We've made Galera->Spec->Secret optional in the Galera CR, meaning you can set it to blank or omit, but an openstackcontrolplane forces it to be "osp-secret" or other non-blank value.   this prevents root PWs that are automatically generated, that is, not derived from DbRootPassword or another pre-defined Secret.