@jglogan Here's a proposed design for keeping the SMB password out of persisted state. It follows the existing registry-credential pattern (container registry login → KeychainQuery) and keeps all keychain access inside container-apiserver. #2408