refactor: remove SpiffeHelperConf from webhook namespace/resolved config

Webhook no longer reads spiffe-helper-config CM at admission time.
Remove SpiffeHelperConf field from NamespaceConfig and ResolvedConfig
structs. The controller now derives the CM from PlatformConfig; the
volume mount still references the CM by name (unchanged).

RHAIENG-4939

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Ian Miller <milleryan2003@gmail.com>

Author: r3v5

kagenti-operator/internal/webhook/injector/namespace_config.go

@@ -53,9 +53,6 @@ type NamespaceConfig struct {
 	SpiffeIdpAlias        string // Keycloak SPIFFE Identity Provider alias (e.g., "spire-spiffe")
 	JWTAudience           string // Audience for SPIFFE JWT-SVIDs (token-exchange identity.jwt_audience)
 
-	// From "spiffe-helper-config" ConfigMap
-	SpiffeHelperConf string // raw helper.conf content
-
 	// From "authproxy-routes" ConfigMap
 	AuthproxyRoutesYAML string // raw routes.yaml content
 
@@ -91,12 +88,9 @@ func ReadNamespaceConfig(ctx context.Context, c client.Reader, namespace string)
 	// uses SecretKeyRef to reference the secret by name, keeping credentials out of
 	// the NamespaceConfig struct and the webhook's memory.
 
-	// Read "spiffe-helper-config" ConfigMap
-	if cm, err := getConfigMap(ctx, c, namespace, SpiffeHelperConfigMapName); err != nil {
-		nsConfigLog.V(1).Info("ConfigMap not found", "name", SpiffeHelperConfigMapName, "namespace", namespace, "error", err)
-	} else {
-		cfg.SpiffeHelperConf = cm.Data["helper.conf"]
-	}
+	// Note: spiffe-helper-config is NOT read here. The controller derives it
+	// from PlatformConfig via ensureSpiffeHelperConfigMap(). The volume mount
+	// still references SpiffeHelperConfigMapName directly.
 
 	// Read "authproxy-routes" ConfigMap
 	if cm, err := getConfigMap(ctx, c, namespace, AuthproxyRoutesConfigMapName); err != nil {

kagenti-operator/internal/webhook/injector/namespace_config_test.go

@@ -48,16 +48,12 @@ func TestReadNamespaceConfig_AllPresent(t *testing.T) {
 			"DEFAULT_OUTBOUND_POLICY": "passthrough",
 		},
 	}
-	spiffeCM := &corev1.ConfigMap{
-		ObjectMeta: metav1.ObjectMeta{Name: SpiffeHelperConfigMapName, Namespace: "ns1"},
-		Data:       map[string]string{"helper.conf": "agent_address = \"/spiffe-workload-api/spire-agent.sock\""},
-	}
 	routesCM := &corev1.ConfigMap{
 		ObjectMeta: metav1.ObjectMeta{Name: AuthproxyRoutesConfigMapName, Namespace: "ns1"},
 		Data:       map[string]string{"routes.yaml": "routes: []"},
 	}
 
-	reader := newFakeReader(abCM, spiffeCM, routesCM)
+	reader := newFakeReader(abCM, routesCM)
 	cfg, err := ReadNamespaceConfig(context.Background(), reader, "ns1")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
@@ -75,9 +71,6 @@ func TestReadNamespaceConfig_AllPresent(t *testing.T) {
 	if cfg.Issuer != "http://keycloak:8080/realms/demo" {
 		t.Errorf("Issuer = %q", cfg.Issuer)
 	}
-	if cfg.SpiffeHelperConf == "" {
-		t.Error("SpiffeHelperConf is empty")
-	}
 	if cfg.TargetAudience != "auth-target" {
 		t.Errorf("TargetAudience = %q", cfg.TargetAudience)
 	}

kagenti-operator/internal/webhook/injector/resolved_config.go

@@ -47,7 +47,6 @@ type ResolvedConfig struct {
 	SpiffeIdpAlias        string // Keycloak SPIFFE Identity Provider alias
 
 	// Sidecar configs — from namespace CMs (not overridable by AgentRuntime v1alpha1)
-	SpiffeHelperConf    string
 	AuthproxyRoutesYAML string
 
 	// AuthBridge runtime config — from namespace "authbridge-runtime-config" ConfigMap
@@ -92,7 +91,6 @@ func ResolveConfig(platform *config.PlatformConfig, ns *NamespaceConfig, ar *Age
 		DefaultOutboundPolicy:      ns.DefaultOutboundPolicy,
 		ClientAuthType:             ns.ClientAuthType,
 		SpiffeIdpAlias:             ns.SpiffeIdpAlias,
-		SpiffeHelperConf:           ns.SpiffeHelperConf,
 		AuthproxyRoutesYAML:        ns.AuthproxyRoutesYAML,
 		AuthBridgeRuntimeYAML:      ns.AuthBridgeRuntimeYAML,
 	}

kagenti-operator/internal/webhook/injector/resolved_config_test.go

@@ -96,18 +96,13 @@ func TestResolveConfig_SpiffeTrustDomain_AROverride(t *testing.T) {
 
 func TestResolveConfig_SidecarConfigs_NotOverridable(t *testing.T) {
 	ns := &NamespaceConfig{
-		SpiffeHelperConf:    "helper.conf content",
 		AuthproxyRoutesYAML: "routes.yaml content",
 	}
-	// AR overrides don't have fields for these — they flow through from namespace
 	ar := &AgentRuntimeOverrides{
 		SpiffeTrustDomain: ptr.To("override"),
 	}
 
 	resolved := ResolveConfig(config.CompiledDefaults(), ns, ar)
-	if resolved.SpiffeHelperConf != "helper.conf content" {
-		t.Errorf("SpiffeHelperConf should come from namespace")
-	}
 	if resolved.AuthproxyRoutesYAML != "routes.yaml content" {
 		t.Errorf("AuthproxyRoutesYAML should come from namespace")
 	}