feat(provider-sync): sync provider credentials from Kubernetes Secrets

[mattj-monad]

Summary

Adds openshell-provider-sync, a controller that keeps provider credentials current with Kubernetes Secrets managed elsewhere (External Secrets Operator syncing from 1Password or Vault). It runs as its own Deployment and talks to the gateway only through the public UpdateProvider API, so a rotated Secret reaches running sandboxes without restarting the gateway or the sandbox. With stable_placeholder: true on the credential's profile (NVIDIA#3339, already in monad.14), it also reaches processes that are already running.

Related Issue

No fork issue. Upstream, a scoped-down version of NVIDIA#1882 is the long-term path. The agent-fleet side (the chart, plus the Secret labels and annotations) lives on agent-fleet feat/provider-sync.

Changes

• Crate openshell-provider-sync. The first commit is the prototype, cherry-picked from upstream main. The second makes it fit agent Secrets:
  • Several providers per Secret. openshell.nvidia.com/provider-credentials takes [provider:]KEY[=secret-key] entries, all in one workspace from openshell.nvidia.com/provider-workspace.
  • Each provider on its own. A failing provider no longer holds back its siblings. The requeue uses the soonest retry among the failed providers.
  • Empty means absent. A provider whose keys are all missing or empty is skipped with a ProviderSyncSkipped event. That lets a Secret list both Claude credential variants. Some keys set but not all is still refused, so a half-written Secret cannot cause a partial rotation.
  • What is sent. Only the changed keys, as a value-only update. Values are never logged or put in Events. State is held as salted fingerprints in memory, and every labelled Secret is resynced at startup.
  • Auth. Gateway endpoint plus an optional bearer token file and CA file. There is no mTLS. Today's gateways run without authentication, so the token file stays unset for now.
• Image. deploy/docker/Dockerfile.provider-sync, distroless cc-debian13:nonroot, USER 65532:65532, with no writable paths. monad-images.yml builds it for amd64 and arm64 and publishes ghcr.io/monad-inc/openshell/provider-sync with the same tags as the gateway.
• Docs.
  • Crate README: annotation format, behavior, flags and RBAC.
  • MONAD.md image list.
  • A provider-sync section in the debug-openshell-cluster skill, covering each Event reason and a failure-pattern row.
  • configuration.mdx is unchanged, since no gateway TOML or Helm rendering changes.

Testing

• cargo test -p openshell-provider-sync: 30 passed. Coverage includes:
  • a multi-provider agent Secret;
  • rotating one key, which touches only its provider;
  • a failing provider isolated from its siblings;
  • switching between the Claude variants;
  • empty-as-absent;
  • conflicts and claim takeover.
• cargo clippy -p openshell-provider-sync --all-targets -D warnings: clean.
• mise run pre-commit: passed.
• Not yet run against a live gateway. The live rotation test on kind follows once this image and the agent-fleet chart land.

Checklist

• Conventional commits, signed off
• Tests added
• Docs and debug-openshell-cluster skill updated
• Live verification on kind (follow-up)

Limits

• One replica, no leader election. A second replica would only send duplicate idempotent updates.
• No activation wait. The controller doesn't wait for supervisors to report that they activated an update; the gateway's mutation id is logged for correlation.
• No health endpoint.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DSMF7ZMUu3WSs72KbVBBmJ