From 5cd6fa8fe68a955c84077d717300ecce13e9f1f1 Mon Sep 17 00:00:00 2001
From: Andrew Kenworthy <andrew.kenworthy@stackable.tech>
Date: Mon, 20 Jul 2026 12:49:27 +0200
Subject: [PATCH 1/5] factor: add infallible rbac functions

---
 Cargo.lock                                    | 11 +--
 Cargo.toml                                    |  2 +-
 .../src/controller/build/mod.rs               | 81 +++++++++++++++----
 .../src/controller/build/resource/mod.rs      |  4 +-
 .../src/controller/build/resource/rbac.rs     | 42 ++++++++++
 .../controller/build/resource/statefulset.rs  |  8 +-
 rust/operator-binary/src/controller/mod.rs    | 38 +++++++--
 rust/operator-binary/src/hbase_controller.rs  | 64 ++++-----------
 8 files changed, 166 insertions(+), 84 deletions(-)
 create mode 100644 rust/operator-binary/src/controller/build/resource/rbac.rs

diff --git a/Cargo.lock b/Cargo.lock
index 233c8490..19c0a1c1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1607,7 +1607,6 @@ dependencies = [
 [[package]]
 name = "k8s-version"
 version = "0.1.3"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.3#013bbf43f7006a4ddfc08a147f68441ed88b462b"
 dependencies = [
  "darling",
  "regex",
@@ -3022,7 +3021,6 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 [[package]]
 name = "stackable-certs"
 version = "0.4.1"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.3#013bbf43f7006a4ddfc08a147f68441ed88b462b"
 dependencies = [
  "const-oid",
  "ecdsa",
@@ -3068,8 +3066,7 @@ dependencies = [
 
 [[package]]
 name = "stackable-operator"
-version = "0.113.3"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.3#013bbf43f7006a4ddfc08a147f68441ed88b462b"
+version = "0.113.4"
 dependencies = [
  "base64",
  "clap",
@@ -3114,7 +3111,6 @@ dependencies = [
 [[package]]
 name = "stackable-operator-derive"
 version = "0.3.1"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.3#013bbf43f7006a4ddfc08a147f68441ed88b462b"
 dependencies = [
  "darling",
  "proc-macro2",
@@ -3125,7 +3121,6 @@ dependencies = [
 [[package]]
 name = "stackable-shared"
 version = "0.1.2"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.3#013bbf43f7006a4ddfc08a147f68441ed88b462b"
 dependencies = [
  "jiff",
  "k8s-openapi",
@@ -3142,7 +3137,6 @@ dependencies = [
 [[package]]
 name = "stackable-telemetry"
 version = "0.6.5"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.3#013bbf43f7006a4ddfc08a147f68441ed88b462b"
 dependencies = [
  "axum",
  "clap",
@@ -3166,7 +3160,6 @@ dependencies = [
 [[package]]
 name = "stackable-versioned"
 version = "0.11.1"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.3#013bbf43f7006a4ddfc08a147f68441ed88b462b"
 dependencies = [
  "kube",
  "schemars",
@@ -3180,7 +3173,6 @@ dependencies = [
 [[package]]
 name = "stackable-versioned-macros"
 version = "0.11.1"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.3#013bbf43f7006a4ddfc08a147f68441ed88b462b"
 dependencies = [
  "convert_case",
  "convert_case_extras",
@@ -3198,7 +3190,6 @@ dependencies = [
 [[package]]
 name = "stackable-webhook"
 version = "0.9.2"
-source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.3#013bbf43f7006a4ddfc08a147f68441ed88b462b"
 dependencies = [
  "arc-swap",
  "async-trait",
diff --git a/Cargo.toml b/Cargo.toml
index ad98707b..c3c9b496 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -31,4 +31,4 @@ tracing = "0.1"
 
 [patch."https://github.com/stackabletech/operator-rs.git"]
 # stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "main" }
-# stackable-operator = { path = "../operator-rs/crates/stackable-operator" }
+stackable-operator = { path = "../operator-rs/crates/stackable-operator" }
diff --git a/rust/operator-binary/src/controller/build/mod.rs b/rust/operator-binary/src/controller/build/mod.rs
index 1c5dac7a..390eb417 100644
--- a/rust/operator-binary/src/controller/build/mod.rs
+++ b/rust/operator-binary/src/controller/build/mod.rs
@@ -1,4 +1,4 @@
-//! Builders that turn a [`ValidatedCluster`](crate::controller::ValidatedCluster) into
+//! Builders that turn a [`ValidatedCluster`] into
 //! Kubernetes resources.
 
 use std::str::FromStr;
@@ -15,6 +15,7 @@ use crate::{
             config_map::{self, build_rolegroup_config_map},
             discovery::{self, build_discovery_config_map},
             pdb::build_pdb,
+            rbac::{build_role_binding, build_service_account},
             service::{build_rolegroup_metrics_service, build_rolegroup_service},
             statefulset::{self, build_rolegroup_statefulset},
         },
@@ -56,7 +57,6 @@ pub enum Error {
 pub fn build(
     cluster: &ValidatedCluster,
     cluster_info: &KubernetesClusterInfo,
-    service_account_name: &str,
 ) -> Result<KubernetesResources, Error> {
     let mut stateful_sets = vec![];
     let mut services = vec![];
@@ -83,17 +83,11 @@ pub fn build(
                     })?,
             );
             stateful_sets.push(
-                build_rolegroup_statefulset(
-                    cluster,
-                    hbase_role,
-                    role_group_name,
-                    rg_config,
-                    service_account_name,
-                )
-                .with_context(|_| StatefulSetSnafu {
-                    hbase_role: hbase_role.clone(),
-                    role_group: role_group_name.clone(),
-                })?,
+                build_rolegroup_statefulset(cluster, hbase_role, role_group_name, rg_config)
+                    .with_context(|_| StatefulSetSnafu {
+                        hbase_role: hbase_role.clone(),
+                        role_group: role_group_name.clone(),
+                    })?,
             );
         }
 
@@ -113,6 +107,8 @@ pub fn build(
         services,
         config_maps,
         pod_disruption_budgets,
+        service_accounts: vec![build_service_account(cluster)],
+        role_bindings: vec![build_role_binding(cluster)],
     })
 }
 
@@ -127,6 +123,8 @@ pub mod role;
 
 #[cfg(test)]
 mod tests {
+    use std::collections::BTreeMap;
+
     use stackable_operator::kube::Resource;
 
     use super::build;
@@ -146,8 +144,7 @@ mod tests {
     fn build_produces_expected_resource_names() {
         let cluster = test_utils::validated_cluster();
         let cluster_info = test_utils::cluster_info();
-        let resources =
-            build(&cluster, &cluster_info, "hbase-serviceaccount").expect("build succeeds");
+        let resources = build(&cluster, &cluster_info).expect("build succeeds");
 
         // One StatefulSet per role group (one `default` group for each of the three roles).
         assert_eq!(
@@ -186,4 +183,58 @@ mod tests {
             ["hbase-master", "hbase-regionserver", "hbase-restserver"]
         );
     }
+
+    /// Locks the RBAC resource names, the roleRef, and the recommended label set against
+    /// accidental drift. The cluster name deliberately differs from the product name so that
+    /// swapped `name`/`instance` label values cannot pass unnoticed (the shared fixture is named
+    /// `hbase`, which would mask exactly that swap).
+    #[test]
+    fn build_produces_rbac() {
+        let hbase = test_utils::hbase_from_yaml(
+            &test_utils::MINIMAL_HBASE_YAML.replace("name: hbase", "name: my-hbase"),
+        );
+        let cluster = test_utils::validated_cluster_from(&hbase);
+        let cluster_info = test_utils::cluster_info();
+        let resources = build(&cluster, &cluster_info).expect("build succeeds");
+
+        assert_eq!(
+            sorted_names(&resources.service_accounts),
+            ["my-hbase-serviceaccount"]
+        );
+        assert_eq!(
+            sorted_names(&resources.role_bindings),
+            ["my-hbase-rolebinding"]
+        );
+
+        let expected_labels = BTreeMap::from(
+            [
+                ("app.kubernetes.io/component", "none"),
+                ("app.kubernetes.io/instance", "my-hbase"),
+                (
+                    "app.kubernetes.io/managed-by",
+                    "hbase.stackable.com_hbasecluster",
+                ),
+                ("app.kubernetes.io/name", "hbase"),
+                ("app.kubernetes.io/role-group", "none"),
+                ("app.kubernetes.io/version", "2.6.3-stackable0.0.0-dev"),
+                ("stackable.tech/vendor", "Stackable"),
+            ]
+            .map(|(key, value)| (key.to_string(), value.to_string())),
+        );
+        let service_account = resources
+            .service_accounts
+            .first()
+            .expect("a ServiceAccount is built");
+        assert_eq!(
+            service_account.metadata.labels,
+            Some(expected_labels.clone())
+        );
+
+        let role_binding = resources
+            .role_bindings
+            .first()
+            .expect("a RoleBinding is built");
+        assert_eq!(role_binding.metadata.labels, Some(expected_labels));
+        assert_eq!(role_binding.role_ref.name, "hbase-clusterrole");
+    }
 }
diff --git a/rust/operator-binary/src/controller/build/resource/mod.rs b/rust/operator-binary/src/controller/build/resource/mod.rs
index f9b822cd..6bfb9adb 100644
--- a/rust/operator-binary/src/controller/build/resource/mod.rs
+++ b/rust/operator-binary/src/controller/build/resource/mod.rs
@@ -1,9 +1,9 @@
-//! Builders that turn a [`ValidatedCluster`](crate::controller::ValidatedCluster) into
-//! Kubernetes resources.
+//! Builders for individual Kubernetes resources (one module per resource type).
 
 pub mod config_map;
 pub mod discovery;
 pub mod listener;
 pub mod pdb;
+pub mod rbac;
 pub mod service;
 pub mod statefulset;
diff --git a/rust/operator-binary/src/controller/build/resource/rbac.rs b/rust/operator-binary/src/controller/build/resource/rbac.rs
new file mode 100644
index 00000000..8d52854b
--- /dev/null
+++ b/rust/operator-binary/src/controller/build/resource/rbac.rs
@@ -0,0 +1,42 @@
+//! Builds the RBAC resources (ServiceAccount + RoleBinding) shared by all role groups.
+
+use std::str::FromStr;
+
+use stackable_operator::{
+    k8s_openapi::api::{core::v1::ServiceAccount, rbac::v1::RoleBinding},
+    kvp::Labels,
+    v2::{
+        rbac,
+        types::operator::{RoleGroupName, RoleName},
+    },
+};
+
+use crate::controller::ValidatedCluster;
+
+stackable_operator::constant!(NONE_ROLE_NAME: RoleName = "none");
+stackable_operator::constant!(NONE_ROLE_GROUP_NAME: RoleGroupName = "none");
+
+/// Builds the [`ServiceAccount`] that the role-group Pods run under.
+pub fn build_service_account(cluster: &ValidatedCluster) -> ServiceAccount {
+    rbac::build_service_account(
+        cluster,
+        &cluster.rbac_resource_names(),
+        rbac_labels(cluster),
+    )
+}
+
+/// Builds the [`RoleBinding`] that binds the [`ServiceAccount`] from [`build_service_account`] to
+/// the operator-deployed ClusterRole.
+pub fn build_role_binding(cluster: &ValidatedCluster) -> RoleBinding {
+    rbac::build_role_binding(
+        cluster,
+        &cluster.rbac_resource_names(),
+        rbac_labels(cluster),
+    )
+}
+
+/// Both resources are shared by the whole cluster rather than tied to a role or role group, so
+/// the recommended labels carry `none` for both values.
+fn rbac_labels(cluster: &ValidatedCluster) -> Labels {
+    cluster.recommended_labels_for(&NONE_ROLE_NAME, &NONE_ROLE_GROUP_NAME)
+}
diff --git a/rust/operator-binary/src/controller/build/resource/statefulset.rs b/rust/operator-binary/src/controller/build/resource/statefulset.rs
index 1ae98a9c..3b4152f9 100644
--- a/rust/operator-binary/src/controller/build/resource/statefulset.rs
+++ b/rust/operator-binary/src/controller/build/resource/statefulset.rs
@@ -106,7 +106,6 @@ pub fn build_rolegroup_statefulset(
     hbase_role: &HbaseRole,
     role_group_name: &RoleGroupName,
     validated_rg_config: &HbaseRoleGroupConfig,
-    service_account_name: &str,
 ) -> Result<StatefulSet> {
     let resolved_product_image = &cluster.image;
     let merged_config = &validated_rg_config.config.config;
@@ -239,7 +238,12 @@ pub fn build_rolegroup_statefulset(
             )),
         )
         .context(AddVolumeSnafu)?
-        .service_account_name(service_account_name)
+        .service_account_name(
+            cluster
+                .rbac_resource_names()
+                .service_account_name()
+                .to_string(),
+        )
         .security_context(PodSecurityContextBuilder::new().fs_group(1000).build());
 
     // The HBase container's log config ConfigMap: either the operator-generated one (the
diff --git a/rust/operator-binary/src/controller/mod.rs b/rust/operator-binary/src/controller/mod.rs
index 2cb2c9e6..eca4d60a 100644
--- a/rust/operator-binary/src/controller/mod.rs
+++ b/rust/operator-binary/src/controller/mod.rs
@@ -13,8 +13,9 @@ use stackable_operator::{
     k8s_openapi::{
         api::{
             apps::v1::StatefulSet,
-            core::v1::{ConfigMap, Service},
+            core::v1::{ConfigMap, Service, ServiceAccount},
             policy::v1::PodDisruptionBudget,
+            rbac::v1::RoleBinding,
         },
         apimachinery::pkg::apis::meta::v1::ObjectMeta,
     },
@@ -25,6 +26,7 @@ use stackable_operator::{
         builder::meta::ownerreference_from_resource,
         kvp::label::{recommended_labels, role_group_selector},
         role_group_utils::ResourceNames,
+        role_utils,
         types::{
             kubernetes::{ConfigMapName, NamespaceName, SecretClassName, Uid},
             operator::{
@@ -67,6 +69,8 @@ pub struct KubernetesResources {
     pub services: Vec<Service>,
     pub config_maps: Vec<ConfigMap>,
     pub pod_disruption_budgets: Vec<PodDisruptionBudget>,
+    pub service_accounts: Vec<ServiceAccount>,
+    pub role_bindings: Vec<RoleBinding>,
 }
 
 /// The validated cluster: proves that config merging and validation succeeded for
@@ -132,6 +136,15 @@ impl ValidatedCluster {
         RoleName::from_str(&hbase_role.to_string()).expect("an HbaseRole name is a valid role name")
     }
 
+    /// Type-safe names for the per-cluster RBAC resources: the ServiceAccount shared by all
+    /// Pods, its (namespaced) RoleBinding, and the operator-deployed ClusterRole it binds.
+    pub fn rbac_resource_names(&self) -> role_utils::ResourceNames {
+        role_utils::ResourceNames {
+            cluster_name: self.name.clone(),
+            product_name: product_name(),
+        }
+    }
+
     /// Type-safe names for the resources of a given role group.
     pub(crate) fn resource_names(
         &self,
@@ -146,18 +159,33 @@ impl ValidatedCluster {
     }
 
     /// Recommended labels for a role-group resource.
-    pub fn recommended_labels(
+    pub fn recommended_labels(&self, role: &HbaseRole, role_group_name: &RoleGroupName) -> Labels {
+        self.recommended_labels_for(&Self::role_name(role), role_group_name)
+    }
+
+    /// Recommended labels for a resource that is not tied to a concrete [`HbaseRole`] (e.g. the
+    /// Kubernetes executor pod template), using a free-form role/role-group label value.
+    pub fn recommended_labels_for(
         &self,
-        hbase_role: &HbaseRole,
+        role_name: &RoleName,
+        role_group_name: &RoleGroupName,
+    ) -> Labels {
+        self.recommended_labels_with(&self.product_version, role_name, role_group_name)
+    }
+
+    fn recommended_labels_with(
+        &self,
+        product_version: &ProductVersion,
+        role_name: &RoleName,
         role_group_name: &RoleGroupName,
     ) -> Labels {
         recommended_labels(
             self,
             &product_name(),
-            &self.product_version,
+            product_version,
             &operator_name(),
             &controller_name(),
-            &Self::role_name(hbase_role),
+            role_name,
             role_group_name,
         )
     }
diff --git a/rust/operator-binary/src/hbase_controller.rs b/rust/operator-binary/src/hbase_controller.rs
index 61d6ba46..f2861c39 100644
--- a/rust/operator-binary/src/hbase_controller.rs
+++ b/rust/operator-binary/src/hbase_controller.rs
@@ -11,13 +11,10 @@ use snafu::{ResultExt, Snafu};
 use stackable_operator::{
     cli::OperatorEnvironmentOptions,
     cluster_resources::ClusterResourceApplyStrategy,
-    commons::rbac::build_rbac_resources,
     kube::{
-        ResourceExt,
         core::{DeserializeGuard, error_boundary},
         runtime::controller::Action,
     },
-    kvp::LabelError,
     logging::controller::ReconcilerError,
     shared::time::Duration,
     status::condition::{
@@ -30,7 +27,7 @@ use strum::{EnumDiscriminants, IntoStaticStr};
 
 use crate::{
     controller::{build, controller_name, operator_name, product_name},
-    crd::{APP_NAME, HbaseClusterStatus, OPERATOR_NAME, v1alpha1},
+    crd::{HbaseClusterStatus, OPERATOR_NAME, v1alpha1},
 };
 
 pub struct Ctx {
@@ -46,24 +43,6 @@ pub enum Error {
         source: stackable_operator::cluster_resources::Error,
     },
 
-    #[snafu(display("failed to build RBAC resources"))]
-    BuildRbacResources {
-        source: stackable_operator::commons::rbac::Error,
-    },
-
-    #[snafu(display("failed to build label"))]
-    BuildLabel { source: LabelError },
-
-    #[snafu(display("failed to patch service account"))]
-    ApplyServiceAccount {
-        source: stackable_operator::cluster_resources::Error,
-    },
-
-    #[snafu(display("failed to patch role binding"))]
-    ApplyRoleBinding {
-        source: stackable_operator::cluster_resources::Error,
-    },
-
     #[snafu(display("failed to build cluster resources"))]
     BuildResources { source: build::Error },
 
@@ -137,39 +116,26 @@ pub async fn reconcile_hbase(
         &hbase.spec.object_overrides,
     );
 
-    let (rbac_sa, rbac_rolebinding) = build_rbac_resources(
-        hbase,
-        APP_NAME,
-        cluster_resources
-            .get_required_labels()
-            .context(BuildLabelSnafu)?,
-    )
-    .context(BuildRbacResourcesSnafu)?;
-    cluster_resources
-        .add(client, rbac_sa.clone())
-        .await
-        .context(ApplyServiceAccountSnafu)?;
-    cluster_resources
-        .add(client, rbac_rolebinding)
-        .await
-        .context(ApplyRoleBindingSnafu)?;
-
-    // The ServiceAccount name is deterministic on the built object, so the build step does not
-    // depend on the applied ServiceAccount.
-    let service_account_name = rbac_sa.name_any();
-
-    let resources = build::build(
-        &validated_cluster,
-        &client.kubernetes_cluster_info,
-        &service_account_name,
-    )
-    .context(BuildResourcesSnafu)?;
+    let resources = build::build(&validated_cluster, &client.kubernetes_cluster_info)
+        .context(BuildResourcesSnafu)?;
 
     let mut ss_cond_builder = StatefulSetConditionBuilder::default();
 
     // Apply order: everything before the StatefulSets, StatefulSets last. A changed ConfigMap or
     // Secret a Pod mounts must exist before the Pod restarts, otherwise the Pod restarts again
     // unnecessarily. See https://github.com/stackabletech/commons-operator/issues/111 for details.
+    for service_account in resources.service_accounts {
+        cluster_resources
+            .add(client, service_account)
+            .await
+            .context(ApplyResourceSnafu)?;
+    }
+    for role_binding in resources.role_bindings {
+        cluster_resources
+            .add(client, role_binding)
+            .await
+            .context(ApplyResourceSnafu)?;
+    }
     for service in resources.services {
         cluster_resources
             .add(client, service)

From a382f80e49c0d3c85494a672ae4edcebe5b891be Mon Sep 17 00:00:00 2001
From: Andrew Kenworthy <andrew.kenworthy@stackable.tech>
Date: Wed, 22 Jul 2026 10:39:59 +0200
Subject: [PATCH 2/5] switch to op-rs branch

---
 Cargo.lock        |  9 ++++++++
 Cargo.nix         | 56 +++++++++++++++++++++++------------------------
 Cargo.toml        |  4 ++--
 crate-hashes.json | 18 +++++++--------
 4 files changed, 48 insertions(+), 39 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 19c0a1c1..760a4ef5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1607,6 +1607,7 @@ dependencies = [
 [[package]]
 name = "k8s-version"
 version = "0.1.3"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#0e5442574027eff876b6763df930dc6924d7bfdd"
 dependencies = [
  "darling",
  "regex",
@@ -3021,6 +3022,7 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 [[package]]
 name = "stackable-certs"
 version = "0.4.1"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#0e5442574027eff876b6763df930dc6924d7bfdd"
 dependencies = [
  "const-oid",
  "ecdsa",
@@ -3067,6 +3069,7 @@ dependencies = [
 [[package]]
 name = "stackable-operator"
 version = "0.113.4"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#0e5442574027eff876b6763df930dc6924d7bfdd"
 dependencies = [
  "base64",
  "clap",
@@ -3111,6 +3114,7 @@ dependencies = [
 [[package]]
 name = "stackable-operator-derive"
 version = "0.3.1"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#0e5442574027eff876b6763df930dc6924d7bfdd"
 dependencies = [
  "darling",
  "proc-macro2",
@@ -3121,6 +3125,7 @@ dependencies = [
 [[package]]
 name = "stackable-shared"
 version = "0.1.2"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#0e5442574027eff876b6763df930dc6924d7bfdd"
 dependencies = [
  "jiff",
  "k8s-openapi",
@@ -3137,6 +3142,7 @@ dependencies = [
 [[package]]
 name = "stackable-telemetry"
 version = "0.6.5"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#0e5442574027eff876b6763df930dc6924d7bfdd"
 dependencies = [
  "axum",
  "clap",
@@ -3160,6 +3166,7 @@ dependencies = [
 [[package]]
 name = "stackable-versioned"
 version = "0.11.1"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#0e5442574027eff876b6763df930dc6924d7bfdd"
 dependencies = [
  "kube",
  "schemars",
@@ -3173,6 +3180,7 @@ dependencies = [
 [[package]]
 name = "stackable-versioned-macros"
 version = "0.11.1"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#0e5442574027eff876b6763df930dc6924d7bfdd"
 dependencies = [
  "convert_case",
  "convert_case_extras",
@@ -3190,6 +3198,7 @@ dependencies = [
 [[package]]
 name = "stackable-webhook"
 version = "0.9.2"
+source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#0e5442574027eff876b6763df930dc6924d7bfdd"
 dependencies = [
  "arc-swap",
  "async-trait",
diff --git a/Cargo.nix b/Cargo.nix
index e2f430e7..2d30d14c 100644
--- a/Cargo.nix
+++ b/Cargo.nix
@@ -5107,9 +5107,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "013bbf43f7006a4ddfc08a147f68441ed88b462b";
-          sha256 = "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "0e5442574027eff876b6763df930dc6924d7bfdd";
+          sha256 = "1la3w84zi2w2hqfm95prpyrzqzmy95p5n4dcwsw02m6hfpxqv1mn";
         };
         libName = "k8s_version";
         authors = [
@@ -9908,9 +9908,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "013bbf43f7006a4ddfc08a147f68441ed88b462b";
-          sha256 = "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "0e5442574027eff876b6763df930dc6924d7bfdd";
+          sha256 = "1la3w84zi2w2hqfm95prpyrzqzmy95p5n4dcwsw02m6hfpxqv1mn";
         };
         libName = "stackable_certs";
         authors = [
@@ -10104,13 +10104,13 @@ rec {
       };
       "stackable-operator" = rec {
         crateName = "stackable-operator";
-        version = "0.113.3";
+        version = "0.113.4";
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "013bbf43f7006a4ddfc08a147f68441ed88b462b";
-          sha256 = "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "0e5442574027eff876b6763df930dc6924d7bfdd";
+          sha256 = "1la3w84zi2w2hqfm95prpyrzqzmy95p5n4dcwsw02m6hfpxqv1mn";
         };
         libName = "stackable_operator";
         authors = [
@@ -10307,9 +10307,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "013bbf43f7006a4ddfc08a147f68441ed88b462b";
-          sha256 = "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "0e5442574027eff876b6763df930dc6924d7bfdd";
+          sha256 = "1la3w84zi2w2hqfm95prpyrzqzmy95p5n4dcwsw02m6hfpxqv1mn";
         };
         procMacro = true;
         libName = "stackable_operator_derive";
@@ -10342,9 +10342,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "013bbf43f7006a4ddfc08a147f68441ed88b462b";
-          sha256 = "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "0e5442574027eff876b6763df930dc6924d7bfdd";
+          sha256 = "1la3w84zi2w2hqfm95prpyrzqzmy95p5n4dcwsw02m6hfpxqv1mn";
         };
         libName = "stackable_shared";
         authors = [
@@ -10423,9 +10423,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "013bbf43f7006a4ddfc08a147f68441ed88b462b";
-          sha256 = "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "0e5442574027eff876b6763df930dc6924d7bfdd";
+          sha256 = "1la3w84zi2w2hqfm95prpyrzqzmy95p5n4dcwsw02m6hfpxqv1mn";
         };
         libName = "stackable_telemetry";
         authors = [
@@ -10533,9 +10533,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "013bbf43f7006a4ddfc08a147f68441ed88b462b";
-          sha256 = "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "0e5442574027eff876b6763df930dc6924d7bfdd";
+          sha256 = "1la3w84zi2w2hqfm95prpyrzqzmy95p5n4dcwsw02m6hfpxqv1mn";
         };
         libName = "stackable_versioned";
         authors = [
@@ -10583,9 +10583,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "013bbf43f7006a4ddfc08a147f68441ed88b462b";
-          sha256 = "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "0e5442574027eff876b6763df930dc6924d7bfdd";
+          sha256 = "1la3w84zi2w2hqfm95prpyrzqzmy95p5n4dcwsw02m6hfpxqv1mn";
         };
         procMacro = true;
         libName = "stackable_versioned_macros";
@@ -10651,9 +10651,9 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech/operator-rs.git";
-          rev = "013bbf43f7006a4ddfc08a147f68441ed88b462b";
-          sha256 = "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps";
+          url = "https://github.com/stackabletech//operator-rs.git";
+          rev = "0e5442574027eff876b6763df930dc6924d7bfdd";
+          sha256 = "1la3w84zi2w2hqfm95prpyrzqzmy95p5n4dcwsw02m6hfpxqv1mn";
         };
         libName = "stackable_webhook";
         authors = [
diff --git a/Cargo.toml b/Cargo.toml
index c3c9b496..a3c19ddb 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -30,5 +30,5 @@ tokio = { version = "1.52", features = ["full"] }
 tracing = "0.1"
 
 [patch."https://github.com/stackabletech/operator-rs.git"]
-# stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "main" }
-stackable-operator = { path = "../operator-rs/crates/stackable-operator" }
+stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "main" }
+# stackable-operator = { path = "../operator-rs/crates/stackable-operator" }
diff --git a/crate-hashes.json b/crate-hashes.json
index cd3917c3..a71a1c95 100644
--- a/crate-hashes.json
+++ b/crate-hashes.json
@@ -1,12 +1,12 @@
 {
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.3#k8s-version@0.1.3": "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.3#stackable-certs@0.4.1": "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.3#stackable-operator-derive@0.3.1": "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.3#stackable-operator@0.113.3": "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.3#stackable-shared@0.1.2": "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.3#stackable-telemetry@0.6.5": "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.3#stackable-versioned-macros@0.11.1": "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.3#stackable-versioned@0.11.1": "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps",
-  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.3#stackable-webhook@0.9.2": "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=main#k8s-version@0.1.3": "1la3w84zi2w2hqfm95prpyrzqzmy95p5n4dcwsw02m6hfpxqv1mn",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=main#stackable-certs@0.4.1": "1la3w84zi2w2hqfm95prpyrzqzmy95p5n4dcwsw02m6hfpxqv1mn",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=main#stackable-operator-derive@0.3.1": "1la3w84zi2w2hqfm95prpyrzqzmy95p5n4dcwsw02m6hfpxqv1mn",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=main#stackable-operator@0.113.4": "1la3w84zi2w2hqfm95prpyrzqzmy95p5n4dcwsw02m6hfpxqv1mn",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=main#stackable-shared@0.1.2": "1la3w84zi2w2hqfm95prpyrzqzmy95p5n4dcwsw02m6hfpxqv1mn",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=main#stackable-telemetry@0.6.5": "1la3w84zi2w2hqfm95prpyrzqzmy95p5n4dcwsw02m6hfpxqv1mn",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=main#stackable-versioned-macros@0.11.1": "1la3w84zi2w2hqfm95prpyrzqzmy95p5n4dcwsw02m6hfpxqv1mn",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=main#stackable-versioned@0.11.1": "1la3w84zi2w2hqfm95prpyrzqzmy95p5n4dcwsw02m6hfpxqv1mn",
+  "git+https://github.com/stackabletech//operator-rs.git?branch=main#stackable-webhook@0.9.2": "1la3w84zi2w2hqfm95prpyrzqzmy95p5n4dcwsw02m6hfpxqv1mn",
   "git+https://github.com/stackabletech/product-config.git?tag=0.8.0#product-config@0.8.0": "1dz70kapm2wdqcr7ndyjji0lhsl98bsq95gnb2lw487wf6yr7987"
 }
\ No newline at end of file

From 35d29a5f246fc20cc7ccaf1fe933ae2c87529bc4 Mon Sep 17 00:00:00 2001
From: Andrew Kenworthy <andrew.kenworthy@stackable.tech>
Date: Wed, 22 Jul 2026 10:42:08 +0200
Subject: [PATCH 3/5] changelog

---
 CHANGELOG.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a572f19b..249ba9f3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,8 +6,11 @@
 
 - Internal operator refactoring: introduce a build() step in the reconciler that
   assembles all relevant Kubernetes resources before anything is applied ([#776]).
+- The RBAC ServiceAccount and RoleBinding are now built with the operator-rs `v2::rbac`
+  functions and carry the full set of recommended labels ([#782]).
 
 [#776]: https://github.com/stackabletech/hbase-operator/pull/776
+[#782]: https://github.com/stackabletech/hbase-operator/pull/782
 
 ## [26.7.0] - 2026-07-21
 

From e65803603c4f9f7181743e4be0f63f5a9f04eb54 Mon Sep 17 00:00:00 2001
From: Andrew Kenworthy <andrew.kenworthy@stackable.tech>
Date: Wed, 22 Jul 2026 17:44:28 +0200
Subject: [PATCH 4/5] rename resource names functions, add role parse test

---
 .../controller/build/resource/config_map.rs   |  2 +-
 .../src/controller/build/resource/rbac.rs     |  4 ++--
 .../src/controller/build/resource/service.rs  |  4 ++--
 .../controller/build/resource/statefulset.rs  |  4 ++--
 rust/operator-binary/src/controller/mod.rs    | 21 +++++++++++++++++--
 5 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/rust/operator-binary/src/controller/build/resource/config_map.rs b/rust/operator-binary/src/controller/build/resource/config_map.rs
index 8e5037e1..8c3f1030 100644
--- a/rust/operator-binary/src/controller/build/resource/config_map.rs
+++ b/rust/operator-binary/src/controller/build/resource/config_map.rs
@@ -111,7 +111,7 @@ pub fn build_rolegroup_config_map(
     let cm_metadata = cluster
         .object_meta(
             cluster
-                .resource_names(role, role_group_name)
+                .role_group_resource_names(role, role_group_name)
                 .role_group_config_map()
                 .to_string(),
             role,
diff --git a/rust/operator-binary/src/controller/build/resource/rbac.rs b/rust/operator-binary/src/controller/build/resource/rbac.rs
index 8d52854b..e59a8818 100644
--- a/rust/operator-binary/src/controller/build/resource/rbac.rs
+++ b/rust/operator-binary/src/controller/build/resource/rbac.rs
@@ -20,7 +20,7 @@ stackable_operator::constant!(NONE_ROLE_GROUP_NAME: RoleGroupName = "none");
 pub fn build_service_account(cluster: &ValidatedCluster) -> ServiceAccount {
     rbac::build_service_account(
         cluster,
-        &cluster.rbac_resource_names(),
+        &cluster.cluster_resource_names(),
         rbac_labels(cluster),
     )
 }
@@ -30,7 +30,7 @@ pub fn build_service_account(cluster: &ValidatedCluster) -> ServiceAccount {
 pub fn build_role_binding(cluster: &ValidatedCluster) -> RoleBinding {
     rbac::build_role_binding(
         cluster,
-        &cluster.rbac_resource_names(),
+        &cluster.cluster_resource_names(),
         rbac_labels(cluster),
     )
 }
diff --git a/rust/operator-binary/src/controller/build/resource/service.rs b/rust/operator-binary/src/controller/build/resource/service.rs
index 103b1b67..f12025b8 100644
--- a/rust/operator-binary/src/controller/build/resource/service.rs
+++ b/rust/operator-binary/src/controller/build/resource/service.rs
@@ -35,7 +35,7 @@ pub fn build_rolegroup_service(
         metadata: cluster
             .object_meta(
                 cluster
-                    .resource_names(hbase_role, role_group_name)
+                    .role_group_resource_names(hbase_role, role_group_name)
                     .headless_service_name()
                     .to_string(),
                 hbase_role,
@@ -77,7 +77,7 @@ pub fn build_rolegroup_metrics_service(
         metadata: cluster
             .object_meta(
                 cluster
-                    .resource_names(hbase_role, role_group_name)
+                    .role_group_resource_names(hbase_role, role_group_name)
                     .metrics_service_name()
                     .to_string(),
                 hbase_role,
diff --git a/rust/operator-binary/src/controller/build/resource/statefulset.rs b/rust/operator-binary/src/controller/build/resource/statefulset.rs
index 3b4152f9..8c4b722e 100644
--- a/rust/operator-binary/src/controller/build/resource/statefulset.rs
+++ b/rust/operator-binary/src/controller/build/resource/statefulset.rs
@@ -110,7 +110,7 @@ pub fn build_rolegroup_statefulset(
     let resolved_product_image = &cluster.image;
     let merged_config = &validated_rg_config.config.config;
     let logging = &validated_rg_config.config.logging;
-    let resource_names = cluster.resource_names(hbase_role, role_group_name);
+    let resource_names = cluster.role_group_resource_names(hbase_role, role_group_name);
     let https_enabled = cluster.has_https_enabled();
 
     let ports = hbase_role
@@ -240,7 +240,7 @@ pub fn build_rolegroup_statefulset(
         .context(AddVolumeSnafu)?
         .service_account_name(
             cluster
-                .rbac_resource_names()
+                .cluster_resource_names()
                 .service_account_name()
                 .to_string(),
         )
diff --git a/rust/operator-binary/src/controller/mod.rs b/rust/operator-binary/src/controller/mod.rs
index eca4d60a..3c9c70f2 100644
--- a/rust/operator-binary/src/controller/mod.rs
+++ b/rust/operator-binary/src/controller/mod.rs
@@ -138,7 +138,7 @@ impl ValidatedCluster {
 
     /// Type-safe names for the per-cluster RBAC resources: the ServiceAccount shared by all
     /// Pods, its (namespaced) RoleBinding, and the operator-deployed ClusterRole it binds.
-    pub fn rbac_resource_names(&self) -> role_utils::ResourceNames {
+    pub fn cluster_resource_names(&self) -> role_utils::ResourceNames {
         role_utils::ResourceNames {
             cluster_name: self.name.clone(),
             product_name: product_name(),
@@ -146,7 +146,7 @@ impl ValidatedCluster {
     }
 
     /// Type-safe names for the resources of a given role group.
-    pub(crate) fn resource_names(
+    pub(crate) fn role_group_resource_names(
         &self,
         hbase_role: &HbaseRole,
         role_group_name: &RoleGroupName,
@@ -323,3 +323,20 @@ pub type HbaseRoleGroupConfig = stackable_operator::v2::role_utils::RoleGroupCon
     stackable_operator::v2::role_utils::JavaCommonConfig,
     v1alpha1::HbaseConfigOverrides,
 >;
+
+#[cfg(test)]
+mod tests {
+    use strum::IntoEnumIterator;
+
+    use super::ValidatedCluster;
+    use crate::crd::HbaseRole;
+
+    /// Locks the invariant behind the `expect` in [`ValidatedCluster::role_name`]: every
+    /// `HbaseRole` variant (present and future) must serialise to a valid `RoleName`.
+    #[test]
+    fn every_hbase_role_serialises_to_a_valid_role_name() {
+        for role in HbaseRole::iter() {
+            ValidatedCluster::role_name(&role);
+        }
+    }
+}

From fcf1fc78bfbc614b31f7498858d34e7fe60d7959 Mon Sep 17 00:00:00 2001
From: Andrew Kenworthy <andrew.kenworthy@stackable.tech>
Date: Thu, 23 Jul 2026 09:01:03 +0200
Subject: [PATCH 5/5] reference op-rs 0.114.0

---
 Cargo.lock        | 18 +++++++++---------
 Cargo.nix         | 18 +++++++++---------
 Cargo.toml        |  2 +-
 crate-hashes.json | 18 +++++++++---------
 4 files changed, 28 insertions(+), 28 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 4b6988a9..738bf374 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1581,7 +1581,7 @@ dependencies = [
 [[package]]
 name = "k8s-version"
 version = "0.1.3"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#ee66b8d66fe10c216acfed0f81070b362604b392"
+source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.114.0#ee66b8d66fe10c216acfed0f81070b362604b392"
 dependencies = [
  "darling",
  "regex",
@@ -2959,7 +2959,7 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 [[package]]
 name = "stackable-certs"
 version = "0.4.1"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#ee66b8d66fe10c216acfed0f81070b362604b392"
+source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.114.0#ee66b8d66fe10c216acfed0f81070b362604b392"
 dependencies = [
  "const-oid",
  "ecdsa",
@@ -3006,7 +3006,7 @@ dependencies = [
 [[package]]
 name = "stackable-operator"
 version = "0.114.0"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#ee66b8d66fe10c216acfed0f81070b362604b392"
+source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.114.0#ee66b8d66fe10c216acfed0f81070b362604b392"
 dependencies = [
  "base64",
  "clap",
@@ -3050,7 +3050,7 @@ dependencies = [
 [[package]]
 name = "stackable-operator-derive"
 version = "0.3.1"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#ee66b8d66fe10c216acfed0f81070b362604b392"
+source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.114.0#ee66b8d66fe10c216acfed0f81070b362604b392"
 dependencies = [
  "darling",
  "proc-macro2",
@@ -3061,7 +3061,7 @@ dependencies = [
 [[package]]
 name = "stackable-shared"
 version = "0.1.2"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#ee66b8d66fe10c216acfed0f81070b362604b392"
+source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.114.0#ee66b8d66fe10c216acfed0f81070b362604b392"
 dependencies = [
  "jiff",
  "k8s-openapi",
@@ -3078,7 +3078,7 @@ dependencies = [
 [[package]]
 name = "stackable-telemetry"
 version = "0.6.5"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#ee66b8d66fe10c216acfed0f81070b362604b392"
+source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.114.0#ee66b8d66fe10c216acfed0f81070b362604b392"
 dependencies = [
  "axum",
  "clap",
@@ -3102,7 +3102,7 @@ dependencies = [
 [[package]]
 name = "stackable-versioned"
 version = "0.11.1"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#ee66b8d66fe10c216acfed0f81070b362604b392"
+source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.114.0#ee66b8d66fe10c216acfed0f81070b362604b392"
 dependencies = [
  "kube",
  "schemars",
@@ -3116,7 +3116,7 @@ dependencies = [
 [[package]]
 name = "stackable-versioned-macros"
 version = "0.11.1"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#ee66b8d66fe10c216acfed0f81070b362604b392"
+source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.114.0#ee66b8d66fe10c216acfed0f81070b362604b392"
 dependencies = [
  "convert_case",
  "convert_case_extras",
@@ -3134,7 +3134,7 @@ dependencies = [
 [[package]]
 name = "stackable-webhook"
 version = "0.9.2"
-source = "git+https://github.com/stackabletech//operator-rs.git?branch=main#ee66b8d66fe10c216acfed0f81070b362604b392"
+source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.114.0#ee66b8d66fe10c216acfed0f81070b362604b392"
 dependencies = [
  "arc-swap",
  "async-trait",
diff --git a/Cargo.nix b/Cargo.nix
index 30ab1f7f..1c98d4be 100644
--- a/Cargo.nix
+++ b/Cargo.nix
@@ -5026,7 +5026,7 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech//operator-rs.git";
+          url = "https://github.com/stackabletech/operator-rs.git";
           rev = "ee66b8d66fe10c216acfed0f81070b362604b392";
           sha256 = "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj";
         };
@@ -9707,7 +9707,7 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech//operator-rs.git";
+          url = "https://github.com/stackabletech/operator-rs.git";
           rev = "ee66b8d66fe10c216acfed0f81070b362604b392";
           sha256 = "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj";
         };
@@ -9907,7 +9907,7 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech//operator-rs.git";
+          url = "https://github.com/stackabletech/operator-rs.git";
           rev = "ee66b8d66fe10c216acfed0f81070b362604b392";
           sha256 = "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj";
         };
@@ -10102,7 +10102,7 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech//operator-rs.git";
+          url = "https://github.com/stackabletech/operator-rs.git";
           rev = "ee66b8d66fe10c216acfed0f81070b362604b392";
           sha256 = "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj";
         };
@@ -10137,7 +10137,7 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech//operator-rs.git";
+          url = "https://github.com/stackabletech/operator-rs.git";
           rev = "ee66b8d66fe10c216acfed0f81070b362604b392";
           sha256 = "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj";
         };
@@ -10218,7 +10218,7 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech//operator-rs.git";
+          url = "https://github.com/stackabletech/operator-rs.git";
           rev = "ee66b8d66fe10c216acfed0f81070b362604b392";
           sha256 = "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj";
         };
@@ -10328,7 +10328,7 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech//operator-rs.git";
+          url = "https://github.com/stackabletech/operator-rs.git";
           rev = "ee66b8d66fe10c216acfed0f81070b362604b392";
           sha256 = "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj";
         };
@@ -10378,7 +10378,7 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech//operator-rs.git";
+          url = "https://github.com/stackabletech/operator-rs.git";
           rev = "ee66b8d66fe10c216acfed0f81070b362604b392";
           sha256 = "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj";
         };
@@ -10446,7 +10446,7 @@ rec {
         edition = "2024";
         workspace_member = null;
         src = pkgs.fetchgit {
-          url = "https://github.com/stackabletech//operator-rs.git";
+          url = "https://github.com/stackabletech/operator-rs.git";
           rev = "ee66b8d66fe10c216acfed0f81070b362604b392";
           sha256 = "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj";
         };
diff --git a/Cargo.toml b/Cargo.toml
index ff1bc286..4346053a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -30,5 +30,5 @@ tokio = { version = "1.52", features = ["full"] }
 tracing = "0.1"
 
 [patch."https://github.com/stackabletech/operator-rs.git"]
-stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "main" }
+# stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "main" }
 # stackable-operator = { path = "../operator-rs/crates/stackable-operator" }
diff --git a/crate-hashes.json b/crate-hashes.json
index 3ddbc0ba..04979b96 100644
--- a/crate-hashes.json
+++ b/crate-hashes.json
@@ -1,11 +1,11 @@
 {
-  "git+https://github.com/stackabletech//operator-rs.git?branch=main#k8s-version@0.1.3": "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj",
-  "git+https://github.com/stackabletech//operator-rs.git?branch=main#stackable-certs@0.4.1": "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj",
-  "git+https://github.com/stackabletech//operator-rs.git?branch=main#stackable-operator-derive@0.3.1": "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj",
-  "git+https://github.com/stackabletech//operator-rs.git?branch=main#stackable-operator@0.114.0": "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj",
-  "git+https://github.com/stackabletech//operator-rs.git?branch=main#stackable-shared@0.1.2": "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj",
-  "git+https://github.com/stackabletech//operator-rs.git?branch=main#stackable-telemetry@0.6.5": "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj",
-  "git+https://github.com/stackabletech//operator-rs.git?branch=main#stackable-versioned-macros@0.11.1": "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj",
-  "git+https://github.com/stackabletech//operator-rs.git?branch=main#stackable-versioned@0.11.1": "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj",
-  "git+https://github.com/stackabletech//operator-rs.git?branch=main#stackable-webhook@0.9.2": "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj"
+  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.114.0#k8s-version@0.1.3": "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj",
+  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.114.0#stackable-certs@0.4.1": "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj",
+  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.114.0#stackable-operator-derive@0.3.1": "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj",
+  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.114.0#stackable-operator@0.114.0": "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj",
+  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.114.0#stackable-shared@0.1.2": "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj",
+  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.114.0#stackable-telemetry@0.6.5": "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj",
+  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.114.0#stackable-versioned-macros@0.11.1": "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj",
+  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.114.0#stackable-versioned@0.11.1": "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj",
+  "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.114.0#stackable-webhook@0.9.2": "1v6slybgc0xqsmh3bxyid6xjvmz8ps41nfmmc6csgyzqs2v0wzxj"
 }
\ No newline at end of file