feat: Generate per-agent ConfigMap for authbridge at injection time

[huang195]

Summary

• Operator creates a per-agent ConfigMap (authbridge-config-<name>) at pod injection time
• Reads the namespace-level authbridge-runtime-config, merges in mode + per-agent listener addresses
• Authbridge sidecar mounts the per-agent ConfigMap instead of the shared one
• Removes REVERSE_PROXY_ADDR, REVERSE_PROXY_BACKEND, FORWARD_PROXY_ADDR env vars and --mode flag from the proxy-sidecar container (all now in the per-agent ConfigMap)

Context

Listener addresses are per-agent (port-stealing assigns dynamic ports) but the shared ConfigMap is per-namespace. Previously we used ${ENV_VAR} placeholders in the shared ConfigMap, which broke validation when env vars were unset in other modes.

The three-layer ConfigMap flow:

1. Helm creates authbridge-runtime-config per namespace (defaults)
2. Backend creates authbridge-runtime-config for runtime namespaces (same defaults)
3. Operator reads it at injection, merges per-agent config, writes authbridge-config-<agent>

Files changed

File	Change
namespace_config.go	Read authbridge-runtime-config ConfigMap
resolved_config.go	Propagate AuthBridgeRuntimeYAML
pod_mutator.go	ensurePerAgentConfigMap() + call sites for both modes
volume_builder.go	Parameterize authbridge ConfigMap name, overrideAuthBridgeConfigMapInVolumes
container_builder.go	Remove listener env vars and --mode from proxy-sidecar
*_test.go	Updated tests for new behavior

Test plan

• go test ./internal/webhook/injector/ — all pass
• go vet — clean
• gofmt — clean
• E2E: deploy agent with default mode → per-agent ConfigMap with mode: envoy-sidecar
• E2E: deploy with kagenti.io/authbridge-mode=proxy-sidecar → per-agent ConfigMap with listener addresses

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

[esnible]

I asked Claude about this PR, and it believes there are problems:

⏺ Found a critical issue — the RBAC is missing the patch verb for configmaps, but server-side apply uses Patch. Let me verify what the kubebuilder
  marker generates and what the Helm chart has.                                                                                                                                                                                                         
                                                                                          
⏺ The RBAC is missing patch in both the kubebuilder marker, the kustomize role.yaml, and the Helm role.yaml. Server-side apply (client.Patch)      
  requires the patch verb. This is a must-fix bug.  

[pdettori]

Summary

Solid PR. The design is clean: lifting per-agent concerns out of the shared ConfigMap into a dedicated authbridge-config-<name> CM at injection time is the right call, and the progression from Get→Create/Update → AlreadyExists handling → server-side apply shows good iterative thinking. The uncached APIReader fix (commit 6b305bf) is the kind of subtle cache-scope bug that usually only surfaces in production — good catch.

Areas reviewed: Go (injector), Helm RBAC, kustomize RBAC, unit tests, E2E tests
Commits: 18 commits, all signed-off ✓
CI status: All checks pass (Build, E2E, Unit, Integration, Lint, CodeQL, Trivy) ✓

Approve with two suggestions and one nit below.

[pdettori]

Suggestion: buildOwnerReference doesn't set Controller: true or BlockOwnerDeletion: true. GC works without these, but K8s convention is to mark the primary managing controller with controller=true. Without it, a second controller could also set a controller OwnerReference on this CM (K8s only rejects a second controller=true reference, not a second controller=nil/false one).

Suggested change for both Deployment and StatefulSet paths:

WithController(ptr.To(true)).
WithBlockOwnerDeletion(ptr.To(true))

[pdettori]

Suggestion: requiredVolumes is only set inside the PerWorkloadConfigResolution block (a few lines up). If PerWorkloadConfigResolution=false and proxy-sidecar mode is active, requiredVolumes is nil here — overrideAuthBridgeConfigMapInVolumes returns an empty slice and the per-agent CM name never makes it into the injected volumes.

If proxy-sidecar always requires PerWorkloadConfigResolution=true (i.e. the scenario isn't reachable in practice), a short comment here prevents future confusion:

// requiredVolumes is set in the PerWorkloadConfigResolution branch above;
// proxy-sidecar mode always requires that gate.

Otherwise, the volume override should also cover the non-resolved path.

[pdettori]

Nit: CM name constructed by hand. If the test agent name changes this silently diverges. Since perAgentConfigMapName is unexported, consider a helper constant:

const testAgentCMName = "authbridge-config-" + authBridgeAgentName