✨ Feat: Add SPIRE x5c init-container signing, trust-domain binding, and ConfigMap trust bundle

[kevincogan]

Summary

Implements automated AgentCard signing via a SPIRE init-container and replaces the legacy signature verification infrastructure with an X.509 certificate chain (x5c) based approach.

Key changes:

• Remove deprecated providers: Drop SecretProvider, JWKSProvider, NoOpProvider, legacy samples, unused images, and helper scripts.

• Add X5CProvider: X.509 certificate chain-based JWS signature verification with SPIFFE ID extraction from SAN URIs, trust bundle caching via ConfigMap, chain depth limits, and automatic bundle refresh.

• Refactor AgentCard controller: Replace allowedSpiffeIDs manual allowlist with trust domain only identity binding derived from x5c certificate SAN URIs. Add proactive SVID expiry restart logic with bundle-hash and resign-trigger annotations.

• Add agentcard-signer init-container: Binary that fetches X.509-SVID from SPIRE Workload API, signs AgentCard JSON with JWS (x5c header), and writes the signed card to a shared volume.

• Wire operator flags: Add CLI flags for --spire-trust-bundle-configmap, --spire-trust-domain, and --svid-expiry-grace-period with startup validation. Harden fetcher with io.LimitReader (1 MiB cap).

• Update Helm chart and CRDs: Regenerate CRD schemas removing allowedSpiffeIDs, update manager deployment args for ConfigMap trust bundle and SVID grace period.

• Update documentation: Revise signature verification, identity binding, architecture, and API reference docs for the new x5c/SPIRE model.

Related issue(s)

Fixes #179
Related #116

(Optional) Testing Instructions

1. Unit tests — all pass.
2. End-To-End Testing: all pass.

[usize]

nit: looks like we need to run go fmt

And finally, a request. This looks great, but the sample-config might confuse folks. I cheated and asked an LLM to help me hone in on the details:

  1. image: weather-agent:latest — this image doesn't exist in any registry. Should this be
  ghcr.io/kagenti/agent-examples/weather_service:v0.0.1-alpha.3 (as used in GETTING_STARTED.md), or does it need a real static-file-server
  image that serves /.well-known/agent.json?
  2. image: kagenti/agentcard-signer:latest — not published anywhere. It needs to be built from cmd/agentcard-signer/ and loaded into the
  cluster, but there are no instructions for this.
  3. No namespace creation — everything targets namespace: agents but nothing creates it (not in the manifests or the kustomization).
  4. Missing ClusterSPIFFEID — the a2a-signature-verification.md doc lists this as a prerequisite (step 1), but it's not included in the
  sample. Without it the init-container will crash because SPIRE won't issue an SVID.
  5. Operator flag configuration not covered — the operator needs --require-a2a-signature=true and --spire-trust-domain=<domain> to verify
  signatures, but there's no guidance on how to set these (e.g., Helm values).

The basic idea, is that I think we need to be explicit about e.g. requiring a kagenti dev install via kagenti/deployments/run_install.sh --env dev (in the Kagenti repo) and to add to the makefile in the project to build and add the agent signature container locally maybe? Or we could do it with a setup.sh and teardown.sh script.

That's the approach I've been taking e.g., here in AuthBridge in this demo I added: https://github.com/kagenti/kagenti-extensions/tree/main/AuthBridge/demos/multi-target

If we could add a working demo like that, that works with a fresh dev install of kagenti to a local kind cluster it would likely be a big help and we could use it to demo the cool new feature.

Otherwise, this is great. Ready to approve after hearing your thoughts about adding a slightly easier-to-run demo.

[usize]

nit: I think this is now config/samples/signed-agent-example ?

[kevincogan]

Thanks for the thorough review! All points addressed and a lot cleaner now:

1. go fmt: Fixed across all changed files.

2. Sample config issues: Removed config/samples/signed-agent-example/ entirely and replaced it with four self-contained demos in demos/ following the AuthBridge convention (demo.md + run-demo-commands.sh + teardown-demo.sh + k8s/ manifests):

   • agentcard-spire-signing: Full init-container signing flow with namespace, ClusterSPIFFEID, and operator flag documentation

   • agentcard-enforcement: Trust domain rejection and NetworkPolicy enforcement

   • agentcard-auto-discovery: Sync controller auto-creating AgentCards for labeled workloads

   • agentcard-proactive-restart: SVID expiry detection triggering automatic re-signing

     Each demo is runnable end-to-end against a fresh kagenti/deployments/run_install.sh --env dev install. Added make build-signer and make load-signer-image targets for the init-container image.

3. Stale path: Fixed. The old docs are replaced with agentcard-signature-verification.md and agentcard-identity-binding.md, all cross-references updated.

   Also cleaned up dead Secret setup in the signature verification tests (leftover from the removed SecretProvider).