Provider credentials

AgentOS separates request enforcement, authorization decisions, and credential delivery. A Mate calls the explicit governed provider endpoint with its short-lived, Pod-bound ServiceAccount identity. The authorizer returns a bounded decision reference. Only the selected provider adapter attaches its one credential while forwarding the allowed request; it never returns that credential to the Mate.

Each adapter has one ServiceAccount, one credential domain, one reviewed upstream-host set, and at most one Secret projection. Provider Secrets live only in the core agentos namespace. A First Mate, Second Mate, Crewmate, or Pod in an agentos-domain-* namespace must not mount a provider root. Ordinary Internet traffic remains direct and does not depend on this path.

Use native agentgateway authentication only where the upstream contract fits: static file-backed headers, a supported OAuth token exchange, or AWS/GCP workload identity. GitHub App and refresh-token flows belong in a provider-only broker. A tool that cannot select a governed base URL needs a reviewed adapter; do not hand a bearer token to the tool as a fallback.

Rotate one domain

Replace the managed Secret with its current Kubernetes resourceVersion, following the released Secret procedure. Then roll only that domain's two-replica adapter with maxUnavailable: 0; do not restart Agent Pods. Agentgateway v1.4.1 reads file-backed credentials when configuration loads, so a projected-file update alone is not treated as a credential reload.

The desired and observed Secret resource versions define readiness. A mismatch is credential_rotating for at most 60 seconds. At the deadline it becomes credential_unavailable and the stale revision must stop serving. Missing, rejected, and exchange failures remain confined to that provider route and use finite, payload-free outcomes. Roll back by restoring the previous guarded Secret revision and rolling that same adapter.

The current Helm values are a reviewed render input. Production installation, semantic readiness, rollout automation, provider-scoped networking, canarying, and rollback remain owned by the AgentOS Kustomize package.