Provider credentials should be optional, not default, not enforced

[anmazzotti]

When installing cloud providers, the flow enforces the creation of credentials.

I believe this should be an optional and not default step, as in the user should not be invited to enter credentials by default when installing the provider.

The reason is that global credentials are insecure and should never be used.
Managed identities should be used instead.

If external credentials are needed, it is recommended to create different credentials per Cluster, that users will have to setup in their own namespaces.

For reference, CAPZ has a nice writeup: https://capz.sigs.k8s.io/topics/identities-use-cases

Note: this actually can only apply to providers not requiring init credentials.
A lot of them have this requirement, so the UI should keep the current enforcing behavior for those, for example aws, gcp, vsphere, etc.

For a correct list, the initialization documentation can be used: https://cluster-api.sigs.k8s.io/user/quick-start#initialization-for-common-providers
Some providers can just be installed without environment variables requirements.

[anmazzotti]

Beside Azure which is already behaving as expected, this issue is blocked for the other providers until the problem is addressed upstream: rancher/turtles#1273

[gaktive]

As we do this to unblock this feature, we should figure out the overall UX going forward as we juggle complexity with usability.