fix: reconcile ownership label before content-equality check

Address PR review feedback:
- Label reconciliation now runs before content comparison so leftover
  CMs from the old static-template path get their managed-by label
  adopted even when content already matches PlatformConfig.
- Add prod/OpenShift override note to DefaultSpiffeHelperConfig.
- Add test for label adoption on leftover CMs.

RHAIENG-4939

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Ian Miller <milleryan2003@gmail.com>

Author: r3v5

kagenti-operator/internal/controller/agentruntime_controller.go

@@ -1082,15 +1082,21 @@ func (r *AgentRuntimeReconciler) ensureSpiffeHelperConfigMap(ctx context.Context
 		return fmt.Errorf("failed to check spiffe-helper-config in %s: %w", namespace, err)
 	}
 
-	if existing.Data["helper.conf"] == cfg.Spiffe.HelperConfig {
-		return nil
-	}
+	needsUpdate := existing.Data["helper.conf"] != cfg.Spiffe.HelperConfig
 
-	existing.Data = desired.Data
 	if existing.Labels == nil {
 		existing.Labels = make(map[string]string)
 	}
-	existing.Labels[LabelManagedBy] = LabelManagedByValue
+	if existing.Labels[LabelManagedBy] != LabelManagedByValue {
+		existing.Labels[LabelManagedBy] = LabelManagedByValue
+		needsUpdate = true
+	}
+
+	if !needsUpdate {
+		return nil
+	}
+
+	existing.Data = desired.Data
 	if err := r.Update(ctx, existing); err != nil {
 		return fmt.Errorf("failed to update spiffe-helper-config in %s: %w", namespace, err)
 	}

kagenti-operator/internal/controller/agentruntime_controller_test.go

@@ -897,6 +897,32 @@ var _ = Describe("AgentRuntime Controller", func() {
 			Expect(result.Data["helper.conf"]).To(Equal("same_content"))
 		})
 
+		It("should adopt label on leftover CM with matching content", func() {
+			existing := &corev1.ConfigMap{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "spiffe-helper-config",
+					Namespace: shTestNS,
+					Labels:    map[string]string{"app.kubernetes.io/managed-by": "kustomize"},
+				},
+				Data: map[string]string{"helper.conf": "same_content"},
+			}
+			Expect(k8sClient.Create(ctx, existing)).To(Succeed())
+
+			r := newReconciler()
+			r.GetPlatformConfig = func() *webhookconfig.PlatformConfig {
+				cfg := webhookconfig.CompiledDefaults()
+				cfg.Spiffe.HelperConfig = "same_content"
+				return cfg
+			}
+
+			Expect(r.ensureSpiffeHelperConfigMap(ctx, shTestNS)).To(Succeed())
+
+			result := &corev1.ConfigMap{}
+			Expect(k8sClient.Get(ctx, types.NamespacedName{Name: "spiffe-helper-config", Namespace: shTestNS}, result)).To(Succeed())
+			Expect(result.Data["helper.conf"]).To(Equal("same_content"))
+			Expect(result.Labels[LabelManagedBy]).To(Equal(LabelManagedByValue))
+		})
+
 		It("should use CompiledDefaults when GetPlatformConfig is nil", func() {
 			r := newReconciler()
 			Expect(r.ensureSpiffeHelperConfigMap(ctx, shTestNS)).To(Succeed())

kagenti-operator/internal/webhook/config/defaults.go

@@ -7,6 +7,9 @@ import (
 
 // DefaultSpiffeHelperConfig is the default helper.conf content for spiffe-helper.
 // Keep in sync with charts/kagenti-operator/values.yaml defaults.spiffe.helperConfig.
+// The jwt_audience below targets a local dev Keycloak. Production and OpenShift
+// deployments MUST override this via Helm values (defaults.spiffe.helperConfig)
+// to set the in-cluster Keycloak audience.
 const DefaultSpiffeHelperConfig = `agent_address = "/spiffe-workload-api/spire-agent.sock"
 cmd = ""
 cmd_args = ""