chore: add spiffe defaults to Helm values, remove static templates

Add spiffe section with helperConfig to Helm values.yaml under defaults.
Delete static spiffe-helper-config.yaml template and OpenShift
spiffe-helper-keycloak.yaml kustomize patch. Update kustomization
references and e2e fixture comments.

RHAIENG-4939

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Ian Miller <milleryan2003@gmail.com>

Author: r3v5

charts/kagenti-operator/values.yaml

@@ -253,3 +253,21 @@ defaults:
       limits:
         cpu: 300m
         memory: 384Mi
+
+  # SPIFFE / spiffe-helper settings.
+  # Keep helperConfig in sync with DefaultSpiffeHelperConfig in internal/webhook/config/defaults.go.
+  spiffe:
+    trustDomain: cluster.local
+    socketPath: "unix:///spiffe-workload-api/spire-agent.sock"
+    helperConfig: |
+      agent_address = "/spiffe-workload-api/spire-agent.sock"
+      cmd = ""
+      cmd_args = ""
+      svid_file_name = "/opt/svid.pem"
+      svid_key_file_name = "/opt/svid_key.pem"
+      svid_bundle_file_name = "/opt/svid_bundle.pem"
+      cert_file_mode = 0644
+      key_file_mode = 0640
+      jwt_svids = [{jwt_audience="http://keycloak.localtest.me:8080/realms/kagenti", jwt_svid_file_name="/opt/jwt_svid.token"}]
+      jwt_svid_file_mode = 0644
+      include_federated_domains = true

kagenti-operator/config/authbridge/kustomization.yaml

@@ -1,4 +1,3 @@
 resources:
 - authbridge-runtime-config.yaml
 - envoy-config.yaml
-- spiffe-helper-config.yaml

kagenti-operator/config/authbridge/spiffe-helper-config.yaml

@@ -12,4 +12,3 @@ resources:
 
 patches:
 - path: patches/authbridge-keycloak.yaml
-- path: patches/spiffe-helper-keycloak.yaml

kagenti-operator/config/openshift/kustomization.yaml

@@ -833,11 +833,11 @@ spec:
 
 // --- AuthBridge Injection E2E fixtures ---
 
-// authBridgeConfigMapFixture returns YAML for the 4 ConfigMaps required by
-// the auth bridge webhook: authbridge-config, authbridge-runtime-config, spiffe-helper-config, envoy-config.
-// Only the mandatory keys are set (ISSUER, KEYCLOAK_URL, KEYCLOAK_REALM, TOKEN_URL,
-// DEFAULT_OUTBOUND_POLICY). The operator reads additional optional keys
-// (EXPECTED_AUDIENCE, TARGET_AUDIENCE, SPIRE_ENABLED, etc.) which default to empty.
+// authBridgeConfigMapFixture returns YAML for the ConfigMaps required by
+// the auth bridge webhook: authbridge-config, spiffe-helper-config, envoy-config,
+// and authbridge-runtime-config. Note: in production, spiffe-helper-config is
+// derived from PlatformConfig by the controller; here it's created directly for
+// e2e test setup before the controller reconciles.
 func authBridgeConfigMapFixture() string {
 	return `apiVersion: v1
 kind: ConfigMap
@@ -1231,9 +1231,11 @@ spec:
 `
 }
 
-// combinedConfigMapFixture returns YAML for the 4 AuthBridge ConfigMaps
+// combinedConfigMapFixture returns YAML for the AuthBridge ConfigMaps
 // (authbridge-config, spiffe-helper-config, envoy-config, authbridge-runtime-config)
-// scoped to the combined test namespace.
+// scoped to the combined test namespace. Note: spiffe-helper-config is created
+// directly here for e2e setup; in production, the controller derives it from
+// PlatformConfig.
 func combinedConfigMapFixture() string {
 	return `apiVersion: v1
 kind: ConfigMap