docs(authbridge): rewrite sidecar injection guide for 0.7 (main)

[mrsabath]

Context

#1782 adds a "Verifying and Tuning Sidecar Injection" section to docs/authbridge/deployment-guide.md that closes the gap surfaced in #1775. Per discussion on that PR, the content is sourced against kagenti-operator v0.2.0-rc.5 (the 0.6 line) and was retargeted to release-0.6. The same section needs a different version for main/0.7, where the sidecar shape and feature-gate vocabulary diverged substantially.

What changed in 0.7 vs 0.6

Topic	0.6 (release-0.6)	0.7 (main)
spiffe-helper sidecar	Separate container — visible as 3rd container	Bundled inside the combined authbridge image; gated by SPIRE_ENABLED env var (kagenti-extensions#432)
combinedSidecar feature gate	Exists, opt-in	Removed — combined is the default (kagenti-operator#361)
clientRegistration feature gate	Exists, in-pod sidecar path	Removed — moved to operator (kagenti-operator#361, kagenti-extensions#409)
spiffeHelper feature gate	Exists	Removed
Mode selection	kagenti.io/authbridge-mode pod annotation	Resolution chain: AgentRuntime.Spec.AuthBridgeMode → namespace authbridge-runtime-config.mode ConfigMap → proxy-sidecar fallback
Default mode	envoy-sidecar	proxy-sidecar
Image set	authbridge, authbridge-light, spiffe-helper, client-registration, proxy-init	authbridge (proxy-sidecar) + authbridge-envoy + proxy-init
Container count under defaults	agent envoy-proxy spiffe-helper (3/3)	agent authbridge-proxy (2/2) — 1 sidecar

Scope of the new docs section (on main)

Rewrite Verifying and Tuning Sidecar Injection in docs/authbridge/deployment-guide.md so a user on 0.7 sees:

1. Inspection one-liner — same kubectl pattern, but expected output is agent authbridge-proxy for proxy-sidecar (default), agent authbridge-envoy proxy-init (init) for envoy-sidecar.
2. Containers per mode + label combination table — drop the 2/2 vs 3/3 split (no longer applies the same way); document what the kagenti.io/inject=disabled opt-out and per-sidecar disable labels do under each mode.
3. Workload-level controls — kagenti.io/inject, kagenti.io/spire, kagenti.io/<sidecar>-inject opt-out labels (per memory: these are opt-out — absent/empty means inject).
4. Mode selection — document the resolution chain (AgentRuntime.Spec.AuthBridgeMode → namespace ConfigMap → fallback) instead of the deprecated annotation.
5. Cluster-admin controls — drop references to combinedSidecar, clientRegistration, spiffeHelper gates. Document remaining gates (globalEnabled, injectTools, etc.) as they exist on main, plus the SPIRE_ENABLED env var.

Source-of-truth files to read

• kagenti-operator/internal/webhook/injector/pod_mutator.go
• kagenti-operator/internal/webhook/injector/precedence.go
• kagenti-operator/internal/webhook/injector/injection_decision.go
• kagenti-operator/internal/webhook/injector/resolved_config.go
• kagenti-operator/internal/webhook/config/feature_gates.go (current gates on main)

Acceptance

• New PR against main with the rewritten section
• Tables verified against a live 0.7 cluster (v0.7.0-alpha.*)
• No references to removed feature gates (combinedSidecar, clientRegistration, spiffeHelper)
• Mode resolution chain documented in place of the deprecated annotation
• Cross-referenced from epic #1428

Related

• Closes the 0.7 side of #1775 (PR #1782 closes the 0.6 side)
• Parent epic: #1428

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. If this issue is still relevant, please comment or remove the stale label.