From c5c2737ca2695e8eea70b377556712bca7d137da Mon Sep 17 00:00:00 2001 From: Hai Huang Date: Fri, 22 May 2026 15:35:53 -0400 Subject: [PATCH] chore(injector): remove unused JWTAudience field MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit cfg.JWTAudience was parsed from authbridge-config ConfigMap's JWT_AUDIENCE key but never read by anything else in the operator. Pure dead code traced via grep — only writes (namespace_config.go, resolved_config.go), zero reads. The chart will stop emitting JWT_AUDIENCE in a companion PR; the JWT-SVID assertion audience used by authbridge's token-exchange plugin is now sourced per-tokenexchange-instance from the in-process SPIFFE provider config, not a cluster-wide env var. Assisted-By: Claude (Anthropic AI) Signed-off-by: Hai Huang --- kagenti-operator/internal/webhook/injector/namespace_config.go | 2 -- kagenti-operator/internal/webhook/injector/resolved_config.go | 2 -- 2 files changed, 4 deletions(-) diff --git a/kagenti-operator/internal/webhook/injector/namespace_config.go b/kagenti-operator/internal/webhook/injector/namespace_config.go index a05128b9..1009955a 100644 --- a/kagenti-operator/internal/webhook/injector/namespace_config.go +++ b/kagenti-operator/internal/webhook/injector/namespace_config.go @@ -52,7 +52,6 @@ type NamespaceConfig struct { DefaultOutboundPolicy string ClientAuthType string // "client-secret" or "federated-jwt" SpiffeIdpAlias string // Keycloak SPIFFE Identity Provider alias (e.g., "spire-spiffe") - JWTAudience string // JWT audience for SPIFFE authentication // From "spiffe-helper-config" ConfigMap SpiffeHelperConf string // raw helper.conf content @@ -89,7 +88,6 @@ func ReadNamespaceConfig(ctx context.Context, c client.Reader, namespace string) cfg.DefaultOutboundPolicy = cm.Data["DEFAULT_OUTBOUND_POLICY"] cfg.ClientAuthType = cm.Data["CLIENT_AUTH_TYPE"] cfg.SpiffeIdpAlias = cm.Data["SPIFFE_IDP_ALIAS"] - cfg.JWTAudience = cm.Data["JWT_AUDIENCE"] } // Note: keycloak-admin-secret is not read here. The resolved container builder diff --git a/kagenti-operator/internal/webhook/injector/resolved_config.go b/kagenti-operator/internal/webhook/injector/resolved_config.go index 989c857b..7a259a28 100644 --- a/kagenti-operator/internal/webhook/injector/resolved_config.go +++ b/kagenti-operator/internal/webhook/injector/resolved_config.go @@ -45,7 +45,6 @@ type ResolvedConfig struct { DefaultOutboundPolicy string ClientAuthType string // "client-secret" or "federated-jwt" SpiffeIdpAlias string // Keycloak SPIFFE Identity Provider alias - JWTAudience string // JWT audience for SPIFFE authentication // Sidecar configs — from namespace CMs (not overridable by AgentRuntime v1alpha1) SpiffeHelperConf string @@ -89,7 +88,6 @@ func ResolveConfig(platform *config.PlatformConfig, ns *NamespaceConfig, ar *Age DefaultOutboundPolicy: ns.DefaultOutboundPolicy, ClientAuthType: ns.ClientAuthType, SpiffeIdpAlias: ns.SpiffeIdpAlias, - JWTAudience: ns.JWTAudience, SpiffeHelperConf: ns.SpiffeHelperConf, EnvoyYAML: ns.EnvoyYAML, AuthproxyRoutesYAML: ns.AuthproxyRoutesYAML,