fix(webhook): skip credential annotation in federated-jwt mode

The authbridge webhook pre-populates the Keycloak client-credentials
annotation so the credential Secret volume is ready before the controller
reconciles. In federated-jwt mode, no credential Secret is created —
AuthBridge reads JWT-SVIDs from the SPIFFE workload API socket directly.
Injecting the volume mount for a non-existent Secret left pods stuck in
Init:0/1.

Fix: read CLIENT_AUTH_TYPE from authbridge-config before pre-populating
the annotation, and skip it when federated-jwt is configured.

Signed-off-by: Alan Cha <alan.cha@ibm.com>
Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Alan Cha <Alan.cha1@ibm.com>

Author: Alan-Cha

kagenti-operator/internal/webhook/v1alpha1/authbridge_webhook.go

@@ -96,16 +96,23 @@ func (w *AuthBridgeWebhook) Handle(ctx context.Context, req admission.Request) a
 	// kubelet will wait for the Secret to appear and mount it — no pod restart required.
 	// Without this, the first pod comes up with an empty /shared/ and envoy returns 503
 	// "identity not yet configured (credentials pending)" until the user deletes the pod.
+	//
+	// Skip in federated-jwt mode: AuthBridge reads JWT-SVIDs from the SPIFFE workload API
+	// socket directly and no credential Secret is created or needed. Injecting the volume
+	// mount for a non-existent Secret would leave pods stuck in Init.
 	if pod.Annotations[injector.AnnotationKeycloakClientSecretName] == "" &&
 		clientreg.WorkloadWantsOperatorClientReg(pod.Labels, w.Mutator.GetFeatureGates().InjectTools) {
-		if pod.Annotations == nil {
-			pod.Annotations = map[string]string{}
+		nsConfig, _ := injector.ReadNamespaceConfig(ctx, w.Mutator.APIReader, req.Namespace)
+		if nsConfig == nil || nsConfig.ClientAuthType != injector.ClientAuthTypeFederatedJWT {
+			if pod.Annotations == nil {
+				pod.Annotations = map[string]string{}
+			}
+			pod.Annotations[injector.AnnotationKeycloakClientSecretName] =
+				clientreg.KeycloakClientCredentialsSecretName(req.Namespace, resourceName)
+			authbridgelog.Info("pre-populated Keycloak client credentials annotation",
+				"namespace", req.Namespace, "name", resourceName,
+				"secret", pod.Annotations[injector.AnnotationKeycloakClientSecretName])
 		}
-		pod.Annotations[injector.AnnotationKeycloakClientSecretName] =
-			clientreg.KeycloakClientCredentialsSecretName(req.Namespace, resourceName)
-		authbridgelog.Info("pre-populated Keycloak client credentials annotation",
-			"namespace", req.Namespace, "name", resourceName,
-			"secret", pod.Annotations[injector.AnnotationKeycloakClientSecretName])
 	}
 
 	// Check if already injected (idempotency / reinvocation)