New to creating sensors. If I need to initialize a resource using credentials, can it pull from a k8s secret on a code location, or are they deployed on the agent? I have a hunch it's the latter because using the resource in the exact same way on an Op works but not on a sensor.