fix(chart): Render --spire-trust-domain independently of signatureVerification.enabled

The trust domain is consumed by two controllers in this operator binary:

- **AgentCardReconciler** (signature verification): uses it to build expected
  SPIFFE IDs when verifying x5c chains on agent card signatures.
- **ClientRegistrationReconciler** (operator-managed Keycloak client lifecycle):
  uses it to build SPIFFE-shaped client IDs of the form
  spiffe://<trust-domain>/ns/<ns>/sa/<sa> when authbridge-config has
  SPIRE_ENABLED=true.

The chart template gated --spire-trust-domain on signatureVerification.enabled.
As a result, clusters that use SPIRE for workload identity but do not enable A2A
signature enforcement fail client registration: the reconciler loops with
"cannot resolve Keycloak client id yet -- --spire-trust-domain is required"
every 30s and no agent ever gets registered in Keycloak.

Move --spire-trust-domain out of the signatureVerification.enabled block so it
is rendered whenever .Values.signatureVerification.spireTrustDomain is set,
regardless of whether signature verification is on. The signature-specific
flags (--require-a2a-signature, --signature-audit-mode,
--enforce-network-policies, --svid-expiry-grace-period, trust-bundle flags)
stay inside the gate.

Update the values.yaml comment to describe the new semantics. No default change.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Hai Huang <huang195@gmail.com>

Author: huang195

charts/kagenti-operator/templates/manager/manager.yaml

@@ -42,9 +42,6 @@ spec:
             {{- if .Values.signatureVerification.enforceNetworkPolicies }}
             - "--enforce-network-policies=true"
             {{- end }}
-            {{- if .Values.signatureVerification.spireTrustDomain }}
-            - "--spire-trust-domain={{ .Values.signatureVerification.spireTrustDomain }}"
-            {{- end }}
             {{- if .Values.signatureVerification.spireTrustBundle.configMapName }}
             - "--spire-trust-bundle-configmap={{ .Values.signatureVerification.spireTrustBundle.configMapName }}"
             {{- end }}
@@ -61,6 +58,19 @@ spec:
             - "--svid-expiry-grace-period={{ .Values.signatureVerification.svidExpiryGracePeriod }}"
             {{- end }}
             {{- end }}
+            {{/*
+              --spire-trust-domain is rendered independently of
+              signatureVerification.enabled. The flag is also consumed by the
+              ClientRegistrationReconciler, which resolves SPIFFE client IDs of
+              the form spiffe://<trust-domain>/ns/<ns>/sa/<sa> when
+              authbridge-config has SPIRE_ENABLED=true. Gating it on signature
+              verification would break operator-managed client registration in
+              clusters that use SPIRE for workload identity but do not enable
+              A2A signature enforcement.
+            */}}
+            {{- if .Values.signatureVerification.spireTrustDomain }}
+            - "--spire-trust-domain={{ .Values.signatureVerification.spireTrustDomain }}"
+            {{- end }}
           command:
             - {{ .Values.controllerManager.container.cmd }}
           image: {{ .Values.controllerManager.container.image.repository }}:{{ .Values.controllerManager.container.image.tag }}

charts/kagenti-operator/values.yaml

@@ -100,7 +100,12 @@ signatureVerification:
   auditMode: false
   # Enforce network policies based on signature verification
   enforceNetworkPolicies: false
-  # SPIRE trust domain (required when enabled)
+  # SPIRE trust domain. Required when SPIRE is enabled in the cluster even if
+  # signatureVerification.enabled is false: the ClientRegistrationReconciler
+  # uses this to build SPIFFE-shaped Keycloak client IDs
+  # (spiffe://<trust-domain>/ns/<ns>/sa/<sa>) whenever authbridge-config has
+  # SPIRE_ENABLED=true. The chart renders --spire-trust-domain independently of
+  # signatureVerification.enabled for this reason.
   spireTrustDomain: ""
   # Key within the SPIRE trust bundle ConfigMap. Matches the SPIRE hardened Helm chart default
   # and the binary flag default. Override to "bundle.crt" only for older ZTWIM deployments.