feat: add HelperConfig field to SpiffeConfig schema

Add HelperConfig string field to SpiffeConfig struct so PlatformConfig
can carry raw spiffe-helper helper.conf content. Wire default content
into CompiledDefaults() and log truncated snippet on startup.

RHAIENG-4939

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Ian Miller <milleryan2003@gmail.com>

Author: r3v5

kagenti-operator/internal/webhook/config/defaults.go

@@ -5,6 +5,21 @@ import (
 	"k8s.io/apimachinery/pkg/api/resource"
 )
 
+// DefaultSpiffeHelperConfig is the default helper.conf content for spiffe-helper.
+// Keep in sync with charts/kagenti-operator/values.yaml defaults.spiffe.helperConfig.
+const DefaultSpiffeHelperConfig = `agent_address = "/spiffe-workload-api/spire-agent.sock"
+cmd = ""
+cmd_args = ""
+svid_file_name = "/opt/svid.pem"
+svid_key_file_name = "/opt/svid_key.pem"
+svid_bundle_file_name = "/opt/svid_bundle.pem"
+cert_file_mode = 0644
+key_file_mode = 0640
+jwt_svids = [{jwt_audience="http://keycloak.localtest.me:8080/realms/kagenti", jwt_svid_file_name="/opt/jwt_svid.token"}]
+jwt_svid_file_mode = 0644
+include_federated_domains = true
+`
+
 // CompiledDefaults returns hardcoded defaults used when no config is provided
 func CompiledDefaults() *PlatformConfig {
 	return &PlatformConfig{
@@ -79,8 +94,9 @@ func CompiledDefaults() *PlatformConfig {
 			DefaultScopes: []string{"openid"},
 		},
 		Spiffe: SpiffeConfig{
-			TrustDomain: "cluster.local",
-			SocketPath:  "unix:///spiffe-workload-api/spire-agent.sock",
+			TrustDomain:  "cluster.local",
+			SocketPath:   "unix:///spiffe-workload-api/spire-agent.sock",
+			HelperConfig: DefaultSpiffeHelperConfig,
 		},
 		Observability: ObservabilityConfig{
 			LogLevel:      "info",

kagenti-operator/internal/webhook/config/loader.go

@@ -227,9 +227,14 @@ func logConfig(cfg *PlatformConfig, source string) {
 		"defaultAudience", cfg.TokenExchange.DefaultAudience,
 		"defaultScopes", cfg.TokenExchange.DefaultScopes,
 	)
+	helperSnippet := cfg.Spiffe.HelperConfig
+	if len(helperSnippet) > 80 {
+		helperSnippet = helperSnippet[:80] + "..."
+	}
 	log.Info("[config] spiffe",
 		"trustDomain", cfg.Spiffe.TrustDomain,
 		"socketPath", cfg.Spiffe.SocketPath,
+		"helperConfig", helperSnippet,
 	)
 	log.Info("=============================================")
 }

kagenti-operator/internal/webhook/config/types.go

@@ -86,8 +86,9 @@ type TokenExchangeDefaults struct {
 }
 
 type SpiffeConfig struct {
-	TrustDomain string `json:"trustDomain" yaml:"trustDomain"`
-	SocketPath  string `json:"socketPath" yaml:"socketPath"`
+	TrustDomain  string `json:"trustDomain" yaml:"trustDomain"`
+	SocketPath   string `json:"socketPath" yaml:"socketPath"`
+	HelperConfig string `json:"helperConfig" yaml:"helperConfig"`
 }
 
 type ObservabilityConfig struct {

kagenti-operator/internal/webhook/config/types_test.go

@@ -1,6 +1,11 @@
 package config
 
-import "testing"
+import (
+	"strings"
+	"testing"
+
+	"sigs.k8s.io/yaml"
+)
 
 // TransparentPort is the REDIRECT target for the enforce-redirect guard; it must
 // be a valid, non-privileged port (the proxy binds it as a non-root user).
@@ -60,3 +65,47 @@ func TestValidate_IptablesCmd(t *testing.T) {
 		})
 	}
 }
+
+func TestCompiledDefaults_SpiffeHelperConfig(t *testing.T) {
+	cfg := CompiledDefaults()
+	if cfg.Spiffe.HelperConfig == "" {
+		t.Fatal("CompiledDefaults().Spiffe.HelperConfig must not be empty")
+	}
+	if !strings.Contains(cfg.Spiffe.HelperConfig, "agent_address") {
+		t.Error("HelperConfig must contain agent_address")
+	}
+	if !strings.Contains(cfg.Spiffe.HelperConfig, "svid_file_name") {
+		t.Error("HelperConfig must contain svid_file_name")
+	}
+}
+
+func TestSpiffeHelperConfig_YAMLRoundTrip(t *testing.T) {
+	input := `
+spiffe:
+  trustDomain: example.org
+  socketPath: "unix:///custom/socket.sock"
+  helperConfig: |
+    agent_address = "/custom/socket.sock"
+    cmd = ""
+`
+	var cfg PlatformConfig
+	if err := yaml.Unmarshal([]byte(input), &cfg); err != nil {
+		t.Fatalf("YAML unmarshal failed: %v", err)
+	}
+	if cfg.Spiffe.TrustDomain != "example.org" {
+		t.Errorf("TrustDomain = %q, want example.org", cfg.Spiffe.TrustDomain)
+	}
+	if !strings.Contains(cfg.Spiffe.HelperConfig, "agent_address") {
+		t.Error("HelperConfig not loaded from YAML")
+	}
+}
+
+func TestDeepCopy_PreservesHelperConfig(t *testing.T) {
+	cfg := CompiledDefaults()
+	cfg.Spiffe.HelperConfig = "custom_helper_config"
+
+	copied := cfg.DeepCopy()
+	if copied.Spiffe.HelperConfig != "custom_helper_config" {
+		t.Errorf("DeepCopy lost HelperConfig: got %q", copied.Spiffe.HelperConfig)
+	}
+}