Function validate_replication_auth 

pub fn validate_replication_auth(
    source: &Backend,
    destination: &Backend,
) -> ValidationResult

A RepositoryReplication’s source/destination auth pair is safe to run in one mover pod. The replicate pod’s environment carries the static side’s credential Secret (envFrom); for a same-kind S3 or Azure pair where exactly one side uses workload identity, the workload-identity side’s credential chain reads those same env vars (minio-go’s EnvAWS; kopia’s env-bound azure flags) and would silently authenticate as the other side — wrong identity, plausibly wrong permissions, no error. Rejected at admission instead. GCS mixed pairs are safe (the static side’s key travels as a --credentials-file path, not ambient env). Both-workload-identity pairs must name the same ServiceAccount — a pod runs as exactly one.