fix: requeue on spiffe-helper-config failure, remove from template list

Remove spiffe-helper-config from templateConfigMapNames since it is now
derived from PlatformConfig via ensureSpiffeHelperConfigMap. Make failure
in ensureSpiffeHelperConfigMap set error status and requeue (30s), matching
the SCC binding pattern, to prevent stamping workloads with a stale or
missing spiffe-helper-config.

Addresses review feedback from kevincogan on PR #437.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>

Author: r3v5

kagenti-operator/internal/controller/agentruntime_controller.go

@@ -209,6 +209,8 @@ func (r *AgentRuntimeReconciler) Reconcile(ctx context.Context, req ctrl.Request
 			r.Recorder.Eventf(rt, nil, corev1.EventTypeWarning, "ConfigMapEnsureError",
 				"EnsureSpiffeHelperConfig", err.Error())
 		}
+		r.updateErrorStatus(ctx, req.NamespacedName, ConditionTypeReady, "SpiffeHelperConfigError", err.Error())
+		return ctrl.Result{RequeueAfter: 30 * time.Second}, nil
 	}
 
 	// 4.6. Ensure namespace has Istio ambient mesh labels for ztunnel mTLS.
@@ -993,7 +995,6 @@ func computeCardContentHash(cardData *agentv1alpha1.AgentCardData) string {
 var templateConfigMapNames = []string{
 	"authbridge-config",
 	"authbridge-runtime-config",
-	"spiffe-helper-config",
 }
 
 // ensureNamespaceConfigMaps copies template ConfigMaps from kagenti-system to the

kagenti-operator/internal/controller/agentruntime_controller_test.go

@@ -704,7 +704,7 @@ var _ = Describe("AgentRuntime Controller", func() {
 		})
 
 		AfterEach(func() {
-			for _, name := range []string{"authbridge-config", "authbridge-runtime-config", "envoy-config", "spiffe-helper-config"} {
+			for _, name := range []string{"authbridge-config", "authbridge-runtime-config", "envoy-config"} {
 				cm := &corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: ClusterDefaultsNamespace}}
 				_ = k8sClient.Delete(ctx, cm)
 				cm = &corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: cmTestNS}}
@@ -809,8 +809,8 @@ var _ = Describe("AgentRuntime Controller", func() {
 			Expect(k8sClient.Get(ctx, types.NamespacedName{Name: "authbridge-config", Namespace: cmTestNS}, abCfg)).To(Succeed())
 			Expect(abCfg.Data["KEYCLOAK_URL"]).To(Equal("http://existing"))
 
-			// The other 3 should be created from templates
-			for _, name := range []string{"authbridge-runtime-config", "spiffe-helper-config"} {
+			// authbridge-runtime-config should be created from template
+			for _, name := range []string{"authbridge-runtime-config"} {
 				cm := &corev1.ConfigMap{}
 				Expect(k8sClient.Get(ctx, types.NamespacedName{Name: name, Namespace: cmTestNS}, cm)).To(Succeed())
 				Expect(cm.Data["config.yaml"]).To(Equal("template-" + name))