feat(operator): fetch JWT-SVID directly via go-spiffe SDK, remove spiffe-helper sidecar

The spiffe-helper sidecar approach used an abandoned standalone image from
the kagenti-extensions pipeline (removed April 2026 when spiffe-helper was
bundled into authbridge). The authbridge-proxy itself already uses the
go-spiffe WorkloadAPI client in-process — this change makes the operator
consistent with that architecture.

Changes:
- clientregistration_controller.go: replace JWTSVIDPath + os.ReadFile with
  workloadapi.New() + FetchJWTSVID(). Uses the same socket as verifiedFetch.
  Removes path traversal validation (no longer needed without file I/O).
- cmd/main.go: remove --jwt-svid-path flag; reuse --verified-fetch-spiffe-socket
  for JWT-SVID fetching via SpiffeSocket field on the reconciler.
- manager.yaml: remove spiffe-helper container, jwt-svid emptyDir volume,
  spiffe-helper-config volume mount. spiffe-workload-api CSI volume remains
  (shared with verifiedFetch).
- configmap-spiffe-helper.yaml: deleted (no longer needed).
- values.yaml: remove jwtSVIDPath value.

Signed-off-by: Alan Cha <alan.cha@ibm.com>
Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Alan Cha <Alan.cha1@ibm.com>

Author: Alan-Cha

charts/kagenti-operator/templates/manager/configmap-spiffe-helper.yaml

@@ -118,7 +118,6 @@ spec:
             {{- end }}
             {{- if and .Values.spiffe .Values.spiffe.enabled .Values.spiffe.operatorAuth .Values.spiffe.operatorAuth.enabled }}
             - "--use-spiffe-auth=true"
-            - "--jwt-svid-path={{ .Values.spiffe.operatorAuth.jwtSVIDPath | default "/opt/jwt_svid.token" }}"
             - "--operator-client-id=spiffe://{{ .Values.signatureVerification.spireTrustDomain | default "localtest.me" }}/ns/{{ .Release.Namespace }}/sa/{{ .Values.controllerManager.serviceAccountName }}"
             {{- end }}
           command:
@@ -186,42 +185,6 @@ spec:
               mountPath: /spiffe-workload-api
               readOnly: true
             {{- end }}
-            {{- if and .Values.spiffe .Values.spiffe.enabled .Values.spiffe.operatorAuth .Values.spiffe.operatorAuth.enabled }}
-            - name: jwt-svid
-              mountPath: /opt
-              readOnly: true
-            {{- end }}
-        {{- if and .Values.spiffe .Values.spiffe.enabled .Values.spiffe.operatorAuth .Values.spiffe.operatorAuth.enabled }}
-        - name: spiffe-helper
-          image: ghcr.io/kagenti/kagenti-extensions/spiffe-helper:latest
-          imagePullPolicy: IfNotPresent
-          args:
-            - "-config"
-            - "/etc/spiffe-helper/config.hcl"
-          volumeMounts:
-            - name: spiffe-workload-api
-              mountPath: /spiffe-workload-api
-              readOnly: true
-            - name: spiffe-helper-config
-              mountPath: /etc/spiffe-helper
-              readOnly: true
-            - name: jwt-svid
-              mountPath: /opt
-          securityContext:
-            allowPrivilegeEscalation: false
-            runAsNonRoot: true
-            runAsUser: 65532
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 10m
-              memory: 32Mi
-            limits:
-              cpu: 100m
-              memory: 64Mi
-        {{- end }}
       securityContext:
         {{- toYaml .Values.controllerManager.securityContext | nindent 8 }}
       serviceAccountName: {{ .Values.controllerManager.serviceAccountName }}
@@ -251,11 +214,3 @@ spec:
             driver: "csi.spiffe.io"
             readOnly: true
         {{- end }}
-        {{- if and .Values.spiffe .Values.spiffe.enabled .Values.spiffe.operatorAuth .Values.spiffe.operatorAuth.enabled }}
-        - name: spiffe-helper-config
-          configMap:
-            name: operator-spiffe-helper-config
-        - name: jwt-svid
-          emptyDir:
-            medium: Memory
-        {{- end }}

charts/kagenti-operator/templates/manager/manager.yaml

@@ -205,8 +205,6 @@ spiffe:
   enabled: false
   operatorAuth:
     enabled: false
-    # Path to JWT-SVID file written by spiffe-helper sidecar
-    jwtSVIDPath: "/opt/jwt_svid.token"
 
 # Feature gates — highest-priority layer in the injection precedence chain.
 # Set globalEnabled to false to disable ALL sidecar injection (kill switch).

charts/kagenti-operator/values.yaml

@@ -135,7 +135,6 @@ func main() {
 	var credentialWaitTimeout string
 	var enableAuthbridgeConfig bool
 	var useSpiffeAuth bool
-	var jwtSVIDPath string
 	var operatorClientID string
 
 	flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metrics endpoint binds to. "+
@@ -211,9 +210,8 @@ func main() {
 	flag.BoolVar(&enableAuthbridgeConfig, "enable-authbridge-config", true,
 		"Reconcile authbridge-config ConfigMap in namespaces labeled kagenti-enabled=true")
 	flag.BoolVar(&useSpiffeAuth, "use-spiffe-auth", false,
-		"Use JWT-SVID authentication for Keycloak client registration instead of admin credentials")
-	flag.StringVar(&jwtSVIDPath, "jwt-svid-path", "/opt/jwt_svid.token",
-		"Path to JWT-SVID file written by spiffe-helper sidecar (used when --use-spiffe-auth=true)")
+		"Use JWT-SVID authentication for Keycloak client registration instead of admin credentials. "+
+			"JWT-SVIDs are fetched directly from the SPIRE workload API (--verified-fetch-spiffe-socket).")
 	flag.StringVar(&operatorClientID, "operator-client-id", "",
 		"Operator SPIFFE ID (e.g. spiffe://<domain>/ns/<ns>/sa/<sa>), used when --use-spiffe-auth=true")
 
@@ -711,7 +709,7 @@ func main() {
 			SpireTrustDomain:             spireTrustDomain,
 			KeycloakAdminTokenCache:      &keycloak.CachedAdminTokenProvider{},
 			UseSpiffeAuth:                useSpiffeAuth,
-			JWTSVIDPath:                  jwtSVIDPath,
+			SpiffeSocket:                 verifiedFetchSpiffeSocket,
 			OperatorClientID:             operatorClientID,
 			Recorder:                     mgr.GetEventRecorderFor("clientregistration"), //nolint:staticcheck
 		}).SetupWithManager(mgr); err != nil {

kagenti-operator/cmd/main.go

@@ -10,12 +10,13 @@ package controller
 import (
 	"context"
 	"fmt"
-	"os"
-	"path/filepath"
 	"sort"
 	"strings"
 	"time"
 
+	"github.com/spiffe/go-spiffe/v2/svid/jwtsvid"
+	"github.com/spiffe/go-spiffe/v2/workloadapi"
+
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
@@ -80,15 +81,16 @@ type ClientRegistrationReconciler struct {
 	KeycloakAdminTokenCache *keycloak.CachedAdminTokenProvider
 
 	// UseSpiffeAuth enables JWT-SVID authentication instead of admin credentials.
-	// When true, the operator authenticates to Keycloak with its JWT-SVID and uses
-	// the Admin API with manage-clients role. When false, uses admin credentials.
+	// When true, the operator fetches a JWT-SVID from SPIRE via the go-spiffe SDK
+	// and uses it with the Keycloak Admin API (manage-clients role only).
+	// When false, uses admin credentials.
 	UseSpiffeAuth bool
 
-	// JWTSVIDPath is the file path to read the operator's JWT-SVID from.
-	// Only used when UseSpiffeAuth is true. Default: /opt/jwt_svid.token
-	JWTSVIDPath string
+	// SpiffeSocket is the SPIRE workload API socket address used to fetch JWT-SVIDs.
+	// Only used when UseSpiffeAuth is true. Defaults to the verified-fetch socket.
+	SpiffeSocket string
 
-	// OperatorClientID is the operator's SPIFFE ID (e.g., spiffe://localtest.me/ns/kagenti-operator-system/sa/...).
+	// OperatorClientID is the operator's SPIFFE ID (e.g., spiffe://localtest.me/ns/kagenti-system/sa/controller-manager).
 	// Only used when UseSpiffeAuth is true.
 	OperatorClientID string
 
@@ -269,8 +271,6 @@ func (r *ClientRegistrationReconciler) reconcileOne(
 
 	// Authenticate to Keycloak: use JWT-SVID if enabled, otherwise admin credentials
 	if r.UseSpiffeAuth {
-		// SPIFFE authentication path
-		// Validate OperatorClientID before file I/O to fail fast on misconfiguration
 		if r.OperatorClientID == "" {
 			err := fmt.Errorf("OperatorClientID not configured")
 			logger.Error(err, "SPIFFE auth requires OperatorClientID")
@@ -281,36 +281,40 @@ func (r *ClientRegistrationReconciler) reconcileOne(
 			return ctrl.Result{RequeueAfter: 30 * time.Second}, nil
 		}
 
-		jwtSVIDPath := r.JWTSVIDPath
-		if jwtSVIDPath == "" {
-			jwtSVIDPath = "/opt/jwt_svid.token"
+		socket := r.SpiffeSocket
+		if socket == "" {
+			socket = "unix:///spiffe-workload-api/spire-agent.sock"
 		}
 
-		// Path traversal protection: only allow reading from designated directories
-		cleanPath := filepath.Clean(jwtSVIDPath)
-		if !strings.HasPrefix(cleanPath, "/opt/") && !strings.HasPrefix(cleanPath, "/var/run/secrets/") {
-			err := fmt.Errorf("JWT-SVID path %q outside allowed directories (/opt/, /var/run/secrets/)", jwtSVIDPath)
-			logger.Error(err, "invalid JWT-SVID path")
+		// Fetch a JWT-SVID directly from the SPIRE workload API using the go-spiffe SDK.
+		// This is the same socket used by verifiedFetch — no sidecar or file needed.
+		// The audience must be the Keycloak realm's issuer URL (external URL, not in-cluster).
+		// The JWT-SVID audience must be the Keycloak realm's issuer URL (external/public URL).
+		// Keycloak's FederatedJWTClientValidator checks aud == its own issuer string.
+		audience := fmt.Sprintf("%s/realms/%s", strings.TrimRight(ab.KeycloakURL, "/"), ab.KeycloakRealm)
+		spiffeClient, err := workloadapi.New(ctx, workloadapi.WithAddr(socket))
+		if err != nil {
+			logger.Error(err, "failed to create SPIFFE workload API client")
 			if r.Recorder != nil {
-				r.Recorder.Eventf(owner, corev1.EventTypeWarning, "InvalidJWTSVIDPath",
-					"JWT-SVID path %q rejected: must be under /opt/ or /var/run/secrets/", jwtSVIDPath)
+				r.Recorder.Eventf(owner, corev1.EventTypeWarning, "SPIFFEClientFailed",
+					"Failed to connect to SPIRE workload API at %s: %v", socket, err)
 			}
-			return ctrl.Result{}, err // fail permanently on config error
+			return ctrl.Result{RequeueAfter: 30 * time.Second}, nil
 		}
+		defer spiffeClient.Close()
 
-		jwtSVID, err := os.ReadFile(cleanPath)
+		svid, err := spiffeClient.FetchJWTSVID(ctx, jwtsvid.Params{Audience: audience})
 		if err != nil {
-			logger.Error(err, "read JWT-SVID failed", "path", cleanPath)
+			logger.Error(err, "failed to fetch JWT-SVID from SPIRE")
 			if r.Recorder != nil {
-				r.Recorder.Eventf(owner, corev1.EventTypeWarning, "JWTSVIDReadFailed",
-					"Failed to read JWT-SVID from %s: %v. Check spiffe-helper sidecar configuration.", cleanPath, err)
+				r.Recorder.Event(owner, corev1.EventTypeWarning, "JWTSVIDFetchFailed",
+					"Failed to fetch JWT-SVID from SPIRE workload API. Check SPIRE is running and the operator has a registered identity.")
 			}
 			return ctrl.Result{RequeueAfter: 30 * time.Second}, nil
 		}
 
-		// WARNING: JWT-SVID is a bearer token - must never appear in logs or error messages
-		// to prevent token exposure. All code paths must handle jwtSVID as sensitive data.
-		token, err = kc.JWTSVIDGrantToken(ctx, ab.KeycloakRealm, r.OperatorClientID, string(jwtSVID))
+		// WARNING: JWT-SVID is a bearer token — must never appear in logs or error messages.
+		token, err = kc.JWTSVIDGrantToken(ctx, ab.KeycloakRealm, r.OperatorClientID, svid.Marshal())
 		if err != nil {
 			logger.Error(err, "Keycloak JWT-SVID authentication failed")
 			if r.Recorder != nil {
@@ -319,7 +323,7 @@ func (r *ClientRegistrationReconciler) reconcileOne(
 			}
 			return ctrl.Result{RequeueAfter: 30 * time.Second}, nil
 		}
-		logger.V(1).Info("authenticated with JWT-SVID", "clientId", r.OperatorClientID)
+		logger.V(1).Info("authenticated with JWT-SVID via SPIRE workload API", "clientId", r.OperatorClientID)
 	} else {
 		// Admin credentials path (legacy)
 		adminUser, adminPass, err := r.resolveKeycloakAdminCredentials(ctx)