Generate MQTT credentials per test run

[oysand]

Why

The suite was handed four secrets from FlotillaTestsKv:

Secret	What it actually was
FLOTILLA-MQTT-PASSWORD	plaintext for the flotilla line of the committed passwd_file
ISAR-MQTT-PASSWORD	same, isar
SARA-MQTT-PASSWORD	same, sara
FLOTILLA-BROKER-SERVER-KEY	the broker's TLS private key

These were real credentials shared with every environment, because the broker validated against the passwd_file and certificate baked into its image. A fifth secret, INTEGRATION_TEST_AZURE_CLIENT_SECRET, existed only to read those four.

After this PR the integration tests require no secrets at all. uv run pytest -s . with Docker running. Since main moved the service images to public ghcr.io packages, no registry login is needed either.

What

utilities/mqtt_credentials.py mints, per test session:

• a CA,
• a server certificate for the broker's network alias,
• a random password for every user in flotilla's access_control.

equinor/flotilla#2908 makes the broker assemble these into its configuration on startup. Nothing leaves the session and nothing grants anything anywhere else.

TLS and the broker ACLs are still exercised end to end — this is not a weakening. ISAR verifies the broker certificate against the generated CA, handed to it as ISAR_MQTT_CA_CERT (equinor/isar#1166).

Also:

• Dropped FLOTILLA_MQTT_PASSWORD, ISAR_MQTT_PASSWORD, SARA_MQTT_PASSWORD and FLOTILLA_BROKER_SERVER_KEY from settings.py.
• Dropped the Azure login, the key vault lookup and the AZURE_* / KEYVAULT_NAME env from run_integration_tests.yml.
• build_local_images.sh now also builds flotilla-broker, since verifying a change here needs the broker built from a local checkout.
• cryptography promoted to a direct dependency; it was already present transitively.

Depends on

Both must merge and publish an image first, otherwise this suite runs against a broker that ignores MQTT_PASSWORDS:

• Let the broker take its credentials at runtime flotilla#2908 — broker takes its credentials at runtime
• Make the MQTT CA certificate configurable isar#1166 — configurable MQTT CA certificate

Merge order for INTEGRATION_TEST_AZURE_CLIENT_SECRET

It is still declared in run_integration_tests.yml, marked deprecated and required: false, but nothing reads it. It cannot be removed yet: flotilla, sara and isar-robot still pass it, and GitHub rejects a caller passing a secret the reusable workflow does not declare.

1. This PR.
2. Stop passing the unused integration test secret flotilla#2918, Stop passing the unused integration test secret sara#488 and Stop passing the unused integration test secret isar-robot#402 — stop passing it.
3. A one-line follow-up here deleting the declaration.
4. Delete the four secrets from FlotillaTestsKv and retire the service principal.

Verified

Re-verified after rebasing onto current main (the ACR to ghcr.io move). Built all four images from local checkouts with scripts/build_local_images.sh (isar-robot overlaid with the local isar wheel carrying equinor/isar#1166), then ran the full suite in parallel with .env moved away and FLOTILLA_MQTT_PASSWORD, ISAR_MQTT_PASSWORD, SARA_MQTT_PASSWORD, FLOTILLA_BROKER_SERVER_KEY explicitly unset:

4 passed, 58 warnings in 260.20s (0:04:20)

Separately exercised the broker image directly: TLS handshake with hostname verification against the generated CA, Denied PUBLISH for sara → isar/x/status, not authorised on subscribe to isar/#, wrong-password refusal, and both fallback paths.

Ready for review checklist:

• A self-review has been performed
• All commits run individually
• Temporary changes have been removed, like logging, TODO, etc.
• The PR has been tested locally
• This change doesn't need a new test
  • The change is to the test harness itself; the four existing integration tests are the test, and they pass with no secrets available.
• Relevant issues are linked
  • No issue exists; this is the goal of removing external secrets from the integration tests.
• Remaining work is documented in issues
  • Merge order above; per-environment credential rollout is robotics-infrastructure work.
• The changes do not introduce dead code as unused imports, functions etc.

Merge order

This is one of five PRs that remove the need for any external secret to run the armada
integration tests. They must merge in this order:

1. Let the broker take its credentials at runtime flotilla#2908 — broker takes its credentials at runtime
   Make the MQTT CA certificate configurable isar#1166 — MQTT CA certificate configurable
   then wait for the :dev images to publish
2. Generate MQTT credentials per test run #100 — generate MQTT credentials per test run
3. Stop passing the unused integration test secret flotilla#2918, Stop passing the unused integration test secret isar-robot#402, Stop passing the unused integration test secret sara#488 — stop passing the unused secret
4. armada follow-up — drop the now-unused secret declaration, retire the key vault

Out of order it breaks: armada's reusable workflow currently declares
INTEGRATION_TEST_AZURE_CLIENT_SECRET as required: true and every caller uses @main, so a
caller that stops passing it before step 2 fails immediately. Conversely step 2 needs the new
broker and the configurable ISAR CA already published, because it feeds the broker its
credentials through the environment.

Follow-up rollout is tracked in equinor/robotics-infrastructure#1169.

[oysand]

Pushed b1feb8a: a comment only.

MQTT_USERS duplicates the user list in broker/mosquitto/config/access_control in
equinor/flotilla, which is a drift risk worth being explicit about. It is now a caught one: with
equinor/flotilla#2908 the broker refuses to start when MQTT_PASSWORDS does not cover every user in
that file, so adding a user there without adding it here fails this suite loudly instead of leaving
one service unable to authenticate.