fix(security): reject empty credential secrets - #224

Type of Change

• New Feature
• Bug Fix
• Documentation
• Performance Improvement
• Test/CI
• Refactor
• Other:

Related Issues

Fixes rustfs/backlog#1096

Summary of Changes

• reject configured credential Secrets whose data field is absent or empty
• validate required credential keys after the same trimming used by the pinned RustFS runtime
• reject invalid UTF-8 and NUL-containing credential values while preserving stable SNAFU errors and status reasons
• make the existing byte-length contract explicit in status messages, the CRD, user guides, and examples
• add focused coverage for valid data, absent data, missing keys, invalid UTF-8, NUL bytes, trimmed short values, and multibyte UTF-8 values

Checklist

• I have read and followed the CONTRIBUTING.md guidelines
• Passed make pre-commit (fmt-check + clippy + test + e2e-check + console-lint + console-build + console-fmt-check)
• Added/updated necessary tests
• Documentation: updated the credential validation contract in the CRD, English and Chinese user guides, and examples
• CHANGELOG: N/A; this enforces and clarifies the existing credential Secret contract
• CI/CD passed

Impact

• Breaking change (CRD/API compatibility)
• Requires doc/config/deployment update
• Other impact: invalid configured credential Secrets now block reconciliation through existing credential status reasons

Verification

make pre-commit

Additional Notes

Kubernetes Secret retrieval remains in Context, while credential invariants are evaluated by a private pure helper. Length is measured in UTF-8 bytes after trimming to match RustFS runtime normalization. Existing byte-length compatibility is preserved, and the public contract now states that behavior explicitly.

Thank you for your contribution! Please ensure your PR follows the community standards (CODE_OF_CONDUCT.md) and sign the CLA if this is your first contribution.