[codyhartsook]

The egress gateway reuses a fetched credential per actor and URI for 5 minutes. A cache hit never reaches the provider, so a grant the provider revokes keeps working until the entry expires. Threat model T-26 calls for short cache TTLs and says operators may tune them, but the chart had no way to.

agentgateway/agentgateway#4170 added a per-provider cacheTtl, and the pinned v1.7.0 image has it. This passes it through atenetEgress.extraCredentialProviders:

atenetEgress:
  extraCredentialProviders:
  - name: vault.example.com
    address: vault-provider.vault.svc:50051
    cacheTtl: 0s

• Unset keeps the 5m default and renders the same config as before.
• 0s sends every request to the provider.
• The chart checks the duration at render time, so a typo fails helm install before the gateway sees it.
• Entries with unknown keys now fail, so a misspelled cacheTTL can't silently keep the 5m cache. extraCredentialProviders isn't in a release yet, so no existing values break.

ate-setup --credential-provider doesn't get the field. That flag also serves the Envoy dataplane, which fetches a credential on every request. The bundled k8s.io provider keeps the default.

AI use: AI-assisted. I reviewed the change, ran helm unittest charts/substrate, and loaded the rendered config with agentgateway --validate-only on the pinned image.

• Tests pass
• Docs updated