feat: mode-aware image selection and proxy-sidecar injection by huang195 · Pull Request #295 · kagenti/kagenti-operator

huang195 · 2026-04-17T23:44:49Z

Summary

Add authbridge deployment mode support with three modes controlled by the kagenti.io/authbridge-mode annotation:

Mode	Image	How it works	Size
`envoy-sidecar` (default)	authbridge-envoy	iptables + Envoy + ext_proc	140 MB
`proxy-sidecar`	authbridge-light	HTTP_PROXY env vars	29 MB
`waypoint`	authbridge-light	Standalone (stub, skips injection)	29 MB

Changes

Add AuthBridgeLight image field to ImageConfig
Update default EnvoyProxy image from authbridge-unified to authbridge-envoy
Add AnnotationAuthBridgeMode annotation and mode constants
Add BuildProxySidecarContainer to container builder
Mode-aware injection in pod_mutator.go:
- envoy-sidecar: unchanged (iptables + Envoy + ext_proc)
- proxy-sidecar: inject authbridge-light + HTTP_PROXY/HTTPS_PROXY/NO_PROXY env vars into app containers
- waypoint: skip injection (log and return)
Add injectHTTPProxyEnv and envExists helpers

Proxy-sidecar mode (from Klaviger pattern)

Based on the Klaviger sidecar proxy pattern. The app container gets HTTP_PROXY=http://127.0.0.1:8081 injected, so standard HTTP clients automatically route outbound traffic through authbridge. No iptables or proxy-init needed.

Test plan

go build ./... passes
go test ./internal/webhook/injector/... passes
go test ./internal/webhook/config/... passes
E2E: default mode (envoy-sidecar) works unchanged
Manual: annotate deployment with kagenti.io/authbridge-mode: proxy-sidecar, verify authbridge-light injected with HTTP_PROXY env vars

Depends on kagenti/kagenti-extensions v0.5.0-alpha.4 (authbridge-envoy + authbridge-light images).

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

Add authbridge deployment mode annotation (kagenti.io/authbridge-mode) with three modes: - envoy-sidecar (default): iptables + Envoy + ext_proc using authbridge-envoy image. Unchanged from current behavior. - proxy-sidecar: lightweight authbridge-light image (29 MB) with HTTP_PROXY/HTTPS_PROXY env vars injected into app containers. No iptables, no proxy-init, no Envoy. App routes outbound traffic through authbridge forward proxy on localhost:8081. - waypoint: standalone deployment (not a sidecar). Skips injection. Also updates default images from authbridge-unified to authbridge-envoy and adds authbridge-light image field to ImageConfig. Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Hai Huang <huang195@gmail.com>

pdettori

/lgtm

nvm

pdettori

Well-structured PR that adds three authbridge deployment modes behind an opt-in annotation. The envoy-sidecar default path is unchanged, proxy-sidecar mode correctly injects the lightweight container + HTTP_PROXY env vars into all app containers, and waypoint mode cleanly short-circuits injection. All 16 CI checks pass including E2E and unit tests.

The main gap is the absence of new unit tests in the diff — the existing pod_mutator_test.go and container_builder_test.go should cover the new modes.

Areas reviewed: Go (injector, config), Security
Commits: 1 commit, signed-off ✓, Assisted-By trailer ✓
CI status: all 16 checks passing

Verdict: COMMENT — no must-fix issues, one suggestion for test coverage.

pdettori · 2026-04-18T01:41:56Z

+
+	// ========================================
+	// Envoy-sidecar mode (default)
+	// ========================================


suggestion: No unit tests in the diff for the new proxy-sidecar mode. pod_mutator_test.go and container_builder_test.go both exist — consider adding cases for:

proxy-sidecar mode injects authbridge-proxy container + HTTP_PROXY env vars into app containers

waypoint mode returns early with no mutation (false, nil)

injectHTTPProxyEnv doesn't duplicate existing env vars

BuildProxySidecarContainer with/without SPIRE enabled

The mode-aware branching logic is the core of this PR, so test coverage here would be high-value.

pdettori · 2026-04-18T01:41:56Z

+			RunAsNonRoot:             ptr.To(true),
+			AllowPrivilegeEscalation: ptr.To(false),
+		},
+		VolumeMounts: volumeMounts,


nit: Resources: b.cfg.Resources.EnvoyProxy — consistent with existing builders, but since authbridge-light is ~5× smaller (29 MB vs 140 MB), a follow-up could add an AuthBridgeLight resource config so operators can tune memory/CPU independently for the lightweight variant.

pdettori · 2026-04-18T01:41:56Z

+		// spiffe-helper and client-registration are still injected
+		if decision.SpiffeHelper.Inject && !containerExists(podSpec.Containers, SpiffeHelperContainerName) {
+			podSpec.Containers = append(podSpec.Containers, builder.BuildSpiffeHelperContainer())
+		}


praise: Clean mode-aware branching — proxy-sidecar properly re-uses the shared volume/SPIRE/client-registration infrastructure while stripping iptables and Envoy. Good idempotency via containerExists and envExists checks. The injectHTTPProxyEnv helper correctly skips the authbridge container itself.

pdettori

/LGTM
Approving - up to you if you'd like to add the tests

- TestBuildProxySidecarContainer with/without SPIRE - TestInjectAuthBridge_WaypointMode_SkipsInjection - TestInjectAuthBridge_ProxySidecarMode_InjectsCorrectly - TestInjectHTTPProxyEnv_DoesNotDuplicate Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Hai Huang <huang195@gmail.com>

huang195 · 2026-04-18T13:42:47Z

test cases are added. Thanks @pdettori.

- Chart.yaml: subchart 0.2.0-alpha.27 -> 0.2.0-alpha.28 - values.yaml: operator image 0.2.0-alpha.27 -> 0.2.0-alpha.28 - Rename authbridge-unified-config ConfigMap to authbridge-config - Add listener section with env var placeholders for proxy-sidecar mode: reverse_proxy_addr, reverse_proxy_backend, forward_proxy_addr - These are expanded via ${...} when the operator injects env vars for proxy-sidecar mode; ignored in envoy-sidecar mode Depends on: - kagenti/kagenti-operator#295 (mode-aware images) - kagenti/kagenti-operator#296 (port-stealing) Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Hai Huang <huang195@gmail.com>

- Chart.yaml: subchart 0.2.0-alpha.27 -> 0.2.0-alpha.28 - values.yaml: operator image 0.2.0-alpha.27 -> 0.2.0-alpha.28 - Rename authbridge-unified-config ConfigMap to authbridge-runtime-config (authbridge-config is already used by the flat key-value ConfigMap) - Add listener section with env var placeholders for proxy-sidecar mode Depends on: - kagenti/kagenti-operator#295 (mode-aware images) - kagenti/kagenti-operator#296 (port-stealing + rename) Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Hai Huang <huang195@gmail.com>

huang195 requested a review from a team as a code owner April 17, 2026 23:44

rubambiza added this to Kagenti Issue Prioritization Apr 17, 2026

github-project-automation Bot moved this to Backlog in Kagenti Issue Prioritization Apr 17, 2026

pdettori previously approved these changes Apr 18, 2026

View reviewed changes

pdettori reviewed Apr 18, 2026

View reviewed changes

pdettori approved these changes Apr 18, 2026

View reviewed changes

huang195 merged commit e858f26 into main Apr 18, 2026
15 checks passed

github-project-automation Bot moved this from Backlog to Done in Kagenti Issue Prioritization Apr 18, 2026

huang195 deleted the feat/mode-aware-images branch April 18, 2026 13:42

huang195 mentioned this pull request Apr 18, 2026

Upgrade operator to v0.2.0-alpha.30 with proxy-sidecar fixes and debug logging kagenti/kagenti#1278

Merged

3 tasks

huang195 mentioned this pull request Apr 20, 2026

Use SPIRE Workload API directly instead of spiffe-helper sidecar kagenti/kagenti-extensions#332

Open

clawgenti mentioned this pull request Apr 20, 2026

Weekly Report 2026-04-20 kagenti/kagenti#1286

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: mode-aware image selection and proxy-sidecar injection#295

feat: mode-aware image selection and proxy-sidecar injection#295
huang195 merged 2 commits intomainfrom
feat/mode-aware-images

huang195 commented Apr 17, 2026

Uh oh!

pdettori left a comment

Uh oh!

pdettori left a comment

Uh oh!

pdettori Apr 18, 2026

Uh oh!

pdettori Apr 18, 2026

Uh oh!

pdettori Apr 18, 2026

Uh oh!

pdettori left a comment

Uh oh!

Uh oh!

huang195 commented Apr 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

huang195 commented Apr 17, 2026

Summary

Changes

Proxy-sidecar mode (from Klaviger pattern)

Test plan

Uh oh!

pdettori left a comment

Choose a reason for hiding this comment

Uh oh!

pdettori left a comment

Choose a reason for hiding this comment

Uh oh!

pdettori Apr 18, 2026

Choose a reason for hiding this comment

Uh oh!

pdettori Apr 18, 2026

Choose a reason for hiding this comment

Uh oh!

pdettori Apr 18, 2026

Choose a reason for hiding this comment

Uh oh!

pdettori left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

huang195 commented Apr 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants