Jenkins currently doesn't expose the data bindings necessary to be able to create credentials using CasC that can be used to create Blue Ocean pipelines. From what I can tell (and I'm not Java expert), this is the only thing missing to be able to manage Blue Ocean credentials using CasC.

This is one of the last things that I personally need to be able to finish configuring Jenkins using not but the CasC plugin and externally available Kubernetes secrets.

The code that I'm using to come to this conclusion is here:

https://github.com/jenkinsci/blueocean-plugin/blob/master/blueocean-github-pipeline/src/main/java/io/jenkins/blueocean/blueocean_github_pipeline/GithubPipelineCreateRequest.java#L101
https://github.com/jenkinsci/blueocean-plugin/blob/master/blueocean-pipeline-scm-api/src/main/java/io/jenkins/blueocean/credential/CredentialsUtils.java
https://github.com/jenkinsci/blueocean-plugin/blob/v1.0.1/blueocean-pipeline-scm-api/src/main/java/io/jenkins/blueocean/rest/impl/pipeline/credential/BlueOceanDomainSpecification.java