feat: derive spiffe-helper-config CM from PlatformConfig

Add GetPlatformConfig to AgentRuntimeReconciler and
ensureSpiffeHelperConfigMap() which creates/overwrites the
spiffe-helper-config CM per namespace from PlatformConfig. Remove
spiffe-helper-config from templateConfigMapNames (no longer
template-copied). Include helperConfig in config hash so changes
trigger rolling updates.

RHAIENG-4939

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Ian Miller <milleryan2003@gmail.com>

Author: r3v5

kagenti-operator/cmd/main.go

@@ -631,6 +631,7 @@ func main() {
 		EnableCardDiscovery: enableCardDiscovery,
 		SpireTrustDomain:    spireTrustDomain,
 		GetFeatureGates:     featureGateLoader.Get,
+		GetPlatformConfig:   configLoader.Get,
 	}
 	if enableCardDiscovery {
 		artReconciler.AgentFetcher = agentFetcher

kagenti-operator/internal/controller/agentruntime_config.go

@@ -48,6 +48,11 @@ const (
 	// ConfigMap are watched by AgentRuntimeReconciler so the resolved-config
 	// hash picks them up and rolls affected workloads.
 	AuthBridgeRuntimeConfigMapName = "authbridge-runtime-config"
+
+	// SpiffeHelperConfigMapName is the namespace-scoped ConfigMap holding
+	// the spiffe-helper helper.conf. Derived from PlatformConfig by the
+	// controller; included in the config hash for rolling updates.
+	SpiffeHelperConfigMapName = "spiffe-helper-config"
 )
 
 // ClusterDefaultsNamespace is the namespace where cluster-level ConfigMaps
@@ -84,6 +89,10 @@ type resolvedConfig struct {
 	// we want any byte change to roll the workload. Empty string when
 	// the ConfigMap doesn't exist in the namespace.
 	AuthBridgeRuntime string `json:"authBridgeRuntime,omitempty"`
+
+	// SpiffeHelperConfig captures the spiffe-helper-config CM content so
+	// changes to PlatformConfig's spiffe.helperConfig trigger rolling updates.
+	SpiffeHelperConfig string `json:"spiffeHelperConfig,omitempty"`
 }
 
 // ConfigResult holds the computed hash and any warnings from the config resolution.
@@ -130,10 +139,19 @@ func resolveConfig(ctx context.Context, c client.Reader, namespace string) (reso
 		abRuntime = data["config.yaml"]
 	}
 
+	// Layer 2c: spiffe-helper-config (helper.conf).
+	// Derived from PlatformConfig by the controller; included in hash
+	// so changes to spiffe.helperConfig trigger rolling updates.
+	spiffeHelper := ""
+	if data := readConfigMapData(ctx, c, namespace, SpiffeHelperConfigMapName); len(data) > 0 {
+		spiffeHelper = data["helper.conf"]
+	}
+
 	return resolvedConfig{
-		FeatureGates:      featureGates,
-		Defaults:          merged,
-		AuthBridgeRuntime: abRuntime,
+		FeatureGates:       featureGates,
+		Defaults:           merged,
+		AuthBridgeRuntime:  abRuntime,
+		SpiffeHelperConfig: spiffeHelper,
 	}, warnings
 }
 

kagenti-operator/internal/controller/agentruntime_config_test.go

@@ -220,6 +220,32 @@ var _ = Describe("AgentRuntime Config", func() {
 			r2, _ := ComputeConfigHash(ctx, k8sClient, namespace)
 			Expect(r1.Hash).NotTo(Equal(r2.Hash))
 		})
+
+		It("should change when spiffe-helper-config content changes", func() {
+			const shHashNS = "sh-hash-ns"
+			shNS := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: shHashNS}}
+			_ = k8sClient.Create(ctx, shNS)
+
+			shCM := &corev1.ConfigMap{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "spiffe-helper-config",
+					Namespace: shHashNS,
+				},
+				Data: map[string]string{
+					"helper.conf": "agent_address = \"/old/socket\"",
+				},
+			}
+			Expect(k8sClient.Create(ctx, shCM)).To(Succeed())
+			defer func() { _ = k8sClient.Delete(ctx, shCM) }()
+
+			r1, _ := ComputeConfigHash(ctx, k8sClient, shHashNS)
+
+			shCM.Data["helper.conf"] = "agent_address = \"/new/socket\""
+			Expect(k8sClient.Update(ctx, shCM)).To(Succeed())
+
+			r2, _ := ComputeConfigHash(ctx, k8sClient, shHashNS)
+			Expect(r1.Hash).NotTo(Equal(r2.Hash))
+		})
 	})
 
 	Context("resolveConfig two-layer merge", func() {

kagenti-operator/internal/controller/agentruntime_controller.go

@@ -109,6 +109,7 @@ type AgentRuntimeReconciler struct {
 	EnableCardDiscovery  bool
 	SpireTrustDomain     string
 	GetFeatureGates      func() *webhookconfig.FeatureGates
+	GetPlatformConfig    func() *webhookconfig.PlatformConfig
 }
 
 func (r *AgentRuntimeReconciler) getFeatureGates() *webhookconfig.FeatureGates {
@@ -118,6 +119,15 @@ func (r *AgentRuntimeReconciler) getFeatureGates() *webhookconfig.FeatureGates {
 	return webhookconfig.DefaultFeatureGates()
 }
 
+func (r *AgentRuntimeReconciler) getPlatformConfig() *webhookconfig.PlatformConfig {
+	if r.GetPlatformConfig != nil {
+		if cfg := r.GetPlatformConfig(); cfg != nil {
+			return cfg
+		}
+	}
+	return webhookconfig.CompiledDefaults()
+}
+
 // +kubebuilder:rbac:groups=agent.kagenti.dev,resources=agentruntimes,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=agent.kagenti.dev,resources=agentruntimes/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=agent.kagenti.dev,resources=agentruntimes/finalizers,verbs=update
@@ -190,6 +200,17 @@ func (r *AgentRuntimeReconciler) Reconcile(ctx context.Context, req ctrl.Request
 		}
 	}
 
+	// 4.5b. Ensure spiffe-helper-config CM is derived from PlatformConfig.
+	// Unlike template CMs above, this always overwrites to keep PlatformConfig
+	// as the single source of truth.
+	if err := r.ensureSpiffeHelperConfigMap(ctx, rt.Namespace); err != nil {
+		logger.Error(err, "Failed to ensure spiffe-helper-config")
+		if r.Recorder != nil {
+			r.Recorder.Eventf(rt, nil, corev1.EventTypeWarning, "ConfigMapEnsureError",
+				"EnsureSpiffeHelperConfig", err.Error())
+		}
+	}
+
 	// 4.6. Ensure namespace has Istio ambient mesh labels for ztunnel mTLS.
 	istioLabeled, istioErr := r.ensureIstioMeshLabels(ctx, rt.Namespace)
 	switch {
@@ -1024,6 +1045,59 @@ func (r *AgentRuntimeReconciler) ensureNamespaceConfigMaps(ctx context.Context,
 	return nil
 }
 
+// ensureSpiffeHelperConfigMap creates or updates the spiffe-helper-config ConfigMap
+// in the target namespace using content from PlatformConfig. Unlike template CMs
+// which are create-if-not-exists, this always overwrites because PlatformConfig is
+// the single source of truth.
+func (r *AgentRuntimeReconciler) ensureSpiffeHelperConfigMap(ctx context.Context, namespace string) error {
+	logger := log.FromContext(ctx)
+	cfg := r.getPlatformConfig()
+
+	desired := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      SpiffeHelperConfigMapName,
+			Namespace: namespace,
+			Labels: map[string]string{
+				LabelManagedBy: LabelManagedByValue,
+			},
+		},
+		Data: map[string]string{
+			"helper.conf": cfg.Spiffe.HelperConfig,
+		},
+	}
+
+	existing := &corev1.ConfigMap{}
+	err := r.uncachedReader().Get(ctx, client.ObjectKey{Namespace: namespace, Name: SpiffeHelperConfigMapName}, existing)
+	if apierrors.IsNotFound(err) {
+		if err := r.Create(ctx, desired); err != nil {
+			if apierrors.IsAlreadyExists(err) {
+				return nil
+			}
+			return fmt.Errorf("failed to create spiffe-helper-config in %s: %w", namespace, err)
+		}
+		logger.Info("Created spiffe-helper-config from PlatformConfig", "namespace", namespace)
+		return nil
+	}
+	if err != nil {
+		return fmt.Errorf("failed to check spiffe-helper-config in %s: %w", namespace, err)
+	}
+
+	if existing.Data["helper.conf"] == cfg.Spiffe.HelperConfig {
+		return nil
+	}
+
+	existing.Data = desired.Data
+	if existing.Labels == nil {
+		existing.Labels = make(map[string]string)
+	}
+	existing.Labels[LabelManagedBy] = LabelManagedByValue
+	if err := r.Update(ctx, existing); err != nil {
+		return fmt.Errorf("failed to update spiffe-helper-config in %s: %w", namespace, err)
+	}
+	logger.Info("Updated spiffe-helper-config from PlatformConfig", "namespace", namespace)
+	return nil
+}
+
 const (
 	sccClusterRoleName = "system:openshift:scc:kagenti-authbridge"
 	sccRoleBindingName = "agent-authbridge-scc"

kagenti-operator/internal/controller/agentruntime_controller_test.go

@@ -704,7 +704,7 @@ var _ = Describe("AgentRuntime Controller", func() {
 		})
 
 		AfterEach(func() {
-			for _, name := range templateConfigMapNames {
+			for _, name := range []string{"authbridge-config", "authbridge-runtime-config", "envoy-config", "spiffe-helper-config"} {
 				cm := &corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: ClusterDefaultsNamespace}}
 				_ = k8sClient.Delete(ctx, cm)
 				cm = &corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: cmTestNS}}
@@ -819,6 +819,102 @@ var _ = Describe("AgentRuntime Controller", func() {
 		})
 	})
 
+	Context("When ensuring spiffe-helper-config from PlatformConfig", func() {
+		const shTestNS = "sh-test-ns"
+
+		BeforeEach(func() {
+			testNS := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: shTestNS}}
+			_ = k8sClient.Create(ctx, testNS)
+		})
+
+		AfterEach(func() {
+			cm := &corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: "spiffe-helper-config", Namespace: shTestNS}}
+			_ = k8sClient.Delete(ctx, cm)
+		})
+
+		It("should create spiffe-helper-config when missing", func() {
+			r := newReconciler()
+			r.GetPlatformConfig = func() *webhookconfig.PlatformConfig {
+				cfg := webhookconfig.CompiledDefaults()
+				cfg.Spiffe.HelperConfig = "test_agent_address = \"/test/socket\""
+				return cfg
+			}
+
+			Expect(r.ensureSpiffeHelperConfigMap(ctx, shTestNS)).To(Succeed())
+
+			created := &corev1.ConfigMap{}
+			Expect(k8sClient.Get(ctx, types.NamespacedName{Name: "spiffe-helper-config", Namespace: shTestNS}, created)).To(Succeed())
+			Expect(created.Data["helper.conf"]).To(Equal("test_agent_address = \"/test/socket\""))
+			Expect(created.Labels[LabelManagedBy]).To(Equal(LabelManagedByValue))
+		})
+
+		It("should overwrite spiffe-helper-config when content differs", func() {
+			existing := &corev1.ConfigMap{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "spiffe-helper-config",
+					Namespace: shTestNS,
+				},
+				Data: map[string]string{"helper.conf": "old_content"},
+			}
+			Expect(k8sClient.Create(ctx, existing)).To(Succeed())
+
+			r := newReconciler()
+			r.GetPlatformConfig = func() *webhookconfig.PlatformConfig {
+				cfg := webhookconfig.CompiledDefaults()
+				cfg.Spiffe.HelperConfig = "new_content"
+				return cfg
+			}
+
+			Expect(r.ensureSpiffeHelperConfigMap(ctx, shTestNS)).To(Succeed())
+
+			updated := &corev1.ConfigMap{}
+			Expect(k8sClient.Get(ctx, types.NamespacedName{Name: "spiffe-helper-config", Namespace: shTestNS}, updated)).To(Succeed())
+			Expect(updated.Data["helper.conf"]).To(Equal("new_content"))
+		})
+
+		It("should be idempotent when content matches", func() {
+			existing := &corev1.ConfigMap{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "spiffe-helper-config",
+					Namespace: shTestNS,
+					Labels:    map[string]string{LabelManagedBy: LabelManagedByValue},
+				},
+				Data: map[string]string{"helper.conf": "same_content"},
+			}
+			Expect(k8sClient.Create(ctx, existing)).To(Succeed())
+
+			r := newReconciler()
+			r.GetPlatformConfig = func() *webhookconfig.PlatformConfig {
+				cfg := webhookconfig.CompiledDefaults()
+				cfg.Spiffe.HelperConfig = "same_content"
+				return cfg
+			}
+
+			Expect(r.ensureSpiffeHelperConfigMap(ctx, shTestNS)).To(Succeed())
+
+			result := &corev1.ConfigMap{}
+			Expect(k8sClient.Get(ctx, types.NamespacedName{Name: "spiffe-helper-config", Namespace: shTestNS}, result)).To(Succeed())
+			Expect(result.Data["helper.conf"]).To(Equal("same_content"))
+		})
+
+		It("should use CompiledDefaults when GetPlatformConfig is nil", func() {
+			r := newReconciler()
+			Expect(r.ensureSpiffeHelperConfigMap(ctx, shTestNS)).To(Succeed())
+
+			created := &corev1.ConfigMap{}
+			Expect(k8sClient.Get(ctx, types.NamespacedName{Name: "spiffe-helper-config", Namespace: shTestNS}, created)).To(Succeed())
+			Expect(created.Data["helper.conf"]).To(Equal(webhookconfig.DefaultSpiffeHelperConfig))
+		})
+	})
+
+	Context("When templateConfigMapNames excludes spiffe-helper-config", func() {
+		It("should not contain spiffe-helper-config", func() {
+			for _, name := range templateConfigMapNames {
+				Expect(name).NotTo(Equal("spiffe-helper-config"))
+			}
+		})
+	})
+
 	Context("Service resolution for card discovery", func() {
 		It("should resolve service by name match", func() {
 			dep := newDeployment("svc-name-deploy", namespace)