feat(machine-controller): add DPU UEFI credential rotation (#4462)

[spydaNVIDIA]

Extend Ready-only UEFI rotation to DPUs with a dedicated RotatingDpuUefi state that converges one DPU per cycle (stage BIOS settings -> DPU restart -> record), keyed by the DPU BMC MAC and reusing the site-wide uefi_rotation_enabled flag, per-machine force flag, versioned credential candidates, and backoff/quarantine bookkeeping. Add SetDpuUefiPassword RPC + dpu set-uefi-password CLI + RBAC for the direct-on-device path, and confirm TriggerUefiCredentialRotation resolves DPU BMC MACs.

Related issues

#367

Type of Change

• Add - New feature or capability
• Change - Changes in existing functionality
• Fix - Bug fixes
• Remove - Removed features or deprecated functionality
• Internal - Internal changes (refactoring, tests, docs, etc.)

Breaking Changes

• This PR contains breaking changes

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• No testing required (docs, internal refactor, etc.)

Additional Notes

Related issues

Type of Change

• Add - New feature or capability
• Change - Changes in existing functionality
• Fix - Bug fixes
• Remove - Removed features or deprecated functionality
• Internal - Internal changes (refactoring, tests, docs, etc.)

Breaking Changes

• This PR contains breaking changes

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• No testing required (docs, internal refactor, etc.)

Additional Notes

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 42e0f06e-c163-4036-a525-7d6be8aa70c8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔐 TruffleHog Secret Scan

🚨 Potential secrets detected!

TruffleHog found potential secrets in your code changes. This could include:

• 🔑 API keys and tokens
• 🔐 Passwords and credentials
• 🎫 OAuth tokens
• 🗝️ Private keys

📋 View Detailed Findings

👉 Click here to view the full TruffleHog scan results

The job logs contain:

• Exact file paths and line numbers
• Secret types detected
• Verification status (verified/unverified)

Next Steps

1. Review Details: Check the scan logs for specific findings
2. Verify Findings: Determine if detected items are actual secrets
3. Remove Secrets: If real, remove them from your code immediately
4. Rotate Credentials: Revoke and regenerate any leaked credentials
5. Prevent Future Leaks: Add sensitive files to .gitignore

Security Best Practices

⚠️ Never commit secrets to your repository! Use:

• Environment variables for configuration
• Secret management tools (Vault, AWS Secrets Manager, etc.)
• GitHub Secrets for CI/CD workflows
• .env files (added to .gitignore)

📖 Learn more about TruffleHog

_{🕐 Last updated: 2026-08-10 05:14:06 UTC | Commit: 4a91048}