Merge pull request #333 from huang195/fix/spire-trust-domain-chart-gate

fix(chart): Render --spire-trust-domain independently of signatureVerification.enabled

Author: huang195

charts/kagenti-operator/templates/manager/manager.yaml

@@ -42,9 +42,6 @@ spec:
             {{- if .Values.signatureVerification.enforceNetworkPolicies }}
             - "--enforce-network-policies=true"
             {{- end }}
-            {{- if .Values.signatureVerification.spireTrustDomain }}
-            - "--spire-trust-domain={{ .Values.signatureVerification.spireTrustDomain }}"
-            {{- end }}
             {{- if .Values.signatureVerification.spireTrustBundle.configMapName }}
             - "--spire-trust-bundle-configmap={{ .Values.signatureVerification.spireTrustBundle.configMapName }}"
             {{- end }}
@@ -61,6 +58,19 @@ spec:
             - "--svid-expiry-grace-period={{ .Values.signatureVerification.svidExpiryGracePeriod }}"
             {{- end }}
             {{- end }}
+            {{/*
+              --spire-trust-domain is rendered independently of
+              signatureVerification.enabled. The flag is also consumed by the
+              ClientRegistrationReconciler, which resolves SPIFFE client IDs of
+              the form spiffe://<trust-domain>/ns/<ns>/sa/<sa> when
+              authbridge-config has SPIRE_ENABLED=true. Gating it on signature
+              verification would break operator-managed client registration in
+              clusters that use SPIRE for workload identity but do not enable
+              A2A signature enforcement.
+            */}}
+            {{- if .Values.signatureVerification.spireTrustDomain }}
+            - "--spire-trust-domain={{ .Values.signatureVerification.spireTrustDomain }}"
+            {{- end }}
           command:
             - {{ .Values.controllerManager.container.cmd }}
           image: {{ .Values.controllerManager.container.image.repository }}:{{ .Values.controllerManager.container.image.tag }}

charts/kagenti-operator/values.yaml

@@ -100,7 +100,12 @@ signatureVerification:
   auditMode: false
   # Enforce network policies based on signature verification
   enforceNetworkPolicies: false
-  # SPIRE trust domain (required when enabled)
+  # SPIRE trust domain. Required when SPIRE is enabled in the cluster even if
+  # signatureVerification.enabled is false: the ClientRegistrationReconciler
+  # uses this to build SPIFFE-shaped Keycloak client IDs
+  # (spiffe://<trust-domain>/ns/<ns>/sa/<sa>) whenever authbridge-config has
+  # SPIRE_ENABLED=true. The chart renders --spire-trust-domain independently of
+  # signatureVerification.enabled for this reason.
   spireTrustDomain: ""
   # Key within the SPIRE trust bundle ConfigMap. Matches the SPIRE hardened Helm chart default
   # and the binary flag default. Override to "bundle.crt" only for older ZTWIM deployments.