enterprise/endpoints: use managed connector credentials

[dominic-r]

Details

Part of the managed secrets stack, see #25415.

What does this PR change?

Fleet connectors store their API token, and Google Chrome connectors and Device Trust stages their service account keys, as secrets. With no secret_fields users left, the serializer no longer filters them.

Why is this change needed?

Each credential becomes a secret with its own permissions, rotation and audit trail. See #25415.

How was this tested?

Ran the endpoint connector and stage tests, and the secrets and RBAC tests on this layer.

Linked issues

---

Checklist

• The project has been linted, built, and tested (make all)
• The documentation has been updated and formatted (make docs)
• I have read the AI usage policy.

[netlify]

✅ Deploy Preview for authentik-docs ready!

Name	Link
🔨 Latest commit	f44f43b
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-docs/deploys/6acaaaf36231860008378dcf
😎 Deploy Preview	https://deploy-preview-26105--authentik-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[codecov]

❌ 1 Tests Failed:

Tests completed	Failed	Passed	Skipped
4741	1	4740	14

View the top 1 failed test(s) by shortest run time

600-providers.test.ts::Provider Wizard › Complete OAuth2 Provider

Stack Traces | 92.4s run time

Client Secret should be visible when Client Type is Confidential

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[github-actions]

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-dfdcee1d388fc951e66158e8f0ab58cd1a28a60e
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-dfdcee1d388fc951e66158e8f0ab58cd1a28a60e

Afterwards, run the upgrade commands from the latest release notes.