Feat: default mTLS to permissive and enable card discovery by varshaprasad96 · Pull Request #408 · rossoctl/operator

varshaprasad96 · 2026-06-05T22:48:45Z

Summary

Default mTLSMode to permissive so agents get mTLS automatically when SPIRE is available
Enable --enable-card-discovery and --enable-verified-fetch by default
Treat empty mTLSMode as permissive across all resolution paths (envoy template, pod mutator, resolved config) for consistency with existing CRs
Add deprecation warnings for legacy JWS signing flags
Add startup logs for upgrade visibility

Spec

Implements Phase 1 tasks (T001-T004) from spec: mTLS transport security (#401)

Changes

File	Change
`api/v1alpha1/agentruntime_types.go`	`+kubebuilder:default=permissive` on MTLSMode, `ConditionTypeMTLSReady` constant
`cmd/main.go`	Flip flag defaults, add deprecation warnings, add startup logs
`internal/webhook/injector/envoy_template.go`	Treat empty MTLSMode as permissive
`internal/webhook/injector/pod_mutator.go`	Default fallback from disabled to permissive
`internal/webhook/injector/resolved_config.go`	Update comment for new default
`internal/webhook/injector/*_test.go`	Update tests for new default behavior
`config/crd/bases/`, `charts/`	Regenerated CRD manifests

Test plan

All 17 test packages pass (make test)
CRD schema shows default: permissive for mtlsMode
Code review (correctness + cleanup) completed — C1 and C2 findings fixed
E2E: deploy agents with SPIRE, verify mTLS is active by default
E2E: deploy agents without SPIRE, verify graceful fallback with warning logs

Jira: RHAIENG-4944

🤖 Generated with Claude Code

varshaprasad96 · 2026-06-05T22:49:50Z

/hold

This PR introduces permissive mode for easier migration to use mTLS. Follow up after spec is merged: #401

cc: @r3v5 @akram

cwiklik

Well-executed default flip implementing Phase 1 of the mTLS spec (#401): permissive becomes the default mTLS posture (kubebuilder marker + consistent empty→permissive handling across the envoy template, pod mutator, and resolved config), card-discovery and verified-fetch default on (with documented kill switches), plus deprecation warnings for legacy JWS flags and upgrade-visibility startup logs. CRD manifests are regenerated in both config/crd/bases/ and charts/crds/ identically — good hygiene. Code logic is correct and the doc comments accurately describe the new-CR vs existing-CR resolution.

Security: net improvement (mTLS on by default). The main risk is operational (upgrade rollout + SPIRE dependency), not a vulnerability — see comment #1.

Tests: pass, but missing a positive assertion for the new empty→permissive default (comment #2).

CI: 15 green; E2E still running, and the two new E2E scenarios (with/without SPIRE) are unchecked — worth landing those before merge given the fleet-wide rollout.

Commits: signed-off. Nits: subject lacks the emoji prefix the convention favors; and the PR body uses "🤖 Generated with Claude Code" — Kagenti's convention is Assisted-By: Claude Code, never "Generated with."

Approving — the code is correct; the upgrade-impact verification (comment #1) is strongly recommended before merge.

cwiklik · 2026-06-08T13:36:46Z

 	// process start).
 	//
 	// +optional
+	// +kubebuilder:default=permissive


suggestion: This default flip has a notable upgrade impact worth surfacing. Per the field doc, mtlsMode != disabled auto-enables SPIRE and changing the mode triggers a pod rollout. So on operator upgrade, every existing AgentRuntime with an unset mtlsMode flips empty→permissive → SPIRE auto-enabled + pod rollout, fleet-wide. permissive is designed to be safe (accepts/falls back to plaintext), but on clusters without SPIRE this relies entirely on graceful fallback — and the "deploy without SPIRE, verify graceful fallback" E2E box is still unchecked in the test plan. Recommend verifying the no-SPIRE path before merge and calling out the rollout + SPIRE auto-enable in release notes / a prominent startup log (the existing startup logs cover card-discovery/verified-fetch but not the mTLS default change).

cwiklik · 2026-06-08T13:36:46Z

 			"namespace", namespace, "crName", crName,
 			"unrecognized", mtlsMode, "source", mtlsSource)
-		mtlsMode = MTLSModeDisabled
+		mtlsMode = MTLSModePermissive


nit: The defense-in-depth fallback for an unrecognized mtlsMode flips from disabled to permissive. Reasonable under the "mTLS by default" theme (fails secure rather than open), but note a garbage value now also pulls in SPIRE — fine given the CRD enum rejects unknowns at admission, just a conscious posture change worth a line in the commit/PR rationale.

pdettori · 2026-06-09T01:17:17Z

let's set it to draft until ready to merge

Change mTLS default from disabled to permissive so agents get mTLS automatically when SPIRE is available. Enable card discovery and verified fetch by default. Add deprecation warnings for legacy JWS signing flags. Changes: - Add +kubebuilder:default=permissive on MTLSMode field - Add ConditionTypeMTLSReady and AnnotationMTLSMode constants - Set kagenti.io/mtls-mode annotation on pod template in controller - Set MTLS_MODE env var on authbridge containers in webhook - Treat empty MTLSMode as permissive across all resolution paths (controller, pod mutator, envoy template, resolved config) - Flip --enable-card-discovery and --enable-verified-fetch to true - Add startup deprecation warnings for legacy signing flags - Clean up mtls-mode annotation on AgentRuntime deletion - Update tests for new default behavior Jira: RHAIENG-4944 Signed-off-by: Varsha Prasad Narsing <varshaprasad96@gmail.com> Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>

E2E authbridge tests were failing because the mTLS default changed from disabled to permissive. The envoy-proxy container crash-looped as the envoy template now renders TLS contexts by default, but the E2E test fixtures aren't configured for full mTLS infrastructure. Set mtlsMode: disabled explicitly on both authbridge-agent and authbridge-disabled-agent AgentRuntime fixtures to preserve the existing test behavior. These tests validate sidecar injection, not mTLS transport. Signed-off-by: Varsha Prasad Narsing <varshaprasad96@gmail.com> Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>

varshaprasad96 · 2026-06-12T21:02:40Z

The PR has been updated with changes in #405 and is ready to be reviewed.

r3v5

lgtm, thanks!

pdettori

Approving — code is correct, CI is fully green, CRD regenerated identically in both config/crd/bases/ and charts/crds/, and the dependency spec (#401) and config-merge update (#405) are both merged.

Follow-up (non-blocking): The no-SPIRE graceful-fallback E2E path is still unverified. The default flip means existing AgentRuntimes with an unset mtlsMode go empty→permissive on upgrade, auto-enabling SPIRE + a pod rollout fleet-wide. On clusters without SPIRE this relies entirely on graceful fallback (per @cwiklik's comment #1, and the test-plan box deploy without SPIRE, verify graceful fallback is still unchecked). Please track this as a follow-up — verify the no-SPIRE path and/or call out the upgrade rollout + SPIRE auto-enable in release notes.

Minor cleanups also worth a follow-up: PR body uses 🤖 Generated with Claude Code (Kagenti convention is Assisted-By: Claude Code), and there is no startup log specifically for the mTLS default flip (only card-discovery / verified-fetch are logged).

- Clarify kagenti backend/UI is upstream-only, not midstream product - Note RHOAI agent views are built by dashboard team (ODH Dashboard AAA page) - Update AgentCard flow: JWS verification deprecated in favor of mTLS transport security (rossoctl/operator#408) - Clarify which repos are relevant for midstream strategies Co-reviewed-by: Varsha Prasad Narsing Assisted-By: 🤖 Claude Code Signed-off-by: Roland Huß <rhuss@redhat.com>

varshaprasad96 requested a review from a team as a code owner June 5, 2026 22:48

clawgenti mentioned this pull request Jun 8, 2026

Weekly Report 2026-06-08 rossoctl/rossoctl#1840

Closed

cwiklik approved these changes Jun 8, 2026

View reviewed changes

cwiklik mentioned this pull request Jun 8, 2026

Feature: 2-layer config merge for AgentRuntime controller #405

Merged

4 tasks

pdettori marked this pull request as draft June 9, 2026 01:17

varshaprasad96 force-pushed the feat/mtls-defaults branch from c3aca86 to e3a0491 Compare June 12, 2026 04:18

varshaprasad96 marked this pull request as ready for review June 12, 2026 04:28

varshaprasad96 changed the title ~~feat: default mTLS to permissive and enable card discovery~~ Feat: default mTLS to permissive and enable card discovery Jun 12, 2026

clawgenti mentioned this pull request Jun 15, 2026

Weekly Report 2026-06-15 rossoctl/rossoctl#1971

Closed

r3v5 approved these changes Jun 15, 2026

View reviewed changes

pdettori approved these changes Jun 15, 2026

View reviewed changes

pdettori merged commit b93c5cf into rossoctl:main Jun 15, 2026
16 of 17 checks passed

varshaprasad96 mentioned this pull request Jun 15, 2026

Add overlay 0014: Kagenti agent operator architecture opendatahub-io/architecture-context#30

Merged

akram mentioned this pull request Jun 16, 2026

Bug: SharedTrust and MLflow controllers block all reconciliation when RBAC is missing #440

Open

clawgenti mentioned this pull request Jun 16, 2026

Weekly Report 2026-06-16 (test) rossoctl/rossoctl#1989

Closed

akram mentioned this pull request Jun 17, 2026

Pipeline token-exchange missing jwt_audience/jwt_svid_path when identity.type=spiffe #443

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Feat: default mTLS to permissive and enable card discovery#408

Feat: default mTLS to permissive and enable card discovery#408
pdettori merged 2 commits into
rossoctl:mainfrom
varshaprasad96:feat/mtls-defaults

varshaprasad96 commented Jun 5, 2026

Uh oh!

varshaprasad96 commented Jun 5, 2026

Uh oh!

cwiklik left a comment

Uh oh!

cwiklik Jun 8, 2026

Uh oh!

Uh oh!

cwiklik Jun 8, 2026

Uh oh!

pdettori commented Jun 9, 2026

Uh oh!

varshaprasad96 commented Jun 12, 2026

Uh oh!

r3v5 left a comment

Uh oh!

pdettori left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

varshaprasad96 commented Jun 5, 2026

Summary

Spec

Changes

Test plan

Uh oh!

varshaprasad96 commented Jun 5, 2026

Uh oh!

cwiklik left a comment

Choose a reason for hiding this comment

Uh oh!

cwiklik Jun 8, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cwiklik Jun 8, 2026

Choose a reason for hiding this comment

Uh oh!

pdettori commented Jun 9, 2026

Uh oh!

varshaprasad96 commented Jun 12, 2026

Uh oh!

r3v5 left a comment

Choose a reason for hiding this comment

Uh oh!

pdettori left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants