bug: inbound JWT validation broken in federated-jwt mode (client-id.txt never written)

[Alan-Cha]

Problem

When CLIENT_AUTH_TYPE=federated-jwt, agent pods reject all authenticated inbound requests with HTTP 503:

identity not yet configured (credentials pending)

The authbridge-proxy sidecar polls indefinitely for /shared/client-id.txt and logs:

credential file still not available path=/shared/client-id.txt waited=4h12m0s

Root cause

PR #476 correctly skips writing client-secret.txt in federated-jwt mode — agents authenticate outbound via JWT-SVID, so no Keycloak client secret is needed. However, the change skipped the entire ensureClientCredentialsSecret call, which also writes client-id.txt. It also skipped patchTemplate, so the credential Secret is never mounted into the pod at all.

client-id.txt is read by the authbridge inbound jwt-validation plugin to determine the expected audience when validating JWTs on incoming requests. Without it, the plugin stays in its init loop forever and rejects all inbound traffic with 503.

The broken chain in federated-jwt mode:

1. ensureClientCredentialsSecret skipped → no Secret, no client-id.txt
2. patchTemplate skipped → no Secret annotation on pod template
3. Webhook skips pre-populating the annotation → Secret never mounted

Fix

In ensureClientCredentialsSecret, make client-secret.txt conditional:

if clientSecret != "" {
    sec.StringData["client-secret.txt"] = clientSecret
}
sec.StringData["client-id.txt"] = clientID

In the controller reconcile loop, remove the authType != "federated-jwt" guard so both ensureClientCredentialsSecret (called with empty clientSecret) and patchTemplate still run in federated-jwt mode. The resulting Secret contains only client-id.txt (the agent's SPIFFE ID), which is all the inbound validator needs.

Impact

All agent deployments with CLIENT_AUTH_TYPE=federated-jwt — inbound requests return 503 until this is fixed.

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com