credential-drivers e2e computes a stale 2-field managed path; the suite cannot pass on main

[pierzchalski]

User Story

As a contributor touching the credential drivers, I want the kubernetes-credential-drivers-e2e job to be able to pass on main, so that driver changes have runnable end-to-end evidence.

Problem Statement

The e2e helper computes managed secret names/paths with a stale derivation, so it looks up names the drivers never write, and the suite cannot pass on current main.

e2e/rust/tests/credential_drivers.rs:55-73 derives managed_kubernetes_secret_name / managed_vault_path as SHA256(provider_name \0 "OPENAI_API_KEY")[..40] (2 fields). The drivers derive managed destinations from 5 fields (provider identity fields plus object_id). The kubernetes-secrets arm fails at the first managed-name lookup, so the vault arm never runs.

A fix appears to exist already: branch 1021-ha-gateway-rebalancing/tm (head 908dc4d9) carries an updated fn managed_vault_path(identity: &ProviderIdentity, provider_name: &str) matching the drivers' derivation, and has a green workflow_dispatch run of this job (run 31837361446, 2026-08-14). Cherry-picking that helper change looks sufficient, though we have not run it ourselves.

Impact / Why This Matters

The job is label-gated (test:e2e-kubernetes), so the breakage mostly goes unnoticed: in the 200 most recent branch-e2e.yml runs (2026-08-21 to 2026-08-27) it executed exactly once, and failed. As far as we can tell there is currently no green e2e evidence on main for either credential driver.

Acceptance Criteria

• kubernetes-credential-drivers-e2e passes on main when triggered.
• The e2e helper's managed-name derivation matches the drivers' derivation (ideally shared rather than duplicated, but that is an internal choice).

Reproduction Steps

1. Trigger branch-e2e.yml on current main with the test:e2e-kubernetes label (or workflow_dispatch).
2. Observe the kubernetes-secrets arm panic at the first managed-name lookup.

Environment

main as of 2026-08-27; hosted CI (branch-e2e.yml, job kubernetes-credential-drivers-e2e). Observed on run 33035325468 / job 98398843310 (2026-08-27T03:05Z, PR #2968).

Logs

panicked at tests/credential_drivers.rs:431:12: credential storage e2e failed:
kubectl get secret openshell-cred-f80a16c276dabd5629cb4c6936ab849503d3a9b9 ...
Error from server (NotFound)

---

Drafted by an agent that hit this while surveying the credential drivers; reviewed and endorsed by a human before posting.