Since both AccessKey+SecretKey and ExistingSecretRef in the Auth of S3Server are optional one could create a server without auth.
Look into validating this via webhook: https://sdk.operatorframework.io/docs/building-operators/golang/webhook/#create-validation-webhook