
--- /dev/null
+++ b/tests/templates/kuttl/smoke/32_cm-test-hbase-regionserver-default.yaml.j2
@@ -0,0 +1,105 @@
+hbase-env.sh: |
+  export HBASE_HEAPSIZE="819m"
+  export HBASE_MANAGES_ZK="false"
+  export HBASE_OPTS=""
+  export HBASE_REGIONSERVER_OPTS="-Djava.security.properties=/stackable/conf/security.properties"
+hbase-site.xml: |-
+  <?xml version="1.0"?>
+  <configuration>
+    <property>
+      <name>hbase.client.rpc.bind.address</name>
+      <value>false</value>
+    </property>
+    <property>
+      <name>hbase.cluster.distributed</name>
+      <value>true</value>
+    </property>
+    <property>
+      <name>hbase.regionserver.bound.info.port</name>
+      <value>16030</value>
+    </property>
+    <property>
+      <name>hbase.regionserver.info.port</name>
+      <value>${env:HBASE_INFO_PORT}</value>
+    </property>
+    <property>
+      <name>hbase.regionserver.ipc.address</name>
+      <value>0.0.0.0</value>
+    </property>
+    <property>
+      <name>hbase.regionserver.ipc.port</name>
+      <value>16020</value>
+    </property>
+    <property>
+      <name>hbase.regionserver.port</name>
+      <value>${env:HBASE_SERVICE_PORT}</value>
+    </property>
+    <property>
+      <name>hbase.regionserver.wal.codec</name>
+      <value>org.apache.hadoop.hbase.regionserver.wal.IndexedWALEditCodec</value>
+    </property>
+    <property>
+      <name>hbase.rootdir</name>
+      <value>/hbase</value>
+    </property>
+    <property>
+      <name>hbase.unsafe.regionserver.hostname</name>
+      <value>${env:HBASE_SERVICE_HOST}</value>
+    </property>
+    <property>
+      <name>hbase.zookeeper.property.clientPort</name>
+      <value>2282</value>
+    </property>
+    <property>
+      <name>hbase.zookeeper.quorum</name>
+      <value>test-zk-server.$NAMESPACE.svc.cluster.local:2282</value>
+    </property>
+    <property>
+      <name>phoenix.log.saltBuckets</name>
+      <value>2</value>
+    </property>
+    <property>
+      <name>zookeeper.znode.parent</name>
+      <value>$ZNODE_PATH/hbase</value>
+    </property>
+  </configuration>
+log4j2.properties: |-
+  appenders = FILE, CONSOLE
+
+  appender.CONSOLE.type = Console
+  appender.CONSOLE.name = CONSOLE
+  appender.CONSOLE.target = SYSTEM_ERR
+  appender.CONSOLE.layout.type = PatternLayout
+  appender.CONSOLE.layout.pattern = %d{ISO8601} %-5p [%t] %c{2}: %.1000m%n
+  appender.CONSOLE.filter.threshold.type = ThresholdFilter
+  appender.CONSOLE.filter.threshold.level = INFO
+
+  appender.FILE.type = RollingFile
+  appender.FILE.name = FILE
+  appender.FILE.fileName = /stackable/log/hbase/hbase.log4j2.xml
+  appender.FILE.filePattern = /stackable/log/hbase/hbase.log4j2.xml.%i
+  appender.FILE.layout.type = XMLLayout
+  appender.FILE.policies.type = Policies
+  appender.FILE.policies.size.type = SizeBasedTriggeringPolicy
+  appender.FILE.policies.size.size = 5MB
+  appender.FILE.strategy.type = DefaultRolloverStrategy
+  appender.FILE.strategy.max = 1
+  appender.FILE.filter.threshold.type = ThresholdFilter
+  appender.FILE.filter.threshold.level = INFO
+
+
+  rootLogger.level=INFO
+  rootLogger.appenderRefs = CONSOLE, FILE
+  rootLogger.appenderRef.CONSOLE.ref = CONSOLE
+  rootLogger.appenderRef.FILE.ref = FILE
+security.properties: |
+  networkaddress.cache.negative.ttl=0
+  networkaddress.cache.ttl=10
+ssl-client.xml: |-
+  <?xml version="1.0"?>
+  <configuration>
+  </configuration>
+ssl-server.xml: |-
+  <?xml version="1.0"?>
+  <configuration>
+  </configuration>
diff --git a/tests/templates/kuttl/smoke/32_cm-test-hbase-restserver-default.yaml.j2 b/tests/templates/kuttl/smoke/32_cm-test-hbase-restserver-default.yaml.j2
new file mode 100644
index 00000000..c38c12b1
--- /dev/null
+++ b/tests/templates/kuttl/smoke/32_cm-test-hbase-restserver-default.yaml.j2
@@ -0,0 +1,85 @@
+hbase-env.sh: |
+  export HBASE_HEAPSIZE="819m"
+  export HBASE_MANAGES_ZK="false"
+  export HBASE_OPTS=""
+  export HBASE_REST_OPTS="-Djava.security.properties=/stackable/conf/security.properties"
+hbase-site.xml: |-
+  <?xml version="1.0"?>
+  <configuration>
+    <property>
+      <name>hbase.client.rpc.bind.address</name>
+      <value>false</value>
+    </property>
+    <property>
+      <name>hbase.cluster.distributed</name>
+      <value>true</value>
+    </property>
+    <property>
+      <name>hbase.regionserver.wal.codec</name>
+      <value>org.apache.hadoop.hbase.regionserver.wal.IndexedWALEditCodec</value>
+    </property>
+    <property>
+      <name>hbase.rest.endpoint</name>
+      <value>${env:HBASE_SERVICE_HOST}:${env:HBASE_SERVICE_PORT}</value>
+    </property>
+    <property>
+      <name>hbase.rootdir</name>
+      <value>/hbase</value>
+    </property>
+    <property>
+      <name>hbase.zookeeper.property.clientPort</name>
+      <value>2282</value>
+    </property>
+    <property>
+      <name>hbase.zookeeper.quorum</name>
+      <value>test-zk-server.$NAMESPACE.svc.cluster.local:2282</value>
+    </property>
+    <property>
+      <name>phoenix.log.saltBuckets</name>
+      <value>2</value>
+    </property>
+    <property>
+      <name>zookeeper.znode.parent</name>
+      <value>$ZNODE_PATH/hbase</value>
+    </property>
+  </configuration>
+log4j2.properties: |-
+  appenders = FILE, CONSOLE
+
+  appender.CONSOLE.type = Console
+  appender.CONSOLE.name = CONSOLE
+  appender.CONSOLE.target = SYSTEM_ERR
+  appender.CONSOLE.layout.type = PatternLayout
+  appender.CONSOLE.layout.pattern = %d{ISO8601} %-5p [%t] %c{2}: %.1000m%n
+  appender.CONSOLE.filter.threshold.type = ThresholdFilter
+  appender.CONSOLE.filter.threshold.level = INFO
+
+  appender.FILE.type = RollingFile
+  appender.FILE.name = FILE
+  appender.FILE.fileName = /stackable/log/hbase/hbase.log4j2.xml
+  appender.FILE.filePattern = /stackable/log/hbase/hbase.log4j2.xml.%i
+  appender.FILE.layout.type = XMLLayout
+  appender.FILE.policies.type = Policies
+  appender.FILE.policies.size.type = SizeBasedTriggeringPolicy
+  appender.FILE.policies.size.size = 5MB
+  appender.FILE.strategy.type = DefaultRolloverStrategy
+  appender.FILE.strategy.max = 1
+  appender.FILE.filter.threshold.type = ThresholdFilter
+  appender.FILE.filter.threshold.level = INFO
+
+
+  rootLogger.level=INFO
+  rootLogger.appenderRefs = CONSOLE, FILE
+  rootLogger.appenderRef.CONSOLE.ref = CONSOLE
+  rootLogger.appenderRef.FILE.ref = FILE
+security.properties: |
+  networkaddress.cache.negative.ttl=0
+  networkaddress.cache.ttl=30
+ssl-client.xml: |-
+  <?xml version="1.0"?>
+  <configuration>
+  </configuration>
+ssl-server.xml: |-
+  <?xml version="1.0"?>
+  <configuration>
+  </configuration>

From 1523e25c87f69b594bcd026ba2563ab783f94462 Mon Sep 17 00:00:00 2001
From: Andrew Kenworthy <andrew.kenworthy@stackable.tech>
Date: Fri, 5 Jun 2026 16:08:11 +0200
Subject: [PATCH 19/21] refactor: consume the config-file writer from
 stackable-operator

Replace the vendored java-properties/Hadoop-XML writer
(rust/operator-binary/src/config/writer.rs) with
stackable_operator::v2::config_file_writer, which hosts the same code
(moved there verbatim via operator-rs #1217 on the smooth-operator branch;
hbase's copy was byte-identical to hdfs's, the canonical source). Drop the
now-unused java-properties and xml dependencies.

No behaviour change; rendered output is byte-identical by construction
(same code, new home).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 Cargo.lock                                    |  88 ++++--
 Cargo.nix                                     | 299 ++++++++++--------
 Cargo.toml                                    |   2 -
 crate-hashes.json                             |   4 +-
 rust/operator-binary/Cargo.toml               |   2 -
 rust/operator-binary/src/config/mod.rs        |   1 -
 rust/operator-binary/src/config/writer.rs     | 145 ---------
 .../src/controller/build/config_map.rs        |   2 +-
 .../src/controller/build/discovery.rs         |   2 +-
 .../controller/build/properties/hbase_site.rs |   5 +-
 .../src/controller/build/properties/mod.rs    |   4 +-
 .../build/properties/security_properties.rs   |  11 +-
 .../controller/build/properties/ssl_client.rs |   6 +-
 .../controller/build/properties/ssl_server.rs |   6 +-
 14 files changed, 245 insertions(+), 332 deletions(-)
 delete mode 100644 rust/operator-binary/src/config/writer.rs

diff --git a/Cargo.lock b/Cargo.lock
index 814820ac..4b9e0936 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1515,7 +1515,7 @@ dependencies = [
 [[package]]
 name = "k8s-version"
 version = "0.1.3"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#a31cd2514445b251038fc4ea7abc28c57b2a6ad9"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#46cd3f93a788d44d177a8794fde91fbefa3156d7"
 dependencies = [
  "darling",
  "regex",
@@ -1840,9 +1840,9 @@ checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
 [[package]]
 name = "opentelemetry"
-version = "0.31.0"
+version = "0.32.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b84bcd6ae87133e903af7ef497404dda70c60d0ea14895fc8a5e6722754fc2a0"
+checksum = "b0142c63252a9e054e68a4c61a5778f7b14f576274d593f8ce883d191a099682"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -1854,9 +1854,9 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry-appender-tracing"
-version = "0.31.1"
+version = "0.32.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef6a1ac5ca3accf562b8c306fa8483c85f4390f768185ab775f242f7fe8fdcc2"
+checksum = "2c0080f0dc1d7c786f467cd85a4e395fcab11ee852004f39a29a18ab7c25d837"
 dependencies = [
  "opentelemetry",
  "tracing",
@@ -1866,9 +1866,9 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry-http"
-version = "0.31.0"
+version = "0.32.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7a6d09a73194e6b66df7c8f1b680f156d916a1a942abf2de06823dd02b7855d"
+checksum = "5683015d09e2df236ef005b17f6f196f0d5f6313c4fa43a7b6a53b52776e4331"
 dependencies = [
  "async-trait",
  "bytes",
@@ -1879,9 +1879,9 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry-otlp"
-version = "0.31.1"
+version = "0.32.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f69cd6acbb9af919df949cd1ec9e5e7fdc2ef15d234b6b795aaa525cc02f71f"
+checksum = "9966929966d17620d7c316c643ba62631826e10021409357772d5eea84f62c35"
 dependencies = [
  "http",
  "opentelemetry",
@@ -1893,14 +1893,14 @@ dependencies = [
  "thiserror 2.0.18",
  "tokio",
  "tonic",
- "tracing",
+ "tonic-types",
 ]
 
 [[package]]
 name = "opentelemetry-proto"
-version = "0.31.0"
+version = "0.32.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7175df06de5eaee9909d4805a3d07e28bb752c34cab57fa9cff549da596b30f"
+checksum = "56d658ba1faf63f7b9c492cfbe6e0ec365440a16132d3270c1065f7b33f1b638"
 dependencies = [
  "opentelemetry",
  "opentelemetry_sdk",
@@ -1911,21 +1911,22 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry-semantic-conventions"
-version = "0.31.0"
+version = "0.32.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e62e29dfe041afb8ed2a6c9737ab57db4907285d999ef8ad3a59092a36bdc846"
+checksum = "6ca2f98a0437b427b4b08f19f1caa3c44db885a202bc12cfea13d6c702243d68"
 
 [[package]]
 name = "opentelemetry_sdk"
-version = "0.31.0"
+version = "0.32.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e14ae4f5991976fd48df6d843de219ca6d31b01daaab2dad5af2badeded372bd"
+checksum = "9b59f80e1ac4d5ff7a2db8fb6c80badb7f0f3f858211fba08dd9aaec750894f9"
 dependencies = [
  "futures-channel",
  "futures-executor",
  "futures-util",
  "opentelemetry",
  "percent-encoding",
+ "portable-atomic",
  "rand 0.9.4",
  "thiserror 2.0.18",
  "tokio",
@@ -2208,6 +2209,15 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "prost-types"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8991c4cbdb8bc5b11f0b074ffe286c30e523de90fee5ba8132f1399f23cb3dd7"
+dependencies = [
+ "prost",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.45"
@@ -2347,9 +2357,9 @@ checksum = "ba39f3699c378cd8970968dcbff9c43159ea4cfbd88d43c00b22f2ef10a435d2"
 
 [[package]]
 name = "reqwest"
-version = "0.12.28"
+version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
 dependencies = [
  "base64",
  "bytes",
@@ -2365,9 +2375,6 @@ dependencies = [
  "log",
  "percent-encoding",
  "pin-project-lite",
- "serde",
- "serde_json",
- "serde_urlencoded",
  "sync_wrapper",
  "tokio",
  "tower",
@@ -2893,7 +2900,7 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 [[package]]
 name = "stackable-certs"
 version = "0.4.0"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#a31cd2514445b251038fc4ea7abc28c57b2a6ad9"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#46cd3f93a788d44d177a8794fde91fbefa3156d7"
 dependencies = [
  "const-oid",
  "ecdsa",
@@ -2925,7 +2932,6 @@ dependencies = [
  "fnv",
  "futures 0.3.32",
  "indoc",
- "java-properties",
  "rstest",
  "serde",
  "serde_json",
@@ -2936,13 +2942,12 @@ dependencies = [
  "strum",
  "tokio",
  "tracing",
- "xml",
 ]
 
 [[package]]
 name = "stackable-operator"
 version = "0.111.1"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#a31cd2514445b251038fc4ea7abc28c57b2a6ad9"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#46cd3f93a788d44d177a8794fde91fbefa3156d7"
 dependencies = [
  "base64",
  "clap",
@@ -2954,6 +2959,7 @@ dependencies = [
  "futures 0.3.32",
  "http",
  "indexmap",
+ "java-properties",
  "jiff",
  "json-patch",
  "k8s-openapi",
@@ -2979,12 +2985,13 @@ dependencies = [
  "tracing-subscriber",
  "url",
  "uuid",
+ "xml",
 ]
 
 [[package]]
 name = "stackable-operator-derive"
 version = "0.3.1"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#a31cd2514445b251038fc4ea7abc28c57b2a6ad9"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#46cd3f93a788d44d177a8794fde91fbefa3156d7"
 dependencies = [
  "darling",
  "proc-macro2",
@@ -2994,8 +3001,8 @@ dependencies = [
 
 [[package]]
 name = "stackable-shared"
-version = "0.1.0"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#a31cd2514445b251038fc4ea7abc28c57b2a6ad9"
+version = "0.1.1"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#46cd3f93a788d44d177a8794fde91fbefa3156d7"
 dependencies = [
  "jiff",
  "k8s-openapi",
@@ -3011,8 +3018,8 @@ dependencies = [
 
 [[package]]
 name = "stackable-telemetry"
-version = "0.6.3"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#a31cd2514445b251038fc4ea7abc28c57b2a6ad9"
+version = "0.6.4"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#46cd3f93a788d44d177a8794fde91fbefa3156d7"
 dependencies = [
  "axum",
  "clap",
@@ -3036,7 +3043,7 @@ dependencies = [
 [[package]]
 name = "stackable-versioned"
 version = "0.10.0"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#a31cd2514445b251038fc4ea7abc28c57b2a6ad9"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#46cd3f93a788d44d177a8794fde91fbefa3156d7"
 dependencies = [
  "kube",
  "schemars",
@@ -3050,7 +3057,7 @@ dependencies = [
 [[package]]
 name = "stackable-versioned-macros"
 version = "0.10.0"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#a31cd2514445b251038fc4ea7abc28c57b2a6ad9"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#46cd3f93a788d44d177a8794fde91fbefa3156d7"
 dependencies = [
  "convert_case",
  "convert_case_extras",
@@ -3068,7 +3075,7 @@ dependencies = [
 [[package]]
 name = "stackable-webhook"
 version = "0.9.1"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#a31cd2514445b251038fc4ea7abc28c57b2a6ad9"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#46cd3f93a788d44d177a8794fde91fbefa3156d7"
 dependencies = [
  "arc-swap",
  "async-trait",
@@ -3420,6 +3427,17 @@ dependencies = [
  "tonic",
 ]
 
+[[package]]
+name = "tonic-types"
+version = "0.14.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73ab1b02061f83d519bba3caa167f88f261ef05720ab8ebc954ade70de3348e8"
+dependencies = [
+ "prost",
+ "prost-types",
+ "tonic",
+]
+
 [[package]]
 name = "tower"
 version = "0.5.3"
@@ -3531,9 +3549,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-opentelemetry"
-version = "0.32.1"
+version = "0.33.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ac28f2d093c6c477eaa76b23525478f38de514fa9aeb1285738d4b97a9552fc"
+checksum = "adbc64cba7137545b8044cb1fe9814f7aacf3c6b5f9b45be8bb5db538befdb26"
 dependencies = [
  "js-sys",
  "opentelemetry",
diff --git a/Cargo.nix b/Cargo.nix
index cd85e73e..5fac81a9 100644
--- a/Cargo.nix
+++ b/Cargo.nix
@@ -4831,7 +4831,7 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
-          rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
+          rev = "46cd3f93a788d44d177a8794fde91fbefa3156d7";
           sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         libName = "k8s_version";
@@ -6031,9 +6031,9 @@ rec {
       };
       "opentelemetry" = rec {
         crateName = "opentelemetry";
-        version = "0.31.0";
+        version = "0.32.0";
         edition = "2021";
-        sha256 = "18629xsj4rsyiby9aj511q6wcw6s9m09gx3ymw1yjcvix1mcsjxq";
+        sha256 = "10ln14d1jgc8rvw97mblc9blzcgpg1bimim4d170b7ia4mijq55h";
         dependencies = [
           {
             name = "futures-core";
@@ -6070,24 +6070,24 @@ rec {
         ];
         features = {
           "default" = [ "trace" "metrics" "logs" "internal-logs" "futures" ];
+          "experimental_metrics_bound_instruments" = [ "metrics" ];
           "futures" = [ "futures-core" "futures-sink" "pin-project-lite" ];
           "futures-core" = [ "dep:futures-core" ];
           "futures-sink" = [ "dep:futures-sink" ];
           "internal-logs" = [ "tracing" ];
           "pin-project-lite" = [ "dep:pin-project-lite" ];
-          "spec_unstable_logs_enabled" = [ "logs" ];
           "testing" = [ "trace" ];
           "thiserror" = [ "dep:thiserror" ];
           "trace" = [ "futures" "thiserror" ];
           "tracing" = [ "dep:tracing" ];
         };
-        resolvedDefaultFeatures = [ "default" "futures" "futures-core" "futures-sink" "internal-logs" "logs" "metrics" "pin-project-lite" "spec_unstable_logs_enabled" "thiserror" "trace" "tracing" ];
+        resolvedDefaultFeatures = [ "default" "futures" "futures-core" "futures-sink" "internal-logs" "logs" "metrics" "pin-project-lite" "thiserror" "trace" "tracing" ];
       };
       "opentelemetry-appender-tracing" = rec {
         crateName = "opentelemetry-appender-tracing";
-        version = "0.31.1";
+        version = "0.32.0";
         edition = "2021";
-        sha256 = "1hnwizzgfhpjfnvml638yy846py8hf2gl1n3p1igbk1srb2ilspg";
+        sha256 = "0dyq4myan64sl8wly02jx0gb3jjz7575mn3w8rpphz0xvkq8001c";
         libName = "opentelemetry_appender_tracing";
         dependencies = [
           {
@@ -6130,18 +6130,15 @@ rec {
         ];
         features = {
           "experimental_metadata_attributes" = [ "dep:tracing-log" ];
-          "experimental_use_tracing_span_context" = [ "tracing-opentelemetry" ];
           "log" = [ "dep:log" ];
-          "spec_unstable_logs_enabled" = [ "opentelemetry/spec_unstable_logs_enabled" ];
-          "tracing-opentelemetry" = [ "dep:tracing-opentelemetry" ];
         };
         resolvedDefaultFeatures = [ "default" ];
       };
       "opentelemetry-http" = rec {
         crateName = "opentelemetry-http";
-        version = "0.31.0";
+        version = "0.32.0";
         edition = "2021";
-        sha256 = "0pc5nw1ds8v8w0nvyall39m92v8m1xl1p3vwvxk6nkhrffdd19np";
+        sha256 = "0ca3drvm4fx5nskl7yn42dimy3bg35ppzc85y1p27pz215fh30sn";
         libName = "opentelemetry_http";
         dependencies = [
           {
@@ -6177,16 +6174,16 @@ rec {
           "internal-logs" = [ "opentelemetry/internal-logs" ];
           "reqwest" = [ "dep:reqwest" ];
           "reqwest-blocking" = [ "dep:reqwest" "reqwest/blocking" ];
-          "reqwest-rustls" = [ "dep:reqwest" "reqwest/rustls-tls-native-roots" ];
-          "reqwest-rustls-webpki-roots" = [ "dep:reqwest" "reqwest/rustls-tls-webpki-roots" ];
+          "reqwest-rustls" = [ "dep:reqwest" "reqwest/default-tls" ];
+          "reqwest-rustls-webpki-roots" = [ "dep:reqwest" "reqwest/default-tls" "reqwest/webpki-roots" ];
         };
-        resolvedDefaultFeatures = [ "internal-logs" "reqwest" "reqwest-blocking" ];
+        resolvedDefaultFeatures = [ "reqwest" "reqwest-blocking" ];
       };
       "opentelemetry-otlp" = rec {
         crateName = "opentelemetry-otlp";
-        version = "0.31.1";
+        version = "0.32.0";
         edition = "2021";
-        sha256 = "07zp0b62b9dajnvvcd6j2ppw5zg7wp4ixka9z6fr3bxrrdmcss8z";
+        sha256 = "0d9cys2flpidfxbr6h1103hjc633cax47ihnqgbj0xnicscr4rlr";
         libName = "opentelemetry_otlp";
         dependencies = [
           {
@@ -6247,10 +6244,9 @@ rec {
             usesDefaultFeatures = false;
           }
           {
-            name = "tracing";
-            packageId = "tracing";
+            name = "tonic-types";
+            packageId = "tonic-types";
             optional = true;
-            usesDefaultFeatures = false;
           }
         ];
         devDependencies = [
@@ -6275,16 +6271,19 @@ rec {
         ];
         features = {
           "default" = [ "http-proto" "reqwest-blocking-client" "trace" "metrics" "logs" "internal-logs" ];
+          "experimental-grpc-retry" = [ "grpc-tonic" "opentelemetry_sdk/experimental_async_runtime" "opentelemetry_sdk/rt-tokio" ];
+          "experimental-http-retry" = [ "opentelemetry_sdk/experimental_async_runtime" "opentelemetry_sdk/rt-tokio" "tokio" "httpdate" ];
           "flate2" = [ "dep:flate2" ];
-          "grpc-tonic" = [ "tonic" "prost" "http" "tokio" "opentelemetry-proto/gen-tonic" ];
+          "grpc-tonic" = [ "tonic" "tonic-types" "prost" "http" "tokio" "opentelemetry-proto/gen-tonic" ];
           "gzip-http" = [ "flate2" ];
           "gzip-tonic" = [ "tonic/gzip" ];
           "http" = [ "dep:http" ];
           "http-json" = [ "serde_json" "prost" "opentelemetry-http" "opentelemetry-proto/gen-tonic-messages" "opentelemetry-proto/with-serde" "http" "trace" "metrics" ];
           "http-proto" = [ "prost" "opentelemetry-http" "opentelemetry-proto/gen-tonic-messages" "http" "trace" "metrics" ];
+          "httpdate" = [ "dep:httpdate" ];
           "hyper-client" = [ "opentelemetry-http/hyper" ];
           "integration-testing" = [ "tonic" "prost" "tokio/full" "trace" "logs" ];
-          "internal-logs" = [ "tracing" "opentelemetry_sdk/internal-logs" "opentelemetry-http/internal-logs" ];
+          "internal-logs" = [ "opentelemetry_sdk/internal-logs" "opentelemetry/internal-logs" ];
           "logs" = [ "opentelemetry/logs" "opentelemetry_sdk/logs" "opentelemetry-proto/logs" ];
           "metrics" = [ "opentelemetry/metrics" "opentelemetry_sdk/metrics" "opentelemetry-proto/metrics" ];
           "opentelemetry-http" = [ "dep:opentelemetry-http" ];
@@ -6297,27 +6296,27 @@ rec {
           "serde" = [ "dep:serde" ];
           "serde_json" = [ "dep:serde_json" ];
           "serialize" = [ "serde" "serde_json" ];
-          "tls" = [ "tonic/tls-ring" ];
+          "tls" = [ "tls-ring" ];
           "tls-aws-lc" = [ "tonic/tls-aws-lc" ];
           "tls-provider-agnostic" = [ "tonic/_tls-any" ];
           "tls-ring" = [ "tonic/tls-ring" ];
-          "tls-roots" = [ "tls" "tonic/tls-native-roots" ];
-          "tls-webpki-roots" = [ "tls" "tonic/tls-webpki-roots" ];
+          "tls-roots" = [ "tonic/tls-native-roots" ];
+          "tls-webpki-roots" = [ "tonic/tls-webpki-roots" ];
           "tokio" = [ "dep:tokio" ];
           "tonic" = [ "dep:tonic" ];
+          "tonic-types" = [ "dep:tonic-types" ];
           "trace" = [ "opentelemetry/trace" "opentelemetry_sdk/trace" "opentelemetry-proto/trace" ];
-          "tracing" = [ "dep:tracing" ];
           "zstd" = [ "dep:zstd" ];
           "zstd-http" = [ "zstd" ];
           "zstd-tonic" = [ "tonic/zstd" ];
         };
-        resolvedDefaultFeatures = [ "default" "grpc-tonic" "gzip-tonic" "http" "http-proto" "internal-logs" "logs" "metrics" "opentelemetry-http" "prost" "reqwest" "reqwest-blocking-client" "tokio" "tonic" "trace" "tracing" ];
+        resolvedDefaultFeatures = [ "default" "grpc-tonic" "gzip-tonic" "http" "http-proto" "internal-logs" "logs" "metrics" "opentelemetry-http" "prost" "reqwest" "reqwest-blocking-client" "tokio" "tonic" "tonic-types" "trace" ];
       };
       "opentelemetry-proto" = rec {
         crateName = "opentelemetry-proto";
-        version = "0.31.0";
+        version = "0.32.0";
         edition = "2021";
-        sha256 = "03xkjsjrsm7zkkx5gascqd9bg2z20wymm06l16cyxsp5dpq5s5x7";
+        sha256 = "0f5ny4rpnpq6q5q34b8k2q548rf31rpbxkwjqjwzfqxg3yx5imjn";
         libName = "opentelemetry_proto";
         dependencies = [
           {
@@ -6361,30 +6360,29 @@ rec {
           "const-hex" = [ "dep:const-hex" ];
           "default" = [ "full" ];
           "full" = [ "gen-tonic" "trace" "logs" "metrics" "zpages" "with-serde" "internal-logs" ];
-          "gen-tonic" = [ "gen-tonic-messages" "tonic/channel" ];
-          "gen-tonic-messages" = [ "tonic" "tonic-prost" "prost" ];
+          "gen-tonic" = [ "gen-tonic-messages" "tonic" "tonic-prost" "tonic/channel" ];
+          "gen-tonic-messages" = [ "prost" ];
           "internal-logs" = [ "opentelemetry/internal-logs" ];
           "logs" = [ "opentelemetry/logs" "opentelemetry_sdk/logs" ];
           "metrics" = [ "opentelemetry/metrics" "opentelemetry_sdk/metrics" ];
           "prost" = [ "dep:prost" ];
           "schemars" = [ "dep:schemars" ];
           "serde" = [ "dep:serde" ];
-          "serde_json" = [ "dep:serde_json" ];
           "testing" = [ "opentelemetry/testing" ];
           "tonic" = [ "dep:tonic" ];
           "tonic-prost" = [ "dep:tonic-prost" ];
           "trace" = [ "opentelemetry/trace" "opentelemetry_sdk/trace" ];
           "with-schemars" = [ "schemars" ];
-          "with-serde" = [ "serde" "const-hex" "base64" "serde_json" ];
+          "with-serde" = [ "serde" "const-hex" "base64" ];
           "zpages" = [ "trace" ];
         };
         resolvedDefaultFeatures = [ "gen-tonic" "gen-tonic-messages" "logs" "metrics" "prost" "tonic" "tonic-prost" "trace" ];
       };
       "opentelemetry-semantic-conventions" = rec {
         crateName = "opentelemetry-semantic-conventions";
-        version = "0.31.0";
+        version = "0.32.0";
         edition = "2021";
-        sha256 = "0in8plv2l2ar7anzi7lrbll0fjfvaymkg5vc5bnvibs1w3gjjbp6";
+        sha256 = "0s1x4h1cgmhkxb7i5g02la2vhkf4lg5g26cgn2s2gd1p0j5gk8kc";
         libName = "opentelemetry_semantic_conventions";
         features = {
         };
@@ -6392,9 +6390,9 @@ rec {
       };
       "opentelemetry_sdk" = rec {
         crateName = "opentelemetry_sdk";
-        version = "0.31.0";
+        version = "0.32.1";
         edition = "2021";
-        sha256 = "1gbjsggdxfpjbanjvaxa3nq32vfa37i3v13dvx4gsxhrk7sy8jp1";
+        sha256 = "1ycl11syranrinhgn4c2hlzhyzyvpa06ryxq5mxgzmf4387ghncv";
         dependencies = [
           {
             name = "futures-channel";
@@ -6420,6 +6418,13 @@ rec {
             packageId = "percent-encoding";
             optional = true;
           }
+          {
+            name = "portable-atomic";
+            packageId = "portable-atomic";
+            usesDefaultFeatures = false;
+            target = { target, features }: (!("64" == target."has_atomic" or null));
+            features = [ "fallback" ];
+          }
           {
             name = "rand";
             packageId = "rand 0.9.4";
@@ -6444,10 +6449,18 @@ rec {
             optional = true;
           }
         ];
+        devDependencies = [
+          {
+            name = "tokio";
+            packageId = "tokio";
+            usesDefaultFeatures = false;
+            features = [ "macros" "rt-multi-thread" ];
+          }
+        ];
         features = {
           "default" = [ "trace" "metrics" "logs" "internal-logs" ];
           "experimental_logs_batch_log_processor_with_async_runtime" = [ "logs" "experimental_async_runtime" ];
-          "experimental_logs_concurrent_log_processor" = [ "logs" ];
+          "experimental_metrics_bound_instruments" = [ "metrics" "opentelemetry/experimental_metrics_bound_instruments" ];
           "experimental_metrics_custom_reader" = [ "metrics" ];
           "experimental_metrics_disable_name_validation" = [ "metrics" ];
           "experimental_metrics_periodicreader_with_async_runtime" = [ "metrics" "experimental_async_runtime" ];
@@ -6464,15 +6477,14 @@ rec {
           "rt-tokio-current-thread" = [ "tokio/rt" "tokio/time" "tokio-stream" "experimental_async_runtime" ];
           "serde" = [ "dep:serde" ];
           "serde_json" = [ "dep:serde_json" ];
-          "spec_unstable_logs_enabled" = [ "logs" "opentelemetry/spec_unstable_logs_enabled" ];
           "spec_unstable_metrics_views" = [ "metrics" ];
-          "testing" = [ "opentelemetry/testing" "trace" "metrics" "logs" "rt-tokio" "rt-tokio-current-thread" "tokio/macros" "tokio/rt-multi-thread" ];
+          "testing" = [ "opentelemetry/testing" "trace" "metrics" "logs" "tokio/sync" ];
           "tokio" = [ "dep:tokio" ];
           "tokio-stream" = [ "dep:tokio-stream" ];
           "trace" = [ "opentelemetry/trace" "rand" "percent-encoding" ];
           "url" = [ "dep:url" ];
         };
-        resolvedDefaultFeatures = [ "default" "experimental_async_runtime" "internal-logs" "logs" "metrics" "percent-encoding" "rand" "rt-tokio" "spec_unstable_logs_enabled" "tokio" "tokio-stream" "trace" ];
+        resolvedDefaultFeatures = [ "default" "experimental_async_runtime" "internal-logs" "logs" "metrics" "percent-encoding" "rand" "rt-tokio" "tokio" "tokio-stream" "trace" ];
       };
       "ordered-float" = rec {
         crateName = "ordered-float";
@@ -6981,7 +6993,7 @@ rec {
           "default" = [ "fallback" ];
           "serde" = [ "dep:serde" ];
         };
-        resolvedDefaultFeatures = [ "require-cas" ];
+        resolvedDefaultFeatures = [ "fallback" "require-cas" ];
       };
       "portable-atomic-util" = rec {
         crateName = "portable-atomic-util";
@@ -7249,6 +7261,34 @@ rec {
         ];
 
       };
+      "prost-types" = rec {
+        crateName = "prost-types";
+        version = "0.14.3";
+        edition = "2021";
+        sha256 = "1mrxrciryfgi6a0vmrgyj3g27r9hdhlgwkq71cgv3icbvg5w94c9";
+        libName = "prost_types";
+        authors = [
+          "Dan Burkert <dan@danburkert.com>"
+          "Lucio Franco <luciofranco14@gmail.com>"
+          "Casper Meijn <casper@meijn.net>"
+          "Tokio Contributors <team@tokio.rs>"
+        ];
+        dependencies = [
+          {
+            name = "prost";
+            packageId = "prost";
+            usesDefaultFeatures = false;
+            features = [ "derive" ];
+          }
+        ];
+        features = {
+          "arbitrary" = [ "dep:arbitrary" ];
+          "chrono" = [ "dep:chrono" ];
+          "default" = [ "std" ];
+          "std" = [ "prost/std" ];
+        };
+        resolvedDefaultFeatures = [ "default" "std" ];
+      };
       "quote" = rec {
         crateName = "quote";
         version = "1.0.45";
@@ -7678,9 +7718,9 @@ rec {
       };
       "reqwest" = rec {
         crateName = "reqwest";
-        version = "0.12.28";
+        version = "0.13.4";
         edition = "2021";
-        sha256 = "0iqidijghgqbzl3bjg5hb4zmigwa4r612bgi0yiq0c90b6jkrpgd";
+        sha256 = "1hy1plns9krbh3h1dy2sdjygsfkdcnxm6pbxdi0ya9b5vq8mi711";
         authors = [
           "Sean McArthur <sean@seanmonstar.com>"
         ];
@@ -7697,7 +7737,7 @@ rec {
             name = "futures-channel";
             packageId = "futures-channel";
             optional = true;
-            target = { target, features }: (!("wasm32" == target."arch" or null));
+            target = { target, features }: (!(("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null))));
           }
           {
             name = "futures-core";
@@ -7717,62 +7757,44 @@ rec {
           {
             name = "http-body";
             packageId = "http-body";
-            target = { target, features }: (!("wasm32" == target."arch" or null));
+            target = { target, features }: (!(("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null))));
           }
           {
             name = "http-body-util";
             packageId = "http-body-util";
-            target = { target, features }: (!("wasm32" == target."arch" or null));
+            target = { target, features }: (!(("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null))));
           }
           {
             name = "hyper";
             packageId = "hyper";
-            target = { target, features }: (!("wasm32" == target."arch" or null));
+            target = { target, features }: (!(("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null))));
             features = [ "http1" "client" ];
           }
           {
             name = "hyper-util";
             packageId = "hyper-util";
-            target = { target, features }: (!("wasm32" == target."arch" or null));
+            target = { target, features }: (!(("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null))));
             features = [ "http1" "client" "client-legacy" "client-proxy" "tokio" ];
           }
           {
             name = "js-sys";
             packageId = "js-sys";
-            target = { target, features }: ("wasm32" == target."arch" or null);
+            target = { target, features }: (("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null)));
           }
           {
             name = "log";
             packageId = "log";
-            target = { target, features }: (!("wasm32" == target."arch" or null));
+            target = { target, features }: (!(("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null))));
           }
           {
             name = "percent-encoding";
             packageId = "percent-encoding";
-            target = { target, features }: (!("wasm32" == target."arch" or null));
+            target = { target, features }: (!(("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null))));
           }
           {
             name = "pin-project-lite";
             packageId = "pin-project-lite";
-            target = { target, features }: (!("wasm32" == target."arch" or null));
-          }
-          {
-            name = "serde";
-            packageId = "serde";
-          }
-          {
-            name = "serde_json";
-            packageId = "serde_json";
-            optional = true;
-          }
-          {
-            name = "serde_json";
-            packageId = "serde_json";
-            target = { target, features }: ("wasm32" == target."arch" or null);
-          }
-          {
-            name = "serde_urlencoded";
-            packageId = "serde_urlencoded";
+            target = { target, features }: (!(("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null))));
           }
           {
             name = "sync_wrapper";
@@ -7783,27 +7805,27 @@ rec {
             name = "tokio";
             packageId = "tokio";
             usesDefaultFeatures = false;
-            target = { target, features }: (!("wasm32" == target."arch" or null));
+            target = { target, features }: (!(("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null))));
             features = [ "net" "time" ];
           }
           {
             name = "tower";
             packageId = "tower";
             usesDefaultFeatures = false;
-            target = { target, features }: (!("wasm32" == target."arch" or null));
+            target = { target, features }: (!(("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null))));
             features = [ "retry" "timeout" "util" ];
           }
           {
             name = "tower-http";
             packageId = "tower-http";
             usesDefaultFeatures = false;
-            target = { target, features }: (!("wasm32" == target."arch" or null));
+            target = { target, features }: (!(("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null))));
             features = [ "follow-redirect" ];
           }
           {
             name = "tower-service";
             packageId = "tower-service";
-            target = { target, features }: (!("wasm32" == target."arch" or null));
+            target = { target, features }: (!(("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null))));
           }
           {
             name = "url";
@@ -7812,17 +7834,17 @@ rec {
           {
             name = "wasm-bindgen";
             packageId = "wasm-bindgen";
-            target = { target, features }: ("wasm32" == target."arch" or null);
+            target = { target, features }: (("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null)));
           }
           {
             name = "wasm-bindgen-futures";
             packageId = "wasm-bindgen-futures";
-            target = { target, features }: ("wasm32" == target."arch" or null);
+            target = { target, features }: (("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null)));
           }
           {
             name = "web-sys";
             packageId = "web-sys";
-            target = { target, features }: ("wasm32" == target."arch" or null);
+            target = { target, features }: (("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null)));
             features = [ "AbortController" "AbortSignal" "Headers" "Request" "RequestInit" "RequestMode" "Response" "Window" "FormData" "Blob" "BlobPropertyBag" "ServiceWorkerGlobalScope" "RequestCredentials" "File" "ReadableStream" "RequestCache" ];
           }
         ];
@@ -7831,33 +7853,27 @@ rec {
             name = "futures-util";
             packageId = "futures-util";
             usesDefaultFeatures = false;
-            target = { target, features }: (!("wasm32" == target."arch" or null));
+            target = { target, features }: (!(("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null))));
             features = [ "std" "alloc" ];
           }
           {
             name = "hyper";
             packageId = "hyper";
             usesDefaultFeatures = false;
-            target = { target, features }: (!("wasm32" == target."arch" or null));
+            target = { target, features }: (!(("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null))));
             features = [ "http1" "http2" "client" "server" ];
           }
           {
             name = "hyper-util";
             packageId = "hyper-util";
-            target = { target, features }: (!("wasm32" == target."arch" or null));
+            target = { target, features }: (!(("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null))));
             features = [ "http1" "http2" "client" "client-legacy" "server-auto" "server-graceful" "tokio" ];
           }
-          {
-            name = "serde";
-            packageId = "serde";
-            target = { target, features }: (!("wasm32" == target."arch" or null));
-            features = [ "derive" ];
-          }
           {
             name = "tokio";
             packageId = "tokio";
             usesDefaultFeatures = false;
-            target = { target, features }: (!("wasm32" == target."arch" or null));
+            target = { target, features }: (!(("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null))));
             features = [ "macros" "rt-multi-thread" ];
           }
           {
@@ -7869,40 +7885,37 @@ rec {
           {
             name = "wasm-bindgen";
             packageId = "wasm-bindgen";
-            target = { target, features }: ("wasm32" == target."arch" or null);
+            target = { target, features }: (("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null)));
             features = [ "serde-serialize" ];
           }
         ];
         features = {
+          "__native-tls" = [ "dep:hyper-tls" "dep:native-tls-crate" "__tls" "dep:tokio-native-tls" ];
+          "__native-tls-alpn" = [ "native-tls-crate?/alpn" "hyper-tls?/alpn" ];
           "__rustls" = [ "dep:hyper-rustls" "dep:tokio-rustls" "dep:rustls" "__tls" ];
-          "__rustls-ring" = [ "hyper-rustls?/ring" "tokio-rustls?/ring" "rustls?/ring" "quinn?/ring" ];
+          "__rustls-aws-lc-rs" = [ "hyper-rustls?/aws-lc-rs" "tokio-rustls?/aws-lc-rs" "rustls?/aws-lc-rs" "quinn?/rustls-aws-lc-rs" ];
           "__tls" = [ "dep:rustls-pki-types" "tokio/io-util" ];
           "blocking" = [ "dep:futures-channel" "futures-channel?/sink" "dep:futures-util" "futures-util?/io" "futures-util?/sink" "tokio/sync" ];
           "brotli" = [ "tower-http/decompression-br" ];
           "charset" = [ "dep:encoding_rs" "dep:mime" ];
           "cookies" = [ "dep:cookie_crate" "dep:cookie_store" ];
           "default" = [ "default-tls" "charset" "http2" "system-proxy" ];
-          "default-tls" = [ "dep:hyper-tls" "dep:native-tls-crate" "__tls" "dep:tokio-native-tls" ];
+          "default-tls" = [ "rustls" ];
           "deflate" = [ "tower-http/decompression-deflate" ];
+          "form" = [ "dep:serde" "dep:serde_urlencoded" ];
           "gzip" = [ "tower-http/decompression-gzip" ];
-          "h2" = [ "dep:h2" ];
           "hickory-dns" = [ "dep:hickory-resolver" "dep:once_cell" ];
-          "http2" = [ "h2" "hyper/http2" "hyper-util/http2" "hyper-rustls?/http2" ];
-          "http3" = [ "rustls-tls-manual-roots" "dep:h3" "dep:h3-quinn" "dep:quinn" "tokio/macros" ];
-          "json" = [ "dep:serde_json" ];
-          "macos-system-configuration" = [ "system-proxy" ];
+          "http2" = [ "dep:h2" "hyper/http2" "hyper-util/http2" "hyper-rustls?/http2" ];
+          "http3" = [ "rustls" "dep:h3" "dep:h3-quinn" "dep:quinn" "tokio/macros" ];
+          "json" = [ "dep:serde" "dep:serde_json" ];
           "multipart" = [ "dep:mime_guess" "dep:futures-util" ];
-          "native-tls" = [ "default-tls" ];
-          "native-tls-alpn" = [ "native-tls" "native-tls-crate?/alpn" "hyper-tls?/alpn" ];
-          "native-tls-vendored" = [ "native-tls" "native-tls-crate?/vendored" ];
-          "rustls-tls" = [ "rustls-tls-webpki-roots" ];
-          "rustls-tls-manual-roots" = [ "rustls-tls-manual-roots-no-provider" "__rustls-ring" ];
-          "rustls-tls-manual-roots-no-provider" = [ "__rustls" ];
-          "rustls-tls-native-roots" = [ "rustls-tls-native-roots-no-provider" "__rustls-ring" ];
-          "rustls-tls-native-roots-no-provider" = [ "dep:rustls-native-certs" "hyper-rustls?/native-tokio" "__rustls" ];
-          "rustls-tls-no-provider" = [ "rustls-tls-manual-roots-no-provider" ];
-          "rustls-tls-webpki-roots" = [ "rustls-tls-webpki-roots-no-provider" "__rustls-ring" ];
-          "rustls-tls-webpki-roots-no-provider" = [ "dep:webpki-roots" "hyper-rustls?/webpki-tokio" "__rustls" ];
+          "native-tls" = [ "__native-tls" "__native-tls-alpn" ];
+          "native-tls-no-alpn" = [ "__native-tls" ];
+          "native-tls-vendored" = [ "__native-tls" "native-tls-crate?/vendored" "__native-tls-alpn" ];
+          "native-tls-vendored-no-alpn" = [ "__native-tls" "native-tls-crate?/vendored" ];
+          "query" = [ "dep:serde" "dep:serde_urlencoded" ];
+          "rustls" = [ "__rustls-aws-lc-rs" "dep:rustls-platform-verifier" "__rustls" ];
+          "rustls-no-provider" = [ "dep:rustls-platform-verifier" "__rustls" ];
           "stream" = [ "tokio/fs" "dep:futures-util" "dep:tokio-util" "dep:wasm-streams" ];
           "system-proxy" = [ "hyper-util/client-proxy-system" ];
           "zstd" = [ "tower-http/decompression-zstd" ];
@@ -9512,7 +9525,7 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
-          rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
+          rev = "46cd3f93a788d44d177a8794fde91fbefa3156d7";
           sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         libName = "stackable_certs";
@@ -9649,10 +9662,6 @@ rec {
             name = "indoc";
             packageId = "indoc";
           }
-          {
-            name = "java-properties";
-            packageId = "java-properties";
-          }
           {
             name = "serde";
             packageId = "serde";
@@ -9689,10 +9698,6 @@ rec {
             name = "tracing";
             packageId = "tracing";
           }
-          {
-            name = "xml";
-            packageId = "xml";
-          }
         ];
         buildDependencies = [
           {
@@ -9720,7 +9725,7 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
-          rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
+          rev = "46cd3f93a788d44d177a8794fde91fbefa3156d7";
           sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         libName = "stackable_operator";
@@ -9771,6 +9776,10 @@ rec {
             name = "indexmap";
             packageId = "indexmap";
           }
+          {
+            name = "java-properties";
+            packageId = "java-properties";
+          }
           {
             name = "jiff";
             packageId = "jiff";
@@ -9886,12 +9895,17 @@ rec {
             name = "uuid";
             packageId = "uuid";
           }
+          {
+            name = "xml";
+            packageId = "xml";
+          }
         ];
         features = {
           "certs" = [ "dep:stackable-certs" ];
+          "client-feature-gates" = [ "dep:winnow" ];
           "crds" = [ "dep:stackable-versioned" ];
           "default" = [ "crds" ];
-          "full" = [ "crds" "certs" "time" "webhook" "kube-ws" ];
+          "full" = [ "client-feature-gates" "crds" "certs" "time" "webhook" "kube-ws" ];
           "kube-ws" = [ "kube/ws" ];
           "time" = [ "stackable-shared/time" ];
           "webhook" = [ "dep:stackable-webhook" ];
@@ -9905,7 +9919,7 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
-          rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
+          rev = "46cd3f93a788d44d177a8794fde91fbefa3156d7";
           sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         procMacro = true;
@@ -9935,12 +9949,12 @@ rec {
       };
       "stackable-shared" = rec {
         crateName = "stackable-shared";
-        version = "0.1.0";
+        version = "0.1.1";
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
-          rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
+          rev = "46cd3f93a788d44d177a8794fde91fbefa3156d7";
           sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         libName = "stackable_shared";
@@ -10016,12 +10030,12 @@ rec {
       };
       "stackable-telemetry" = rec {
         crateName = "stackable-telemetry";
-        version = "0.6.3";
+        version = "0.6.4";
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
-          rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
+          rev = "46cd3f93a788d44d177a8794fde91fbefa3156d7";
           sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         libName = "stackable_telemetry";
@@ -10065,7 +10079,7 @@ rec {
           {
             name = "opentelemetry_sdk";
             packageId = "opentelemetry_sdk";
-            features = [ "rt-tokio" "logs" "rt-tokio" "spec_unstable_logs_enabled" ];
+            features = [ "rt-tokio" "logs" "rt-tokio" ];
           }
           {
             name = "pin-project";
@@ -10131,7 +10145,7 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
-          rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
+          rev = "46cd3f93a788d44d177a8794fde91fbefa3156d7";
           sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         libName = "stackable_versioned";
@@ -10181,7 +10195,7 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
-          rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
+          rev = "46cd3f93a788d44d177a8794fde91fbefa3156d7";
           sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         procMacro = true;
@@ -10249,7 +10263,7 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
-          rev = "a31cd2514445b251038fc4ea7abc28c57b2a6ad9";
+          rev = "46cd3f93a788d44d177a8794fde91fbefa3156d7";
           sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         libName = "stackable_webhook";
@@ -11413,6 +11427,33 @@ rec {
           }
         ];
 
+      };
+      "tonic-types" = rec {
+        crateName = "tonic-types";
+        version = "0.14.6";
+        edition = "2024";
+        sha256 = "1s286gg71pjajny8xar0azq1w9lgz1ks3jm3pccxb0qz0q11pavk";
+        libName = "tonic_types";
+        authors = [
+          "Lucio Franco <luciofranco14@gmail.com>"
+          "Rafael Lemos <flemos.rafael.dev@gmail.com>"
+        ];
+        dependencies = [
+          {
+            name = "prost";
+            packageId = "prost";
+          }
+          {
+            name = "prost-types";
+            packageId = "prost-types";
+          }
+          {
+            name = "tonic";
+            packageId = "tonic";
+            usesDefaultFeatures = false;
+          }
+        ];
+
       };
       "tower" = rec {
         crateName = "tower";
@@ -11867,9 +11908,9 @@ rec {
       };
       "tracing-opentelemetry" = rec {
         crateName = "tracing-opentelemetry";
-        version = "0.32.1";
+        version = "0.33.0";
         edition = "2021";
-        sha256 = "1z2jjmxbkm1qawlb3bm99x8xwf4g8wjkbcknm9z4fv1w14nqzhhs";
+        sha256 = "09nvxy5m7nxmifz4b6szdcyczapp2jcgxcac0jw4ax8klz5n9g5d";
         libName = "tracing_opentelemetry";
         dependencies = [
           {
diff --git a/Cargo.toml b/Cargo.toml
index ed454cd1..77b61fc8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -19,7 +19,6 @@ const_format = "0.2"
 fnv = "1.0"
 futures = { version = "0.3", features = ["compat"] }
 indoc = "2.0"
-java-properties = "2.0"
 rstest = "0.26"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
@@ -29,7 +28,6 @@ snafu = "0.9"
 strum = { version = "0.28", features = ["derive"] }
 tokio = { version = "1.40", features = ["full"] }
 tracing = "0.1"
-xml = "1.3"
 
 [patch."https://github.com/stackabletech/operator-rs.git"]
 stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "smooth-operator" }
diff --git a/crate-hashes.json b/crate-hashes.json
index c76bf06c..cd03561e 100644
--- a/crate-hashes.json
+++ b/crate-hashes.json
@@ -3,8 +3,8 @@
   "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-certs@0.4.0": "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96",
   "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-operator-derive@0.3.1": "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96",
   "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-operator@0.111.1": "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96",
-  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-shared@0.1.0": "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96",
-  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-telemetry@0.6.3": "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-shared@0.1.1": "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-telemetry@0.6.4": "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96",
   "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-versioned-macros@0.10.0": "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96",
   "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-versioned@0.10.0": "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96",
   "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#stackable-webhook@0.9.1": "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96",
diff --git a/rust/operator-binary/Cargo.toml b/rust/operator-binary/Cargo.toml
index 35e88f0e..902fedb0 100644
--- a/rust/operator-binary/Cargo.toml
+++ b/rust/operator-binary/Cargo.toml
@@ -17,7 +17,6 @@ const_format.workspace = true
 fnv.workspace = true
 futures.workspace = true
 indoc.workspace = true
-java-properties.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 shell-escape.workspace = true
@@ -25,7 +24,6 @@ snafu.workspace = true
 strum.workspace = true
 tokio.workspace = true
 tracing.workspace = true
-xml.workspace = true
 
 [build-dependencies]
 built.workspace = true
diff --git a/rust/operator-binary/src/config/mod.rs b/rust/operator-binary/src/config/mod.rs
index cb7d7920..271c6d99 100644
--- a/rust/operator-binary/src/config/mod.rs
+++ b/rust/operator-binary/src/config/mod.rs
@@ -1,2 +1 @@
 pub mod jvm;
-pub mod writer;
diff --git a/rust/operator-binary/src/config/writer.rs b/rust/operator-binary/src/config/writer.rs
deleted file mode 100644
index 08250f9f..00000000
--- a/rust/operator-binary/src/config/writer.rs
+++ /dev/null
@@ -1,145 +0,0 @@
-//! Writers for Hadoop XML config files and Java `.properties` files.
-//!
-//! Vendored from the `product-config` crate's `writer` module so the operator no
-//! longer depends on `product-config` for rendering.
-
-use std::io::Write;
-
-use java_properties::{PropertiesError, PropertiesWriter};
-use snafu::{ResultExt, Snafu};
-use xml::escape::escape_str_attribute;
-
-#[derive(Debug, Snafu)]
-pub enum PropertiesWriterError {
-    #[snafu(display("failed to create properties file"))]
-    Properties { source: PropertiesError },
-
-    #[snafu(display("failed to convert properties file byte array to UTF-8"))]
-    FromUtf8 { source: std::string::FromUtf8Error },
-}
-
-/// Creates a common Java properties file string in the format:
-/// `property_1=value_1\nproperty_2=value_2\n`.
-pub fn to_java_properties_string<'a, T>(properties: T) -> Result<String, PropertiesWriterError>
-where
-    T: Iterator<Item = (&'a String, &'a Option<String>)>,
-{
-    let mut output = Vec::new();
-    write_java_properties(&mut output, properties)?;
-    String::from_utf8(output).context(FromUtf8Snafu)
-}
-
-/// Writes Java properties to the given writer. A `None` value is written as an
-/// empty value (`key=`).
-fn write_java_properties<'a, W, T>(writer: W, properties: T) -> Result<(), PropertiesWriterError>
-where
-    W: Write,
-    T: Iterator<Item = (&'a String, &'a Option<String>)>,
-{
-    let mut writer = PropertiesWriter::new(writer);
-    for (k, v) in properties {
-        let property_value = v.as_deref().unwrap_or_default();
-        writer.write(k, property_value).context(PropertiesSnafu)?;
-    }
-    writer.flush().context(PropertiesSnafu)?;
-    Ok(())
-}
-
-/// Converts properties into a Hadoop configuration XML, including the wrapping
-/// `<configuration>...</configuration>` elements. Properties with a `None` value
-/// are skipped. Keys and values are XML-escaped.
-pub fn to_hadoop_xml<'a, T>(properties: T) -> String
-where
-    T: Iterator<Item = (&'a String, &'a Option<String>)>,
-{
-    let mut snippet = String::new();
-    for (k, v) in properties {
-        let escaped_value = match v {
-            Some(value) => escape_str_attribute(value),
-            None => continue,
-        };
-        let escaped_key = escape_str_attribute(k);
-        snippet.push_str(&format!(
-            "  <property>\n    <name>{escaped_key}</name>\n    <value>{escaped_value}</value>\n  </property>\n"
-        ));
-    }
-    format!("<?xml version=\"1.0\"?>\n<configuration>\n{snippet}</configuration>")
-}
-
-#[cfg(test)]
-mod tests {
-    use std::collections::BTreeMap;
-
-    use super::*;
-
-    fn xml(pairs: &[(&str, Option<&str>)]) -> String {
-        let map: BTreeMap<String, Option<String>> = pairs
-            .iter()
-            .map(|(k, v)| (k.to_string(), v.map(str::to_string)))
-            .collect();
-        to_hadoop_xml(map.iter())
-    }
-
-    fn props(pairs: &[(&str, Option<&str>)]) -> String {
-        let map: BTreeMap<String, Option<String>> = pairs
-            .iter()
-            .map(|(k, v)| (k.to_string(), v.map(str::to_string)))
-            .collect();
-        to_java_properties_string(map.iter()).unwrap()
-    }
-
-    #[test]
-    fn hadoop_xml_wraps_empty_configuration() {
-        assert_eq!(
-            xml(&[]),
-            "<?xml version=\"1.0\"?>\n<configuration>\n</configuration>"
-        );
-    }
-
-    #[test]
-    fn hadoop_xml_renders_single_property() {
-        assert_eq!(
-            xml(&[("fs.defaultFS", Some("hdfs://hdfs/"))]),
-            "<?xml version=\"1.0\"?>\n<configuration>\n  \
-             <property>\n    <name>fs.defaultFS</name>\n    \
-             <value>hdfs://hdfs/</value>\n  </property>\n</configuration>"
-        );
-    }
-
-    #[test]
-    fn hadoop_xml_skips_none_values() {
-        assert_eq!(
-            xml(&[("kept", Some("1")), ("dropped", None)]),
-            "<?xml version=\"1.0\"?>\n<configuration>\n  \
-             <property>\n    <name>kept</name>\n    \
-             <value>1</value>\n  </property>\n</configuration>"
-        );
-    }
-
-    #[test]
-    fn hadoop_xml_escapes_special_characters() {
-        let rendered = xml(&[("k", Some("<a>&b"))]);
-        assert!(
-            rendered.contains("<value>&lt;a&gt;&amp;b</value>"),
-            "{rendered}"
-        );
-    }
-
-    #[test]
-    fn java_properties_renders_key_value() {
-        assert_eq!(props(&[("a", Some("1")), ("b", Some("2"))]), "a=1\nb=2\n");
-    }
-
-    #[test]
-    fn java_properties_renders_none_as_empty() {
-        assert_eq!(props(&[("none", None)]), "none=\n");
-    }
-
-    #[test]
-    fn java_properties_escapes_colon_in_value() {
-        assert_eq!(
-            props(&[("url", Some("file://this/location/file.abc"))]),
-            "url=file\\://this/location/file.abc\n"
-        );
-    }
-}
diff --git a/rust/operator-binary/src/controller/build/config_map.rs b/rust/operator-binary/src/controller/build/config_map.rs
index 374a650e..312cda19 100644
--- a/rust/operator-binary/src/controller/build/config_map.rs
+++ b/rust/operator-binary/src/controller/build/config_map.rs
@@ -6,10 +6,10 @@ use stackable_operator::{
     k8s_openapi::api::core::v1::ConfigMap,
     product_logging::framework::VECTOR_CONFIG_FILE,
     role_utils::RoleGroupRef,
+    v2::config_file_writer::PropertiesWriterError,
 };
 
 use crate::{
-    config::writer::PropertiesWriterError,
     controller::build::properties::{
         ConfigFileName, hbase_env, hbase_site, logging, security_properties, ssl_client, ssl_server,
     },
diff --git a/rust/operator-binary/src/controller/build/discovery.rs b/rust/operator-binary/src/controller/build/discovery.rs
index bf746e25..9e669d7f 100644
--- a/rust/operator-binary/src/controller/build/discovery.rs
+++ b/rust/operator-binary/src/controller/build/discovery.rs
@@ -7,10 +7,10 @@ use stackable_operator::{
     builder::{configmap::ConfigMapBuilder, meta::ObjectMetaBuilder},
     k8s_openapi::api::core::v1::ConfigMap,
     kube::runtime::reflector::ObjectRef,
+    v2::config_file_writer::to_hadoop_xml,
 };
 
 use crate::{
-    config::writer::to_hadoop_xml,
     controller::build::properties::ConfigFileName,
     crd::{HbaseRole, v1alpha1},
     hbase_controller::{ValidatedCluster, build_recommended_labels},
diff --git a/rust/operator-binary/src/controller/build/properties/hbase_site.rs b/rust/operator-binary/src/controller/build/properties/hbase_site.rs
index 3d7eea78..2d010911 100644
--- a/rust/operator-binary/src/controller/build/properties/hbase_site.rs
+++ b/rust/operator-binary/src/controller/build/properties/hbase_site.rs
@@ -4,10 +4,11 @@
 
 use std::collections::BTreeMap;
 
-use stackable_operator::v2::config_overrides::KeyValueConfigOverrides;
+use stackable_operator::v2::{
+    config_file_writer::to_hadoop_xml, config_overrides::KeyValueConfigOverrides,
+};
 
 use crate::{
-    config::writer::to_hadoop_xml,
     controller::build::properties::resolved_overrides,
     crd::{
         AnyServiceConfig, HBASE_CLUSTER_DISTRIBUTED, HBASE_MASTER_PORT, HBASE_MASTER_UI_PORT,
diff --git a/rust/operator-binary/src/controller/build/properties/mod.rs b/rust/operator-binary/src/controller/build/properties/mod.rs
index db919037..c4cf5bb8 100644
--- a/rust/operator-binary/src/controller/build/properties/mod.rs
+++ b/rust/operator-binary/src/controller/build/properties/mod.rs
@@ -1,7 +1,7 @@
 //! Per-file builders for the HBase config files assembled into the rolegroup
 //! `ConfigMap`. Each `<file>.rs` module produces the rendered content for one
-//! config file; the shared [`crate::config::writer`] module serializes maps to
-//! the Hadoop-XML / Java-properties on-wire format.
+//! config file; the shared [`stackable_operator::v2::config_file_writer`]
+//! module serializes maps to the Hadoop-XML / Java-properties on-wire format.
 
 use std::collections::BTreeMap;
 
diff --git a/rust/operator-binary/src/controller/build/properties/security_properties.rs b/rust/operator-binary/src/controller/build/properties/security_properties.rs
index 421f925f..35ab38b4 100644
--- a/rust/operator-binary/src/controller/build/properties/security_properties.rs
+++ b/rust/operator-binary/src/controller/build/properties/security_properties.rs
@@ -6,14 +6,13 @@
 
 use std::collections::BTreeMap;
 
-use stackable_operator::v2::config_overrides::KeyValueConfigOverrides;
-
-use crate::{
-    config::writer::{PropertiesWriterError, to_java_properties_string},
-    controller::build::properties::resolved_overrides,
-    crd::HbaseRole,
+use stackable_operator::v2::{
+    config_file_writer::{PropertiesWriterError, to_java_properties_string},
+    config_overrides::KeyValueConfigOverrides,
 };
 
+use crate::{controller::build::properties::resolved_overrides, crd::HbaseRole};
+
 /// Renders `security.properties`: role-specific DNS cache TTLs plus user overrides.
 pub fn build(
     role: &HbaseRole,
diff --git a/rust/operator-binary/src/controller/build/properties/ssl_client.rs b/rust/operator-binary/src/controller/build/properties/ssl_client.rs
index 83d0039d..3fc8093f 100644
--- a/rust/operator-binary/src/controller/build/properties/ssl_client.rs
+++ b/rust/operator-binary/src/controller/build/properties/ssl_client.rs
@@ -1,9 +1,11 @@
 //! Builds the `ssl-client.xml` config file: kerberos/TLS client settings + overrides.
 use std::collections::BTreeMap;
 
-use stackable_operator::v2::config_overrides::KeyValueConfigOverrides;
+use stackable_operator::v2::{
+    config_file_writer::to_hadoop_xml, config_overrides::KeyValueConfigOverrides,
+};
 
-use crate::{config::writer::to_hadoop_xml, controller::build::properties::resolved_overrides};
+use crate::controller::build::properties::resolved_overrides;
 
 /// Renders `ssl-client.xml`.
 pub fn build(settings: BTreeMap<String, String>, overrides: KeyValueConfigOverrides) -> String {
diff --git a/rust/operator-binary/src/controller/build/properties/ssl_server.rs b/rust/operator-binary/src/controller/build/properties/ssl_server.rs
index 2ae17e9b..edf70aac 100644
--- a/rust/operator-binary/src/controller/build/properties/ssl_server.rs
+++ b/rust/operator-binary/src/controller/build/properties/ssl_server.rs
@@ -1,9 +1,11 @@
 //! Builds the `ssl-server.xml` config file: kerberos/TLS server settings + overrides.
 use std::collections::BTreeMap;
 
-use stackable_operator::v2::config_overrides::KeyValueConfigOverrides;
+use stackable_operator::v2::{
+    config_file_writer::to_hadoop_xml, config_overrides::KeyValueConfigOverrides,
+};
 
-use crate::{config::writer::to_hadoop_xml, controller::build::properties::resolved_overrides};
+use crate::controller::build::properties::resolved_overrides;
 
 /// Renders `ssl-server.xml`.
 pub fn build(settings: BTreeMap<String, String>, overrides: KeyValueConfigOverrides) -> String {

From 36cc1da5fe2d2c52648364bfc8a07ebe5cc7df9a Mon Sep 17 00:00:00 2001
From: Malte Sander <malte.sander.it@gmail.com>
Date: Mon, 8 Jun 2026 19:51:22 +0200
Subject: [PATCH 20/21] refactor: add uid, namespace to ValidatedCluster

---
 .../src/controller/build/config_map.rs        |  17 +--
 .../src/controller/build/discovery.rs         |  28 +----
 .../src/controller/validate.rs                |  29 +++--
 rust/operator-binary/src/hbase_controller.rs  | 112 ++++++++++++++++--
 4 files changed, 129 insertions(+), 57 deletions(-)

diff --git a/rust/operator-binary/src/controller/build/config_map.rs b/rust/operator-binary/src/controller/build/config_map.rs
index 312cda19..199f991f 100644
--- a/rust/operator-binary/src/controller/build/config_map.rs
+++ b/rust/operator-binary/src/controller/build/config_map.rs
@@ -6,7 +6,7 @@ use stackable_operator::{
     k8s_openapi::api::core::v1::ConfigMap,
     product_logging::framework::VECTOR_CONFIG_FILE,
     role_utils::RoleGroupRef,
-    v2::config_file_writer::PropertiesWriterError,
+    v2::{builder::meta::ownerreference_from_resource, config_file_writer::PropertiesWriterError},
 };
 
 use crate::{
@@ -31,11 +31,6 @@ pub enum Error {
         role_group: String,
     },
 
-    #[snafu(display("object is missing metadata to build owner reference"))]
-    ObjectMissingMetadataForOwnerRef {
-        source: stackable_operator::builder::meta::Error,
-    },
-
     #[snafu(display("failed to build object meta data"))]
     ObjectMeta {
         source: stackable_operator::builder::meta::Error,
@@ -55,9 +50,6 @@ pub fn build_rolegroup_config_map(
     cluster: &ValidatedCluster,
     role: &HbaseRole,
     rolegroup_ref: &RoleGroupRef<v1alpha1::HbaseCluster>,
-    // `owner` is retained only for the ConfigMap ObjectMeta / owner reference; the rendered
-    // content comes entirely from `cluster`. To be decoupled in a follow-up.
-    owner_ref: &v1alpha1::HbaseCluster,
 ) -> Result<ConfigMap> {
     tracing::info!("Setting up ConfigMap for {:?}", rolegroup_ref);
 
@@ -110,12 +102,11 @@ pub fn build_rolegroup_config_map(
         )?;
 
     let cm_metadata = ObjectMetaBuilder::new()
-        .name_and_namespace(owner_ref)
+        .name_and_namespace(cluster)
         .name(rolegroup_ref.object_name())
-        .ownerreference_from_resource(owner_ref, None, Some(true))
-        .context(ObjectMissingMetadataForOwnerRefSnafu)?
+        .ownerreference(ownerreference_from_resource(cluster, None, Some(true)))
         .with_recommended_labels(&build_recommended_labels(
-            owner_ref,
+            cluster,
             &cluster.image.app_version_label_value,
             &rolegroup_ref.role,
             &rolegroup_ref.role_group,
diff --git a/rust/operator-binary/src/controller/build/discovery.rs b/rust/operator-binary/src/controller/build/discovery.rs
index 9e669d7f..99dace99 100644
--- a/rust/operator-binary/src/controller/build/discovery.rs
+++ b/rust/operator-binary/src/controller/build/discovery.rs
@@ -6,13 +6,12 @@ use snafu::{ResultExt, Snafu};
 use stackable_operator::{
     builder::{configmap::ConfigMapBuilder, meta::ObjectMetaBuilder},
     k8s_openapi::api::core::v1::ConfigMap,
-    kube::runtime::reflector::ObjectRef,
-    v2::config_file_writer::to_hadoop_xml,
+    v2::{builder::meta::ownerreference_from_resource, config_file_writer::to_hadoop_xml},
 };
 
 use crate::{
     controller::build::properties::ConfigFileName,
-    crd::{HbaseRole, v1alpha1},
+    crd::HbaseRole,
     hbase_controller::{ValidatedCluster, build_recommended_labels},
 };
 
@@ -20,12 +19,6 @@ type Result<T, E = Error> = std::result::Result<T, E>;
 
 #[derive(Snafu, Debug)]
 pub enum Error {
-    #[snafu(display("object {hbase} is missing metadata to build owner reference"))]
-    ObjectMissingMetadataForOwnerRef {
-        source: stackable_operator::builder::meta::Error,
-        hbase: ObjectRef<v1alpha1::HbaseCluster>,
-    },
-
     #[snafu(display("failed to build ConfigMap"))]
     BuildConfigMap {
         source: stackable_operator::builder::configmap::Error,
@@ -38,13 +31,7 @@ pub enum Error {
 }
 
 /// Creates a discovery config map containing the `hbase-site.xml` for clients.
-///
-/// The rendered content comes entirely from `cluster`; `owner_ref` is retained only for the
-/// ConfigMap ObjectMeta / owner reference.
-pub fn build_discovery_config_map(
-    cluster: &ValidatedCluster,
-    owner_ref: &v1alpha1::HbaseCluster,
-) -> Result<ConfigMap> {
+pub fn build_discovery_config_map(cluster: &ValidatedCluster) -> Result<ConfigMap> {
     let cluster_config = &cluster.cluster_config;
 
     let mut hbase_site = cluster_config
@@ -55,13 +42,10 @@ pub fn build_discovery_config_map(
     ConfigMapBuilder::new()
         .metadata(
             ObjectMetaBuilder::new()
-                .name_and_namespace(owner_ref)
-                .ownerreference_from_resource(owner_ref, None, Some(true))
-                .with_context(|_| ObjectMissingMetadataForOwnerRefSnafu {
-                    hbase: ObjectRef::from_obj(owner_ref),
-                })?
+                .name_and_namespace(cluster)
+                .ownerreference(ownerreference_from_resource(cluster, None, Some(true)))
                 .with_recommended_labels(&build_recommended_labels(
-                    owner_ref,
+                    cluster,
                     &cluster.image.app_version_label_value,
                     &HbaseRole::RegionServer.to_string(),
                     "discovery",
diff --git a/rust/operator-binary/src/controller/validate.rs b/rust/operator-binary/src/controller/validate.rs
index b4a8cba2..792acd00 100644
--- a/rust/operator-binary/src/controller/validate.rs
+++ b/rust/operator-binary/src/controller/validate.rs
@@ -1,13 +1,12 @@
-use std::{collections::BTreeMap, str::FromStr};
+use std::collections::BTreeMap;
 
 use snafu::{ResultExt, Snafu};
 use stackable_operator::{
     commons::product_image_selection::{self},
     config::merge::Merge,
-    kube::ResourceExt,
     role_utils::GenericRoleConfig,
     utils::cluster_info::KubernetesClusterInfo,
-    v2::types::operator::ClusterName,
+    v2::controller_utils::{get_cluster_name, get_namespace, get_uid},
 };
 use strum::IntoEnumIterator;
 
@@ -33,9 +32,9 @@ pub enum Error {
         source: product_image_selection::Error,
     },
 
-    #[snafu(display("invalid cluster name"))]
-    InvalidClusterName {
-        source: stackable_operator::v2::macros::attributed_string_type::Error,
+    #[snafu(display("failed to determine the cluster identity (name, namespace and uid)"))]
+    GetClusterIdentity {
+        source: stackable_operator::v2::controller_utils::Error,
     },
 
     #[snafu(display("the HbaseCluster has no {role} role defined"))]
@@ -130,10 +129,16 @@ pub fn validate_cluster(
     let ssl_server_settings = kerberos_ssl_server_settings(hbase);
     let ssl_client_settings = kerberos_ssl_client_settings(hbase);
 
-    Ok(ValidatedCluster {
-        name: ClusterName::from_str(&hbase.name_any()).context(InvalidClusterNameSnafu)?,
-        image: resolved_product_image,
-        cluster_config: ValidatedClusterConfig {
+    let name = get_cluster_name(hbase).context(GetClusterIdentitySnafu)?;
+    let namespace = get_namespace(hbase).context(GetClusterIdentitySnafu)?;
+    let uid = get_uid(hbase).context(GetClusterIdentitySnafu)?;
+
+    Ok(ValidatedCluster::new(
+        name,
+        namespace,
+        uid,
+        resolved_product_image,
+        ValidatedClusterConfig {
             zookeeper_connection_information: dereferenced_objects.zookeeper_connection_information,
             hbase_opa_config: dereferenced_objects.hbase_opa_config,
             kerberos_enabled: hbase.has_kerberos_enabled(),
@@ -142,9 +147,9 @@ pub fn validate_cluster(
             ssl_server_settings,
             ssl_client_settings,
         },
-        role_group_configs: role_groups,
+        role_groups,
         role_configs,
-    })
+    ))
 }
 
 /// The names of the role groups defined for `role` in the spec.
diff --git a/rust/operator-binary/src/hbase_controller.rs b/rust/operator-binary/src/hbase_controller.rs
index c57f3f52..d76d8768 100644
--- a/rust/operator-binary/src/hbase_controller.rs
+++ b/rust/operator-binary/src/hbase_controller.rs
@@ -26,7 +26,10 @@ use stackable_operator::{
                 ServicePort, ServiceSpec, TCPSocketAction, Volume,
             },
         },
-        apimachinery::pkg::{apis::meta::v1::LabelSelector, util::intstr::IntOrString},
+        apimachinery::pkg::{
+            apis::meta::v1::{LabelSelector, ObjectMeta},
+            util::intstr::IntOrString,
+        },
     },
     kube::{
         Resource, ResourceExt,
@@ -49,7 +52,13 @@ use stackable_operator::{
         compute_conditions, operations::ClusterOperationsConditionBuilder,
         statefulset::StatefulSetConditionBuilder,
     },
-    v2::types::operator::ClusterName,
+    v2::{
+        HasName, HasUid, NameIsValidLabelValue,
+        types::{
+            kubernetes::{NamespaceName, Uid},
+            operator::ClusterName,
+        },
+    },
 };
 use strum::{EnumDiscriminants, IntoStaticStr};
 
@@ -90,16 +99,100 @@ pub struct Ctx {
 /// every role and role group before any resources are created.
 #[derive(Clone, Debug)]
 pub struct ValidatedCluster {
+    /// Backs the [`Resource`] implementation (provides `meta()`/`name_any()`) so the build
+    /// functions can derive `ObjectMeta`, owner references and labels without the full
+    /// `HbaseCluster` object. Holds only name, namespace and uid.
+    metadata: ObjectMeta,
     /// The logical (and Kubernetes object) name of the cluster.
-    // Populated now; consumed by the new build path in a later commit.
-    #[allow(dead_code)]
     pub name: ClusterName,
+    /// The namespace the cluster lives in. Part of the cluster identity; currently consumed via
+    /// the [`Resource`] metadata (`name_and_namespace`) rather than read directly.
+    #[allow(dead_code)]
+    pub namespace: NamespaceName,
+    /// The UID of the `HbaseCluster` object, used to build owner references.
+    pub uid: Uid,
     pub image: ResolvedProductImage,
     pub cluster_config: ValidatedClusterConfig,
     pub role_group_configs: BTreeMap<HbaseRole, BTreeMap<String, ValidatedRoleGroupConfig>>,
     pub role_configs: BTreeMap<HbaseRole, ValidatedRoleConfig>,
 }
 
+impl ValidatedCluster {
+    #[allow(clippy::too_many_arguments)]
+    pub fn new(
+        name: ClusterName,
+        namespace: NamespaceName,
+        uid: Uid,
+        image: ResolvedProductImage,
+        cluster_config: ValidatedClusterConfig,
+        role_group_configs: BTreeMap<HbaseRole, BTreeMap<String, ValidatedRoleGroupConfig>>,
+        role_configs: BTreeMap<HbaseRole, ValidatedRoleConfig>,
+    ) -> Self {
+        Self {
+            metadata: ObjectMeta {
+                name: Some(name.to_string()),
+                namespace: Some(namespace.to_string()),
+                uid: Some(uid.to_string()),
+                ..ObjectMeta::default()
+            },
+            name,
+            namespace,
+            uid,
+            image,
+            cluster_config,
+            role_group_configs,
+            role_configs,
+        }
+    }
+}
+
+impl Resource for ValidatedCluster {
+    type DynamicType = <v1alpha1::HbaseCluster as Resource>::DynamicType;
+    type Scope = <v1alpha1::HbaseCluster as Resource>::Scope;
+
+    fn group(dt: &Self::DynamicType) -> std::borrow::Cow<'_, str> {
+        v1alpha1::HbaseCluster::group(dt)
+    }
+
+    fn version(dt: &Self::DynamicType) -> std::borrow::Cow<'_, str> {
+        v1alpha1::HbaseCluster::version(dt)
+    }
+
+    fn kind(dt: &Self::DynamicType) -> std::borrow::Cow<'_, str> {
+        v1alpha1::HbaseCluster::kind(dt)
+    }
+
+    fn plural(dt: &Self::DynamicType) -> std::borrow::Cow<'_, str> {
+        v1alpha1::HbaseCluster::plural(dt)
+    }
+
+    fn meta(&self) -> &ObjectMeta {
+        &self.metadata
+    }
+
+    fn meta_mut(&mut self) -> &mut ObjectMeta {
+        &mut self.metadata
+    }
+}
+
+impl HasName for ValidatedCluster {
+    fn to_name(&self) -> String {
+        self.name.to_string()
+    }
+}
+
+impl HasUid for ValidatedCluster {
+    fn to_uid(&self) -> Uid {
+        self.uid.clone()
+    }
+}
+
+impl NameIsValidLabelValue for ValidatedCluster {
+    fn to_label_value(&self) -> String {
+        self.name.to_label_value()
+    }
+}
+
 /// Cluster-wide settings resolved once during validation.
 #[derive(Clone, Debug)]
 pub struct ValidatedClusterConfig {
@@ -353,7 +446,6 @@ pub async fn reconcile_hbase(
                 &validated_cluster,
                 hbase_role,
                 &rolegroup,
-                hbase,
             )
             .context(BuildRolegroupConfigMapSnafu)?;
             let rg_statefulset = build_rolegroup_statefulset(
@@ -411,8 +503,8 @@ pub async fn reconcile_hbase(
 
     // Discovery CM will fail to build until the rest of the cluster has been deployed, so do it last
     // so that failure won't inhibit the rest of the cluster from booting up.
-    let discovery_cm = build_discovery_config_map(&validated_cluster, hbase)
-        .context(BuildDiscoveryConfigMapSnafu)?;
+    let discovery_cm =
+        build_discovery_config_map(&validated_cluster).context(BuildDiscoveryConfigMapSnafu)?;
     cluster_resources
         .add(client, discovery_cm)
         .await
@@ -881,12 +973,12 @@ pub fn error_policy(
     }
 }
 
-pub fn build_recommended_labels<'a>(
-    owner: &'a v1alpha1::HbaseCluster,
+pub fn build_recommended_labels<'a, R>(
+    owner: &'a R,
     app_version: &'a str,
     role: &'a str,
     role_group: &'a str,
-) -> ObjectLabels<'a, v1alpha1::HbaseCluster> {
+) -> ObjectLabels<'a, R> {
     ObjectLabels {
         owner,
         app_name: APP_NAME,

From 634449b82b5f0dad3233fc9e2ae74f258347b632 Mon Sep 17 00:00:00 2001
From: Malte Sander <malte.sander.it@gmail.com>
Date: Tue, 9 Jun 2026 12:14:26 +0200
Subject: [PATCH 21/21] refactor: use non optional property writers

---
 Cargo.lock                                    | 83 +++++++++---------
 Cargo.nix                                     | 87 +++++++++----------
 .../src/controller/build/discovery.rs         | 10 +--
 .../controller/build/properties/hbase_site.rs |  8 +-
 .../build/properties/security_properties.rs   |  8 +-
 .../controller/build/properties/ssl_client.rs |  6 +-
 .../controller/build/properties/ssl_server.rs |  6 +-
 7 files changed, 94 insertions(+), 114 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 4b9e0936..15c16088 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -265,9 +265,9 @@ checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
 
 [[package]]
 name = "bitflags"
-version = "2.12.1"
+version = "2.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84d7ced0ae9557296835c32bf1b1e02b44c746701f898460fb000d7eaa84f00a"
+checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
 
 [[package]]
 name = "block-buffer"
@@ -320,9 +320,9 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
 [[package]]
 name = "chrono"
-version = "0.4.44"
+version = "0.4.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
 dependencies = [
  "iana-time-zone",
  "num-traits",
@@ -1086,9 +1086,9 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "1.4.1"
+version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8be7462df143984c4598a256ef469b251d7d7f9e271135073e78fc535414f3d0"
+checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
 dependencies = [
  "bytes",
  "itoa",
@@ -1453,13 +1453,12 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.99"
+version = "0.3.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "142bc4740e452c1e57ade0cbc129f139c9093e354346f0872ef985f4f5cf5f11"
+checksum = "f2025f20d7a4fa7785846e7b63d10a76d3f1cee98ee5cb79ea59703f95e42162"
 dependencies = [
  "cfg-if",
  "futures-util",
- "once_cell",
  "wasm-bindgen",
 ]
 
@@ -1515,7 +1514,7 @@ dependencies = [
 [[package]]
 name = "k8s-version"
 version = "0.1.3"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#46cd3f93a788d44d177a8794fde91fbefa3156d7"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#de69410331ea51a37ec91e511d0d2f33056b6032"
 dependencies = [
  "darling",
  "regex",
@@ -1707,9 +1706,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.31"
+version = "0.4.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "113b30b4cd05f7c06868fdb2854f66a7b9fece9a48425351cd532e810d74024f"
+checksum = "953f07c43838f8e6f9758cab68bf5bed85465e7587ebe0b823f1bcd81978ad3a"
 
 [[package]]
 name = "matchers"
@@ -2188,9 +2187,9 @@ dependencies = [
 
 [[package]]
 name = "prost"
-version = "0.14.3"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2ea70524a2f82d518bce41317d0fae74151505651af45faf1ffbd6fd33f0568"
+checksum = "528ac67416ff8646872a3c02cad9cc4ee5dc9f9540c9b10771855c95cb2e5ae1"
 dependencies = [
  "bytes",
  "prost-derive",
@@ -2198,9 +2197,9 @@ dependencies = [
 
 [[package]]
 name = "prost-derive"
-version = "0.14.3"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b"
+checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
 dependencies = [
  "anyhow",
  "itertools",
@@ -2211,9 +2210,9 @@ dependencies = [
 
 [[package]]
 name = "prost-types"
-version = "0.14.3"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8991c4cbdb8bc5b11f0b074ffe286c30e523de90fee5ba8132f1399f23cb3dd7"
+checksum = "f94967dc7688f3054c7fac87473ffae4cc4c3904800e2d9f5b857246d8963b0a"
 dependencies = [
  "prost",
 ]
@@ -2900,7 +2899,7 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 [[package]]
 name = "stackable-certs"
 version = "0.4.0"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#46cd3f93a788d44d177a8794fde91fbefa3156d7"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#de69410331ea51a37ec91e511d0d2f33056b6032"
 dependencies = [
  "const-oid",
  "ecdsa",
@@ -2947,7 +2946,7 @@ dependencies = [
 [[package]]
 name = "stackable-operator"
 version = "0.111.1"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#46cd3f93a788d44d177a8794fde91fbefa3156d7"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#de69410331ea51a37ec91e511d0d2f33056b6032"
 dependencies = [
  "base64",
  "clap",
@@ -2991,7 +2990,7 @@ dependencies = [
 [[package]]
 name = "stackable-operator-derive"
 version = "0.3.1"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#46cd3f93a788d44d177a8794fde91fbefa3156d7"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#de69410331ea51a37ec91e511d0d2f33056b6032"
 dependencies = [
  "darling",
  "proc-macro2",
@@ -3002,7 +3001,7 @@ dependencies = [
 [[package]]
 name = "stackable-shared"
 version = "0.1.1"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#46cd3f93a788d44d177a8794fde91fbefa3156d7"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#de69410331ea51a37ec91e511d0d2f33056b6032"
 dependencies = [
  "jiff",
  "k8s-openapi",
@@ -3019,7 +3018,7 @@ dependencies = [
 [[package]]
 name = "stackable-telemetry"
 version = "0.6.4"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#46cd3f93a788d44d177a8794fde91fbefa3156d7"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#de69410331ea51a37ec91e511d0d2f33056b6032"
 dependencies = [
  "axum",
  "clap",
@@ -3043,7 +3042,7 @@ dependencies = [
 [[package]]
 name = "stackable-versioned"
 version = "0.10.0"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#46cd3f93a788d44d177a8794fde91fbefa3156d7"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#de69410331ea51a37ec91e511d0d2f33056b6032"
 dependencies = [
  "kube",
  "schemars",
@@ -3057,7 +3056,7 @@ dependencies = [
 [[package]]
 name = "stackable-versioned-macros"
 version = "0.10.0"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#46cd3f93a788d44d177a8794fde91fbefa3156d7"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#de69410331ea51a37ec91e511d0d2f33056b6032"
 dependencies = [
  "convert_case",
  "convert_case_extras",
@@ -3075,7 +3074,7 @@ dependencies = [
 [[package]]
 name = "stackable-webhook"
 version = "0.9.1"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#46cd3f93a788d44d177a8794fde91fbefa3156d7"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=smooth-operator#de69410331ea51a37ec91e511d0d2f33056b6032"
 dependencies = [
  "arc-swap",
  "async-trait",
@@ -3669,9 +3668,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.23.2"
+version = "1.23.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d258b83ceec21034727ecee8c382cfa6c3e133699b0742c64571814fb420c9f7"
+checksum = "144d6b123cef80b301b8f72a9e2ca4370ddec21950d0a103dd22c437006d2db7"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -3721,9 +3720,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.122"
+version = "0.2.123"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ed04576f974d2b2fba0f38c51dbc5518011e38c36bf1143164be765528fd409"
+checksum = "a254a4b10c19a76f09a27640e7ffbf9bc30bf67e16a3bf28aaefa4920fe81563"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -3734,9 +3733,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.72"
+version = "0.4.73"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9473dbd2991ae90b6291c3c32c30c6187ac49aa32f9905d1cce280ec1e110b0f"
+checksum = "54568702fabf5d4849ce2b90fadfa64168a097eaf4b351ce9df8b687a0086aaf"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -3744,9 +3743,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.122"
+version = "0.2.123"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "916151b09da36bd82f6615cbf3a419e2f0ba23a03c6160e8e92eb6bd4aa1dec6"
+checksum = "24a40fc75b0ec6f3746ceb10d36f53a93dcd68a93b11b6445983945d79eba0dc"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -3754,9 +3753,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.122"
+version = "0.2.123"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "299047362ccbfce148b67ab7e73349f77748e00c8296f9542adfad2ad82c5c5e"
+checksum = "908f34bd9b9ce3d4caf07b72dfab63d61504d156856c6bd3cd87fa350cf3985b"
 dependencies = [
  "bumpalo",
  "proc-macro2",
@@ -3767,18 +3766,18 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.122"
+version = "0.2.123"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a929b2c61f11ba3e9bc35b50c1f25cb38e0e892c0c231ae2b8cf78d5dad4437"
+checksum = "7acbf7616c27b194bbb550bf77ed0c2c3e5b7fd1260a93082b95fb7f47959b92"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "web-sys"
-version = "0.3.99"
+version = "0.3.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d621441cfc37b84979402712047321980c178f299193a3589d05b99e8763436"
+checksum = "6e0871acf327f283dc6da28a1696cdc64fb355ba9f935d052021fa77f35cce69"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -3978,9 +3977,9 @@ checksum = "636f85e5ca6488e96401b61eb7de54f4e44755c988af0f52cf90230c312a1a89"
 
 [[package]]
 name = "yoke"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
 dependencies = [
  "stable_deref_trait",
  "yoke-derive",
diff --git a/Cargo.nix b/Cargo.nix
index 5fac81a9..cfa748a7 100644
--- a/Cargo.nix
+++ b/Cargo.nix
@@ -866,9 +866,9 @@ rec {
       };
       "bitflags" = rec {
         crateName = "bitflags";
-        version = "2.12.1";
+        version = "2.13.0";
         edition = "2021";
-        sha256 = "02phhjm7w380zdh8928zf13cfi1bw2qz2ay36ml2jmwmmv8cxmw4";
+        sha256 = "1y239gpvl061rfvav7jds8mjs42kmwi39is7yx5d1qw3hvp8nf5l";
         authors = [
           "The Rust Project Developers"
         ];
@@ -1012,9 +1012,9 @@ rec {
       };
       "chrono" = rec {
         crateName = "chrono";
-        version = "0.4.44";
+        version = "0.4.45";
         edition = "2021";
-        sha256 = "1c64mk9a235271j5g3v4zrzqqmd43vp9vki7vqfllpqf5rd0fwy6";
+        sha256 = "09rkcgk6is2sdhqs9142zv8xqnj8ryx8m9hknllqwyv9wxi9x9qs";
         dependencies = [
           {
             name = "iana-time-zone";
@@ -3401,9 +3401,9 @@ rec {
       };
       "http" = rec {
         crateName = "http";
-        version = "1.4.1";
+        version = "1.4.2";
         edition = "2021";
-        sha256 = "1l7k2ia57z3q7q3ka497krzps795kd3fymm2k12lr623y4nldrwb";
+        sha256 = "09b4p8fiivkg7wm0b59fyrn1jkm7px298ci7zb9igz6n647gaw39";
         authors = [
           "Alex Crichton <alex@alexcrichton.com>"
           "Carl Lerche <me@carllerche.com>"
@@ -4618,9 +4618,9 @@ rec {
       };
       "js-sys" = rec {
         crateName = "js-sys";
-        version = "0.3.99";
+        version = "0.3.100";
         edition = "2021";
-        sha256 = "04azrzsz91gr5s3z0ij36lz0kj9ry4lw3jz0mmbiwb251rsc8aql";
+        sha256 = "0qi1wjakyw2rx9wwprcfx77g3lvn1b8n6yvfhj2pgym4swh5y0pj";
         libName = "js_sys";
         authors = [
           "The wasm-bindgen Developers"
@@ -4637,11 +4637,6 @@ rec {
             usesDefaultFeatures = false;
             features = [ "std" ];
           }
-          {
-            name = "once_cell";
-            packageId = "once_cell";
-            usesDefaultFeatures = false;
-          }
           {
             name = "wasm-bindgen";
             packageId = "wasm-bindgen";
@@ -4831,7 +4826,7 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
-          rev = "46cd3f93a788d44d177a8794fde91fbefa3156d7";
+          rev = "de69410331ea51a37ec91e511d0d2f33056b6032";
           sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         libName = "k8s_version";
@@ -5639,9 +5634,9 @@ rec {
       };
       "log" = rec {
         crateName = "log";
-        version = "0.4.31";
+        version = "0.4.32";
         edition = "2021";
-        sha256 = "0kq2fh6q2bjkrm8m6hj8kb7gxfd7cr7qbcpxd1lc1xq5rns30fqi";
+        sha256 = "0fmdg0cxig7i4fwf1sw7fmg4d1gdbfzniawcfpwydy1q7320fgwm";
         authors = [
           "The Rust Project Developers"
         ];
@@ -7196,9 +7191,9 @@ rec {
       };
       "prost" = rec {
         crateName = "prost";
-        version = "0.14.3";
+        version = "0.14.4";
         edition = "2021";
-        sha256 = "0s057z9nzggzy7x4bbsiar852hg7zb81f4z4phcdb0ig99971snj";
+        sha256 = "1qas5v5rap45f43v3ja0jngxrrafrkcwl0iw5a3ld1pz2rscd2jj";
         authors = [
           "Dan Burkert <dan@danburkert.com>"
           "Lucio Franco <luciofranco14@gmail.com>"
@@ -7225,9 +7220,9 @@ rec {
       };
       "prost-derive" = rec {
         crateName = "prost-derive";
-        version = "0.14.3";
+        version = "0.14.4";
         edition = "2021";
-        sha256 = "02zvva6kb0pfvlyc4nac6gd37ncjrs8jq5scxcq4nbqkc8wh5ii7";
+        sha256 = "1pqa77d7da5pf6ba3kjj7510m5cynz6902ax01ckvr0pfrgv4w5m";
         procMacro = true;
         libName = "prost_derive";
         authors = [
@@ -7263,9 +7258,9 @@ rec {
       };
       "prost-types" = rec {
         crateName = "prost-types";
-        version = "0.14.3";
+        version = "0.14.4";
         edition = "2021";
-        sha256 = "1mrxrciryfgi6a0vmrgyj3g27r9hdhlgwkq71cgv3icbvg5w94c9";
+        sha256 = "02ivjvc4cwl5bfgjs3l00hwlrk74z8zlg1xcgx60bww8fvf6fjgr";
         libName = "prost_types";
         authors = [
           "Dan Burkert <dan@danburkert.com>"
@@ -9525,7 +9520,7 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
-          rev = "46cd3f93a788d44d177a8794fde91fbefa3156d7";
+          rev = "de69410331ea51a37ec91e511d0d2f33056b6032";
           sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         libName = "stackable_certs";
@@ -9725,7 +9720,7 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
-          rev = "46cd3f93a788d44d177a8794fde91fbefa3156d7";
+          rev = "de69410331ea51a37ec91e511d0d2f33056b6032";
           sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         libName = "stackable_operator";
@@ -9919,7 +9914,7 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
-          rev = "46cd3f93a788d44d177a8794fde91fbefa3156d7";
+          rev = "de69410331ea51a37ec91e511d0d2f33056b6032";
           sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         procMacro = true;
@@ -9954,7 +9949,7 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
-          rev = "46cd3f93a788d44d177a8794fde91fbefa3156d7";
+          rev = "de69410331ea51a37ec91e511d0d2f33056b6032";
           sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         libName = "stackable_shared";
@@ -10035,7 +10030,7 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
-          rev = "46cd3f93a788d44d177a8794fde91fbefa3156d7";
+          rev = "de69410331ea51a37ec91e511d0d2f33056b6032";
           sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         libName = "stackable_telemetry";
@@ -10145,7 +10140,7 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
-          rev = "46cd3f93a788d44d177a8794fde91fbefa3156d7";
+          rev = "de69410331ea51a37ec91e511d0d2f33056b6032";
           sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         libName = "stackable_versioned";
@@ -10195,7 +10190,7 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
-          rev = "46cd3f93a788d44d177a8794fde91fbefa3156d7";
+          rev = "de69410331ea51a37ec91e511d0d2f33056b6032";
           sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         procMacro = true;
@@ -10263,7 +10258,7 @@ rec {
         workspace_member = null;
         src = pkgs.fetchgit {
           url = "https://github.com/stackabletech//operator-rs.git";
-          rev = "46cd3f93a788d44d177a8794fde91fbefa3156d7";
+          rev = "de69410331ea51a37ec91e511d0d2f33056b6032";
           sha256 = "0idpq1xdkr94zrd95xsvrwkj3bvzbii9a7qmw23rn5w4yiwgmj96";
         };
         libName = "stackable_webhook";
@@ -12310,9 +12305,9 @@ rec {
       };
       "uuid" = rec {
         crateName = "uuid";
-        version = "1.23.2";
+        version = "1.23.3";
         edition = "2021";
-        sha256 = "1xy942s4z0bi8p3441wvd4ry3hx6ry1c7s6fgrr38462xqybhn6j";
+        sha256 = "1drddl03gi12vl1s3l2h371dw39plhn9wappp00v707g7h96nk8l";
         authors = [
           "Ashley Mannix<ashleymannix@live.com.au>"
           "Dylan DPC<dylan.dpc@gmail.com>"
@@ -12455,9 +12450,9 @@ rec {
       };
       "wasm-bindgen" = rec {
         crateName = "wasm-bindgen";
-        version = "0.2.122";
+        version = "0.2.123";
         edition = "2021";
-        sha256 = "02flix96brsb2r1i3grnikii302iqpdm337kl3xv5lklz5v4bl1y";
+        sha256 = "0qqmx07r597gm8lbz8qngvv0phwvpzzyfh3nl84nz9qr1jqs8m52";
         libName = "wasm_bindgen";
         authors = [
           "The wasm-bindgen Developers"
@@ -12506,9 +12501,9 @@ rec {
       };
       "wasm-bindgen-futures" = rec {
         crateName = "wasm-bindgen-futures";
-        version = "0.4.72";
+        version = "0.4.73";
         edition = "2021";
-        sha256 = "03qb24gfr072rk8hb69glfdc8yhqqqq2rhy3j5i0ps8sk79dnwwl";
+        sha256 = "1bva12h8gdpqkp753czlxabs0s21lvgzm41brr4lhpdzz818fmjl";
         libName = "wasm_bindgen_futures";
         authors = [
           "The wasm-bindgen Developers"
@@ -12534,9 +12529,9 @@ rec {
       };
       "wasm-bindgen-macro" = rec {
         crateName = "wasm-bindgen-macro";
-        version = "0.2.122";
+        version = "0.2.123";
         edition = "2021";
-        sha256 = "1inyl55bvdifx7l60q9wl0ivmw7236jg7jqmcqpxhsx3knq52qci";
+        sha256 = "1p50xdwmv543b52bc49vm5lcsgd9adpx647bdisg7ihfbg3hz914";
         procMacro = true;
         libName = "wasm_bindgen_macro";
         authors = [
@@ -12558,9 +12553,9 @@ rec {
       };
       "wasm-bindgen-macro-support" = rec {
         crateName = "wasm-bindgen-macro-support";
-        version = "0.2.122";
+        version = "0.2.123";
         edition = "2021";
-        sha256 = "0pjw5kc2mbfz59agk5l21kh4hxzp94rygdvsnr4f3z6b5hv4g419";
+        sha256 = "0nwqyc63byl7rp9nnv45av8h85fncfmxywkvy35d9qwwkfyk93wh";
         libName = "wasm_bindgen_macro_support";
         authors = [
           "The wasm-bindgen Developers"
@@ -12594,10 +12589,10 @@ rec {
       };
       "wasm-bindgen-shared" = rec {
         crateName = "wasm-bindgen-shared";
-        version = "0.2.122";
+        version = "0.2.123";
         edition = "2021";
         links = "wasm_bindgen";
-        sha256 = "0ds4mmfqvxwc5fp33hn0jblf0f6b4lghrd9mpkls66zic4n9p4ls";
+        sha256 = "14lvjm3pzywm5c4962i6s5zmngic1knpggshnnxr9c97dihzgjvs";
         libName = "wasm_bindgen_shared";
         authors = [
           "The wasm-bindgen Developers"
@@ -12612,9 +12607,9 @@ rec {
       };
       "web-sys" = rec {
         crateName = "web-sys";
-        version = "0.3.99";
+        version = "0.3.100";
         edition = "2021";
-        sha256 = "0dilfvl9jnyhi4skl6cry9wc300r693j0w82jjbq8yy3rx0i8qkd";
+        sha256 = "0sffbkrpgyi1402mv4wzp9av6ky6rnb1d2m2dpf87wi7yfn7223f";
         libName = "web_sys";
         authors = [
           "The wasm-bindgen Developers"
@@ -14037,9 +14032,9 @@ rec {
       };
       "yoke" = rec {
         crateName = "yoke";
-        version = "0.8.2";
+        version = "0.8.3";
         edition = "2021";
-        sha256 = "1jprcs7a98a5whvfs6r3jvfh1nnfp6zyijl7y4ywmn88lzywbs5b";
+        sha256 = "1xgyj6c2lxj2bp891ynmhws87c6z7yyv2li1v0ss9di40hxf57vh";
         authors = [
           "Manish Goregaokar <manishsmail@gmail.com>"
         ];
diff --git a/rust/operator-binary/src/controller/build/discovery.rs b/rust/operator-binary/src/controller/build/discovery.rs
index 99dace99..f7409471 100644
--- a/rust/operator-binary/src/controller/build/discovery.rs
+++ b/rust/operator-binary/src/controller/build/discovery.rs
@@ -1,7 +1,5 @@
 //! Build the discovery `ConfigMap` for the HbaseCluster.
 
-use std::collections::BTreeMap;
-
 use snafu::{ResultExt, Snafu};
 use stackable_operator::{
     builder::{configmap::ConfigMapBuilder, meta::ObjectMetaBuilder},
@@ -55,13 +53,7 @@ pub fn build_discovery_config_map(cluster: &ValidatedCluster) -> Result<ConfigMa
         )
         .add_data(
             ConfigFileName::HbaseSite.to_string(),
-            to_hadoop_xml(
-                hbase_site
-                    .into_iter()
-                    .map(|(k, v)| (k, Some(v)))
-                    .collect::<BTreeMap<_, _>>()
-                    .iter(),
-            ),
+            to_hadoop_xml(hbase_site.iter()),
         )
         .build()
         .context(BuildConfigMapSnafu)
diff --git a/rust/operator-binary/src/controller/build/properties/hbase_site.rs b/rust/operator-binary/src/controller/build/properties/hbase_site.rs
index 2d010911..200de3d4 100644
--- a/rust/operator-binary/src/controller/build/properties/hbase_site.rs
+++ b/rust/operator-binary/src/controller/build/properties/hbase_site.rs
@@ -112,13 +112,7 @@ pub fn build(
     // configOverride come last
     config.extend(resolved_overrides(overrides));
 
-    to_hadoop_xml(
-        config
-            .into_iter()
-            .map(|(k, v)| (k, Some(v)))
-            .collect::<BTreeMap<_, _>>()
-            .iter(),
-    )
+    to_hadoop_xml(config.iter())
 }
 
 #[cfg(test)]
diff --git a/rust/operator-binary/src/controller/build/properties/security_properties.rs b/rust/operator-binary/src/controller/build/properties/security_properties.rs
index 35ab38b4..69246812 100644
--- a/rust/operator-binary/src/controller/build/properties/security_properties.rs
+++ b/rust/operator-binary/src/controller/build/properties/security_properties.rs
@@ -27,18 +27,18 @@ pub fn build(
         HbaseRole::RestServer => "30",
     };
 
-    let mut config: BTreeMap<String, Option<String>> = BTreeMap::from([
+    let mut config: BTreeMap<String, String> = BTreeMap::from([
         (
             "networkaddress.cache.ttl".to_string(),
-            Some(positive_ttl.to_string()),
+            positive_ttl.to_string(),
         ),
         (
             "networkaddress.cache.negative.ttl".to_string(),
-            Some("0".to_string()),
+            "0".to_string(),
         ),
     ]);
     // Overrides applied last so users win.
-    config.extend(resolved_overrides(overrides).map(|(key, value)| (key, Some(value))));
+    config.extend(resolved_overrides(overrides));
     to_java_properties_string(config.iter())
 }
 
diff --git a/rust/operator-binary/src/controller/build/properties/ssl_client.rs b/rust/operator-binary/src/controller/build/properties/ssl_client.rs
index 3fc8093f..7cc7afbc 100644
--- a/rust/operator-binary/src/controller/build/properties/ssl_client.rs
+++ b/rust/operator-binary/src/controller/build/properties/ssl_client.rs
@@ -9,9 +9,9 @@ use crate::controller::build::properties::resolved_overrides;
 
 /// Renders `ssl-client.xml`.
 pub fn build(settings: BTreeMap<String, String>, overrides: KeyValueConfigOverrides) -> String {
-    let mut config: BTreeMap<String, Option<String>> = BTreeMap::new();
-    config.extend(settings.into_iter().map(|(k, v)| (k, Some(v))));
-    config.extend(resolved_overrides(overrides).map(|(k, v)| (k, Some(v))));
+    let mut config: BTreeMap<String, String> = BTreeMap::new();
+    config.extend(settings);
+    config.extend(resolved_overrides(overrides));
     to_hadoop_xml(config.iter())
 }
 
diff --git a/rust/operator-binary/src/controller/build/properties/ssl_server.rs b/rust/operator-binary/src/controller/build/properties/ssl_server.rs
index edf70aac..b14917d3 100644
--- a/rust/operator-binary/src/controller/build/properties/ssl_server.rs
+++ b/rust/operator-binary/src/controller/build/properties/ssl_server.rs
@@ -9,9 +9,9 @@ use crate::controller::build::properties::resolved_overrides;
 
 /// Renders `ssl-server.xml`.
 pub fn build(settings: BTreeMap<String, String>, overrides: KeyValueConfigOverrides) -> String {
-    let mut config: BTreeMap<String, Option<String>> = BTreeMap::new();
-    config.extend(settings.into_iter().map(|(k, v)| (k, Some(v))));
-    config.extend(resolved_overrides(overrides).map(|(k, v)| (k, Some(v))));
+    let mut config: BTreeMap<String, String> = BTreeMap::new();
+    config.extend(settings);
+    config.extend(resolved_overrides(overrides));
     to_hadoop_xml(config.iter())
 }