feat: ConfigMap-driven authbridge mode + flip default to proxy-sidecar

[huang195]

Summary

Phase B of the authbridge sidecar consolidation (Phase A is kagenti-extensions PR #409). This PR makes proxy-sidecar the default deployment mode and replaces the kagenti.io/authbridge-mode pod annotation with a ConfigMap- and CR-driven resolution chain.

• Mode selection is now AgentRuntime.Spec.AuthBridgeMode → namespace authbridge-runtime-config.mode → proxy-sidecar fallback. No annotations.
• Default mode is now proxy-sidecar (HTTP_PROXY env + authbridge-proxy container, no Envoy, no iptables).
• Image set collapses to two combined images plus proxy-init. Spiffe-helper is bundled inside the combined images and gated by the per-workload SPIRE_ENABLED env var. Client-registration is operator-managed (in-pod sidecar path removed).
• Feature gates drops combinedSidecar, spiffeHelper, clientRegistration.
• CRD adds Spec.AuthBridgeMode with proxy-sidecar | envoy-sidecar | waypoint enum validation for per-workload overrides.

Net diff: +351 / −1592 lines. Mostly deletion of dead-code paths.

Resolution chain

1. AgentRuntime CR Spec.AuthBridgeMode  (per-workload override)
2. namespace authbridge-runtime-config  (cluster/namespace default)
3. proxy-sidecar                        (cluster-wide fallback)

Image set after this PR

Image	Mode	Contents
authbridge (default)	proxy-sidecar	authbridge-proxy + spiffe-helper
authbridge-envoy	envoy-sidecar	Envoy + ext_proc authbridge + spiffe-helper
proxy-init	envoy-sidecar only	iptables init container

Removed: authbridge-light, standalone spiffe-helper, standalone client-registration.

Test plan

• go build ./... — clean
• go vet ./... — clean
• Unit tests (./internal/...) — all pass
• Webhook integration tests (./internal/webhook/v1alpha1/...) — all pass
• e2e suite (requires Kind cluster — run in CI)
• Manual: deploy the new operator + new authbridge images to a kind cluster, deploy the weather-agent in team1 namespace, verify proxy-sidecar mode is the default, then create an authbridge-runtime-config ConfigMap with mode: envoy-sidecar in another namespace and verify a workload there gets envoy-sidecar shape.
• Manual: per-workload override — deploy two AgentRuntime CRs in the same namespace, one with Spec.AuthBridgeMode: envoy-sidecar and one without, confirm both modes coexist.

Follow-ups

• Phase C: kagenti chart values + UI dropdown for the mode selector (separate PR in kagenti/kagenti).
• Older release tags continue to publish the dropped authbridge-light, standalone spiffe-helper, and standalone client-registration images; CI no longer builds them on this branch.

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

[pdettori]

Well-structured consolidation: 5 sidecar containers → 2 combined images, clean 4-layer mode resolution chain (CR → namespace ConfigMap → deprecated annotation → proxy-sidecar fallback). Net deletion of ~780 lines of dead code with thorough test coverage additions (5 new resolution-chain unit tests, updated e2e assertions).

Areas reviewed: Go, Helm, CRD, Tests, Security
Commits: 5 commits, all signed-off ✅
CI: All 15 checks passing (E2E, unit, integration, lint, helm lint, shellcheck, hadolint, CodeQL, Trivy, DCO)
Webhook selectors: Verified namespaceSelector, objectSelector, timeoutSeconds intact on HEAD

Two minor suggestions for improved observability below — not blocking.

Assisted-By: Claude Code

[pdettori]

suggestion: ExtractMode silently returns "" on YAML parse error, which causes the resolution chain to fall through to the next layer. While this is fail-safe behavior, a malformed authbridge-runtime-config ConfigMap would be silently ignored with no signal to the operator.

Consider logging a warning when yaml.Unmarshal fails, so cluster operators can catch misconfigured ConfigMaps.

if err := yaml.Unmarshal([]byte(authbridgeYAML), &top); err != nil {
	// Consider: log.Log.Info("WARN: failed to parse authbridge-runtime-config", "error", err)
	return ""
}

[pdettori]

suggestion: The ConfigMap and deprecated-annotation layers can return arbitrary strings (unlike the CRD path which has kubebuilder enum validation). An unrecognized mode value (e.g. typo "proxy-sidecart") would flow through to the envoy-sidecar branch without warning.

The failure mode is safe (envoy-sidecar is the more restrictive mode), but adding a validation check after resolution would help operators catch ConfigMap typos:

switch authBridgeMode {
case ModeProxySidecar, ModeEnvoySidecar, ModeWaypoint:
	// valid
default:
	mutatorLog.Info("WARN: unrecognized authBridgeMode, defaulting to proxy-sidecar",
		"mode", authBridgeMode, "source", modeSource)
	authBridgeMode = ModeProxySidecar
	modeSource = "cluster-default-invalid-fallback"
}