VMAgent: Add AWS remotewrite AccessKeySecret and SecretKeySecret

[Sleuth56]

Adds AWS access and secret key refs.

     aws:
        useSigv4: true
        region: us-east-1
        service: aps
        accessKeySecret:
          name: aws-remote-write-creds
          key: access-key
        secretKeySecret:
          name: aws-remote-write-creds
          key: secret-key

[vrutkovs]

Looks good, a suggestion for changelog

[cubic-dev-ai]

1 issue found across 12 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="api/operator/v1beta1/vmagent_types.go">

<violation number="1" location="api/operator/v1beta1/vmagent_types.go:401">
P3: Validation reports a random selector when both AWS selectors are incomplete because Go map iteration is nondeterministic. Validate `accessKeySecret` and `secretKeySecret` in a fixed order.</violation>
</file>

<sub>Click Fix with cubic on a comment, or reply @cubic-dev-ai fix this, and cubic writes the fix.

Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

P3: Validation reports a random selector when both AWS selectors are incomplete because Go map iteration is nondeterministic. Validate accessKeySecret and secretKeySecret in a fixed order.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At api/operator/v1beta1/vmagent_types.go, line 401:

<comment>Validation reports a random selector when both AWS selectors are incomplete because Go map iteration is nondeterministic. Validate `accessKeySecret` and `secretKeySecret` in a fixed order.</comment>

<file context>
@@ -372,6 +382,28 @@ type AWS struct {
+	if !a.UseSigv4 {
+		return fmt.Errorf("accessKeySecret and secretKeySecret require useSigv4=true")
+	}
+	for name, sel := range map[string]*corev1.SecretKeySelector{"accessKeySecret": a.AccessKeySecret, "secretKeySecret": a.SecretKeySecret} {
+		if sel.Name == "" || sel.Key == "" {
+			return fmt.Errorf("%s must have both name and key set", name)
</file context>

Suggested change

	for name, sel := range map[string]*corev1.SecretKeySelector{"accessKeySecret": a.AccessKeySecret, "secretKeySecret": a.SecretKeySecret} {
	if sel.Name == "" || sel.Key == "" {
	return fmt.Errorf("%s must have both name and key set", name)
	}
	}
	if a.AccessKeySecret.Name == "" || a.AccessKeySecret.Key == "" {
	return fmt.Errorf("accessKeySecret must have both name and key set")
	}
	if a.SecretKeySecret.Name == "" || a.SecretKeySecret.Key == "" {
	return fmt.Errorf("secretKeySecret must have both name and key set")
	}