feat: complete credential broker source flow

scripts/credential-grants-validate.py

@@ -240,6 +240,38 @@ def validate_grant(
             )
         if str(local_file.get("mode")) != "0600":
             errors.append(f"{prefix}.delivery.local_token_file.mode must be 0600")
+    if "kubernetes-auth" in allowed:
+        kubernetes_auth = require_dict(
+            delivery.get("kubernetes_auth"),
+            f"{prefix}.delivery.kubernetes_auth",
+            errors,
+        )
+        require_nonempty_string(
+            kubernetes_auth.get("mount"),
+            f"{prefix}.delivery.kubernetes_auth.mount",
+            errors,
+        )
+        require_nonempty_string(
+            kubernetes_auth.get("role"),
+            f"{prefix}.delivery.kubernetes_auth.role",
+            errors,
+        )
+        if not require_list(
+            kubernetes_auth.get("service_account_names"),
+            f"{prefix}.delivery.kubernetes_auth.service_account_names",
+            errors,
+        ):
+            errors.append(
+                f"{prefix}.delivery.kubernetes_auth.service_account_names must not be empty"
+            )
+        if not require_list(
+            kubernetes_auth.get("namespaces"),
+            f"{prefix}.delivery.kubernetes_auth.namespaces",
+            errors,
+        ):
+            errors.append(
+                f"{prefix}.delivery.kubernetes_auth.namespaces must not be empty"
+            )
 
     audit = require_dict(grant_obj.get("audit"), f"{prefix}.audit", errors)
     if audit.get("openbao_audit_required") is not True: