User Story
As a contributor touching the credential drivers, I want the kubernetes-credential-drivers-e2e job to be able to pass on main, so that driver changes have runnable end-to-end evidence.
Problem Statement
The e2e helper computes managed secret names/paths with a stale derivation, so it looks up names the drivers never write, and the suite cannot pass on current main.
e2e/rust/tests/credential_drivers.rs:55-73 derives managed_kubernetes_secret_name / managed_vault_path as SHA256(provider_name \0 "OPENAI_API_KEY")[..40] (2 fields). The drivers derive managed destinations from 5 fields (provider identity fields plus object_id). The kubernetes-secrets arm fails at the first managed-name lookup, so the vault arm never runs.
A fix appears to exist already: branch 1021-ha-gateway-rebalancing/tm (head 908dc4d9) carries an updated fn managed_vault_path(identity: &ProviderIdentity, provider_name: &str) matching the drivers' derivation, and has a green workflow_dispatch run of this job (run 31837361446, 2026-08-14). Cherry-picking that helper change looks sufficient, though we have not run it ourselves.
Impact / Why This Matters
The job is label-gated (test:e2e-kubernetes), so the breakage mostly goes unnoticed: in the 200 most recent branch-e2e.yml runs (2026-08-21 to 2026-08-27) it executed exactly once, and failed. As far as we can tell there is currently no green e2e evidence on main for either credential driver.
Acceptance Criteria
- kubernetes-credential-drivers-e2e passes on main when triggered.
- The e2e helper's managed-name derivation matches the drivers' derivation (ideally shared rather than duplicated, but that is an internal choice).
Reproduction Steps
- Trigger branch-e2e.yml on current main with the test:e2e-kubernetes label (or workflow_dispatch).
- Observe the kubernetes-secrets arm panic at the first managed-name lookup.
Environment
main as of 2026-08-27; hosted CI (branch-e2e.yml, job kubernetes-credential-drivers-e2e). Observed on run 33035325468 / job 98398843310 (2026-08-27T03:05Z, PR #2968).
Logs
panicked at tests/credential_drivers.rs:431:12: credential storage e2e failed:
kubectl get secret openshell-cred-f80a16c276dabd5629cb4c6936ab849503d3a9b9 ...
Error from server (NotFound)
Drafted by an agent that hit this while surveying the credential drivers; reviewed and endorsed by a human before posting.
User Story
As a contributor touching the credential drivers, I want the kubernetes-credential-drivers-e2e job to be able to pass on main, so that driver changes have runnable end-to-end evidence.
Problem Statement
The e2e helper computes managed secret names/paths with a stale derivation, so it looks up names the drivers never write, and the suite cannot pass on current main.
e2e/rust/tests/credential_drivers.rs:55-73 derives managed_kubernetes_secret_name / managed_vault_path as SHA256(provider_name \0 "OPENAI_API_KEY")[..40] (2 fields). The drivers derive managed destinations from 5 fields (provider identity fields plus object_id). The kubernetes-secrets arm fails at the first managed-name lookup, so the vault arm never runs.
A fix appears to exist already: branch 1021-ha-gateway-rebalancing/tm (head 908dc4d9) carries an updated fn managed_vault_path(identity: &ProviderIdentity, provider_name: &str) matching the drivers' derivation, and has a green workflow_dispatch run of this job (run 31837361446, 2026-08-14). Cherry-picking that helper change looks sufficient, though we have not run it ourselves.
Impact / Why This Matters
The job is label-gated (test:e2e-kubernetes), so the breakage mostly goes unnoticed: in the 200 most recent branch-e2e.yml runs (2026-08-21 to 2026-08-27) it executed exactly once, and failed. As far as we can tell there is currently no green e2e evidence on main for either credential driver.
Acceptance Criteria
Reproduction Steps
Environment
main as of 2026-08-27; hosted CI (branch-e2e.yml, job kubernetes-credential-drivers-e2e). Observed on run 33035325468 / job 98398843310 (2026-08-27T03:05Z, PR #2968).
Logs
Drafted by an agent that hit this while surveying the credential drivers; reviewed and endorsed by a human before posting.