Add workspace Key Vault secrets retrieval API for workspace services and user resources - #5021

Draft

Marcus Robinson (marrobi) with Copilot wants to merge 9 commits into

mainfrom

copilot/marrobicopilotupdate-from-main-fix-conflicts

Commits on Aug 1, 2026

Initial plan
Copilot
authored
5941025
Add workspace Key Vault secrets retrieval API (#2402)
Copilot
authored
3570b51
Document keyvault_secret_id secrets convention for template authors
Copilot
authored
7b1c01a
Add UI reveal-secret affordance for keyvault_secret_id properties
Copilot
authored
26d2b22
Grant owning user secrets-reader on Guacamole VM password secrets
Copilot
authored
0ffc095
Retrieve workspace Key Vault secrets via workspace app reg OBO (federated identity)
Copilot
authored
2297aa0
docs: clarify UI secret reveal behaviour and OBO threat model
Copilot
authored
5af7760
docs: move secret retrieval threat model into architecture section
Copilot
authored
5f53c4f
docs: move secret retrieval into its own architecture page
Copilot
authored
218208a