This seems reasonable to me. #5325 is a start to clean up some loose ends in how the installer handles credential modes (I think we want to move toward choosing defaults rather than allowing credentialmode to be ""). #5325 would need to handle this case as well, where we have two modes.

The issue with choosing a default instead of an empty string is that they mean different things. When an explicit selection is made, it (1) tells the cloud-credential-operator to use that mode and (2) skips permissions validation. When an empty string is used, it tells the cloud-credential-operator to inspect the credentials provided and make an opinionated decision about which mode to use based upon what is allowed with the credentials.

Of course, now with Azure there is only Passthrough. So no more intelligent querying of the creds.