Passing short-lived credentials to agents

[jjames-zilo]

Hi NemoClaw team,

I have successfully deployed NemoClaw into my Kubernetes cluster with OpenRouter inference and multiple agents, all responding and functioning as expected.

I have rebuilt the sandbox with kubectl and awscliv2 included, but I'm unclear on the best approach for passing short-lived credentials into it. The workspace container authenticates with AWS/EKS via IRSA and a ServiceAccount token, but it's not obvious how these credentials can be forwarded to or consumed by the agents securely.