Summary
The ensurePerAgentConfigMap() function now injects/scrubs the spiffe: block based on spireEnabled, while synthesizePipeline() sets identity.type=spiffe based on ClientAuthType == "federated-jwt". These two decisions are currently kept in lockstep by the mTLS-baseline auto-enable (pod_mutator.go:290), but they could diverge during the kagenti-extensions → operator webhook migration.
If a workload's effective config carries identity.type: spiffe while spireEnabled=false, the spiffe: block will be stripped, producing a startup crash ("spiffe identity requires a SPIFFE provider to be injected").
Suggested fix
Add a defensive check: if the synthesized pipeline contains identity.type=spiffe, force spireEnabled=true for the spiffe: block injection, or log a warning about the mismatch.
Context
Summary
The
ensurePerAgentConfigMap()function now injects/scrubs thespiffe:block based onspireEnabled, whilesynthesizePipeline()setsidentity.type=spiffebased onClientAuthType == "federated-jwt". These two decisions are currently kept in lockstep by the mTLS-baseline auto-enable (pod_mutator.go:290), but they could diverge during the kagenti-extensions → operator webhook migration.If a workload's effective config carries
identity.type: spiffewhilespireEnabled=false, thespiffe:block will be stripped, producing a startup crash ("spiffe identity requires a SPIFFE provider to be injected").Suggested fix
Add a defensive check: if the synthesized pipeline contains
identity.type=spiffe, forcespireEnabled=truefor thespiffe:block injection, or log a warning about the mismatch.Context