AuthBridge webhook does not emit spiffe block in per-agent ConfigMap

[r3v5]

Bug

The AuthBridge mutating webhook's ensurePerAgentConfigMap does not write the spiffe block into per-agent ConfigMaps when spireEnabled=true, causing authbridge-proxy to crash with:

time=2026-06-23T15:39:54.635Z level=INFO msg="mtls requires the spiffe block to be configured"

Expected

When spireEnabled=true (confirmed by webhook logs: "injection decision","sidecar":"spiffe-helper","inject":true), the per-agent ConfigMap should contain:

spiffe:
  socket: unix:///spiffe-workload-api/spire-agent.sock

Actual

The per-agent ConfigMap (authbridge-config-<agent-name>) has mtls.mode: permissive but no spiffe block. AuthBridge requires the spiffe block when mTLS is enabled.

Root Cause

Code at internal/webhook/injector/pod_mutator.go:988-991 sets cfg["spiffe"] when spireEnabled=true:

if spireEnabled {
    cfg["spiffe"] = map[string]interface{}{
        "socket": m.GetPlatformConfig().Spiffe.SocketPath,
    }
}

However, the produced ConfigMap does not contain this block. The webhook logs confirm spireEnabled=true but the serialized YAML written to the ConfigMap omits the spiffe key.

Workaround

Manually patch the per-agent ConfigMap after pod creation:

# Get current config
oc -n <namespace> get configmap authbridge-config-<agent-name> -o jsonpath='{.data.config\.yaml}' > /tmp/config.yaml

# Append spiffe block
cat >> /tmp/config.yaml << 'SPIFFE'
spiffe:
  socket: unix:///spiffe-workload-api/spire-agent.sock
SPIFFE

# Apply
oc -n <namespace> create configmap authbridge-config-<agent-name> \
  --from-file=config.yaml=/tmp/config.yaml --dry-run=client -o yaml | oc apply -f -

AuthBridge's built-in config reloader picks up the change on next CrashLoopBackOff restart.

Environment

• OCP (ROSA) 4.19.18
• kagenti-operator image built from branch create-controller-for-spire-and-ztwim
• AuthBridge image: ghcr.io/kagenti/kagenti-extensions/authbridge:latest
• mTLS mode: permissive
• SPIRE trust domain: localtest.me

Impact

All A2A agents with mTLS enabled have authbridge-proxy in CrashLoopBackOff until the ConfigMap is manually patched.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. If this issue is still relevant, please comment or remove the stale label.