feat(credentials): add opt-in workspace credential sources

[Pal Lakatos-Toth (pallakatos)]

Publication stack

Follows #548 and targets its namespace-ownership branch for a focused delta. Do not merge into the intermediate feature branch. After preceding slices land, retarget to the protected kars-bridge integration branch and require fresh exact-head CI, genuine audit sign-offs and independent approval. Final promotion to main remains separate.

Scope

• Add optional same-workspace spec.credentialsRef: {name, uid}. When absent, the existing direct <sandbox>-credentials collection remains the default.
• Require explicit source purpose/intent/target, the reserved source name and real source UID. Bind the source and projection to the exact Sandbox, workspace and runtime Namespace incarnation; never discover credentials by name alone for a future Sandbox.
• Project the selected collection only into the agent container, with metadata-only anchoring and UID/resourceVersion-fenced writes. Provider/router/control-plane credentials are not mounted through this feature.
• Refresh the consumer on key rotation/removal. Invalid or missing sources stop the verified consumer and revoke only the owned projection; they do not silently reactivate legacy credentials. Explicit opt-out restores the unchanged direct collection.
• Add CLI add --credential-source, credentials update --use-source, --remove, --disable-source, workspace selection, UID binding, one-time migration, schema-retention detection and controller acknowledgement.
• Add the CRD schema, migration/operation documentation and a real-consumer lifecycle case in the existing disposable Kind harness.

Deliberate v1 limits

This source supports the existing ten channel/search credential keys only. Arbitrary internal-system keys, raw GitHub tokens, provider credentials and process-environment overrides are not supported. Migration rejects unsupported keys rather than dropping them. Existing direct-mode flags remain available.

This is not full Bridge credential integration or Secret-RBAC closure. Bridge still needs a separate adapter, launch binding, scoped permissions and qualification; its arbitrary-key credential UI cannot simply be redirected to this limited allowlist. No Bridge permissions are removed here. Kars remains independently usable without Bridge.

Source revocation is asynchronous: Kubernetes API/node failures can delay termination, and this does not invalidate an external-provider token or erase a value already observed by an agent. Overlay-managed and unwired runtimes are not supported. These limits are documented in docs/how-to/credential-sources.md.

Hosted installation blocker and repair

The first real Kind run at b69a6ad6 exposed a missing Helm schema declaration: the new CEL rule referenced upstreamCompatibility, so Kubernetes rejected the entire Sandbox CRD. Credential-consumer execution was therefore not established. This was a real install blocker, not the separate missing-signature gate.

Repair 693a46ca declares the existing optional Rust compatibility fields, retains the source/overlay admission restriction, asserts its schema dependencies, and requires the intended rejection message in live admission coverage. Helm setup now stops immediately on failure. Automated source review of the five-file repair is closed with no significant issues found: optional/native behavior is preserved and the CEL field dependencies are declared. This is not live API qualification or human approval. The repaired head must pass actual API-server and lifecycle execution before readiness; rendering and source review alone are not sufficient.

Lifecycle cleanup repair and closure

Hosted run 34161927565 at 693a46ca successfully installed the CRD, enforced the intended overlay admission guard, and passed real BYO credential delivery, rotation/key removal, source-deletion revocation without fallback, and explicit opt-out. Sandbox namespace deletion completed. The subsequent InferencePolicy fixture deletion hung until the job deadline; the complete E2E gate therefore remains failed, not green.

Diagnostic commit d444656b exposed the root cause: Kubernetes rejected the partial server-side-apply finalizer-removal payload because metadata.name was missing, leaving the policy terminating after its profile ConfigMap was deleted. Repair 8b206065 replaces both finalizer registration/removal with complete name/namespace/UID/resourceVersion-fenced metadata merges, preserves other finalizers, and propagates non-404 ConfigMap cleanup errors before releasing cleanup authority. Fourteen targeted reconcile/HTTP cases and strict controller Clippy passed. Automated bounded review of the finalizer repair is closed with no significant issues found. This is source/test inspection, not human approval or independent live execution. The mandatory Kind gate now passes at exact head 8b206065: 111 cases, zero failures, including complete policy cleanup and preservation of the core namespace. Evidence: https://github.com/Azure/kars/actions/runs/34169168508/job/101889685225 . All technical CI gates pass; the sole remaining failing check requires two genuine audit sign-offs (author and independent reviewer). No human approval is implied.

Evidence and remaining gates

Current candidate: 8b206065608593667a40665b3f48225ef9ce278d, based on namespace head 62093414.

• Owning-agent local qualification: 66 targeted Rust tests, strict controller all-target Clippy, 90 CLI/Helm tests, typecheck and changed-file lint passed. Existing diff-based LOC/no-stub/crypto/copyright guards passed after handoff. No dependencies were changed or installed.
• The added Kind case uses the already-loaded BYO test image and fixed log markers, not printed credential values. It covers actual consumer environment, rotation/removal, no-fallback revocation, explicit legacy restoration and cleanup. Its syntax and hosted execution both passed at 8b206065, including the final mandatory cleanup.
• Automated technical review of the complete source/CLI lifecycle and frozen E2E harness is complete at b69a6ad6, with no significant issues found. Source review and in-memory CLI probes are not independent live execution, human sign-off or merge approval. Hosted lifecycle results and genuine review/signature gates remain required.
• The dated capability audit is docs/security-audits/2026-09-07-credential-sources.md. Genuine author and independent-reviewer signatures are pending; the audit gate must remain blocked until they exist. No identities or sign-offs are fabricated.
• Hosted exact-head CLI/Rust/Helm, dependency/security, CodeQL, Kind, chaos and benchmark checks have all passed, supplying the lockfile-exact evidence beyond the authorized local cache runs.

No customer/H100 deployment, Azure infrastructure mutation, public image release, integration merge or main merge is performed by preparing this draft.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None