Feature Description
The AgentCard Identity Binding and Signature Verification features (introduced in #176) currently include selector based fallback paths for backward compatibility with the legacy Agent CRD. This creates dual code paths in the controllers, webhooks, and tests that add complexity and maintenance burden.
The selector approach is deprecated in favor of targetRef, which directly references Deployments/StatefulSets. Keeping both paths makes the code harder to reason about and delays the broader targetRef migration tracked in #161.
Proposed Solution
Remove all selector based fallback logic from the identity binding and signature verification features so they exclusively use targetRef for workload resolution. Specifically:
-
agentcard_controller.go: Remove selector fallback from getWorkload(), delete findMatchingWorkloadBySelector and related helpers
-
agentcard_networkpolicy_controller.go: Remove selector fallback from resolveWorkload()
-
agentcardsync_controller.go: Remove selector to targetRef migration logic and selector based duplicate detection
-
agentcard_webhook.go: Enforce targetRef as required, remove selector validation
-
cmd/main.go: Default --enable-legacy-agent-crd to false
-
Tests: Migrate all identity binding and signature verification tests from Agent CRD + selector to Deployment + targetRef
-
Docs: Update identity-binding-quickstart.md and a2a-signature-verification.md to use targetRef exclusively
Scope note: This refactor only touches the code paths added by #176 (identity binding + signature verification). It does not remove the core legacy Agent CRD support from the broader codebase that is tracked separately in #161 / #168.
Want to contribute?
Additional Context
Feature Description
The AgentCard Identity Binding and Signature Verification features (introduced in #176) currently include
selectorbased fallback paths for backward compatibility with the legacyAgentCRD. This creates dual code paths in the controllers, webhooks, and tests that add complexity and maintenance burden.The
selectorapproach is deprecated in favor oftargetRef, which directly references Deployments/StatefulSets. Keeping both paths makes the code harder to reason about and delays the broadertargetRefmigration tracked in #161.Proposed Solution
Remove all
selectorbased fallback logic from the identity binding and signature verification features so they exclusively usetargetReffor workload resolution. Specifically:agentcard_controller.go: Removeselectorfallback fromgetWorkload(), deletefindMatchingWorkloadBySelectorand related helpersagentcard_networkpolicy_controller.go: Removeselectorfallback fromresolveWorkload()agentcardsync_controller.go: RemoveselectortotargetRefmigration logic andselectorbased duplicate detectionagentcard_webhook.go: EnforcetargetRefas required, removeselectorvalidationcmd/main.go: Default--enable-legacy-agent-crdtofalseTests: Migrate all identity binding and signature verification tests from
AgentCRD +selectortoDeployment+targetRefDocs: Update
identity-binding-quickstart.mdanda2a-signature-verification.mdto usetargetRefexclusivelyWant to contribute?
Additional Context
targetRefmigration), Deprecate Agent CRD Support #168 (remove legacy Agent CRD)refactor/targetref-migration(already implemented, pending ✨ A2A AgentCard Signature Verification #176 merge)