fix(crd): remove spec.auth.mode - auth type is global, not per-agent

BREAKING CHANGE: Removed spec.auth.mode field from AgentRuntime CRD

The authentication mode (federated-jwt vs client-secret) is configured
globally at the namespace level via authBridge.clientAuthType, not
per-agent. Having a per-agent mode field was misleading and could
create conflicts.

Changes:
- Removed AuthConfig.Mode field
- Updated webhook to inject routes when spec.auth.outbound is present,
  regardless of mode
- Routes are only effective when namespace has federated-jwt enabled
- Regenerated CRD manifests
- Updated tests to remove mode field
- Removed separate documentation (will be added to existing auth guide)

The authentication mode is a platform-wide setting that applies to all
agents in a namespace. Individual agents configure only their outbound
routes via spec.auth.outbound.

Assisted-By: Claude Code
Signed-off-by: Alan Cha <Alan.cha1@ibm.com>

Author: Alan-Cha

charts/operator/crds/agent.rossoctl.dev_agentruntimes.yaml

@@ -67,29 +67,16 @@ spec:
                   configures AuthBridge to perform token exchange when calling the
                   specified destinations, requesting the appropriate audiences.
                 properties:
-                  mode:
-                    default: client-secret
-                    description: |-
-                      Mode selects the authentication mechanism.
-
-                      Values:
-                        federated-jwt    Use SPIFFE JWT-SVID for client authentication
-                                         with Keycloak. Requires SPIRE and Keycloak 26.6+
-                                         with federated client authentication enabled.
-                        client-secret    Use traditional OAuth2 client credentials (default).
-                                         The operator provisions a client secret.
-                        disabled         No authentication configured. Use for public
-                                         endpoints or when authentication is handled elsewhere.
-                    enum:
-                    - federated-jwt
-                    - client-secret
-                    - disabled
-                    type: string
                   outbound:
                     description: |-
                       Outbound defines token exchange routes for calling other services.
                       Each route tells AuthBridge which audiences to request when calling
-                      a specific destination. Only used when mode is federated-jwt.
+                      a specific destination.
+
+                      Routes are only effective when the namespace is configured with
+                      SPIFFE authentication (authBridge.clientAuthType: federated-jwt).
+                      The authentication mode is set globally at the namespace level, not
+                      per-agent.
                     items:
                       description: OutboundRoute defines a token exchange route for
                         a specific destination.
@@ -124,8 +111,6 @@ spec:
                       - destination
                       type: object
                     type: array
-                required:
-                - mode
                 type: object
               authBridgeMode:
                 description: |-

kagenti-operator/config/crd/bases/_.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.1
+spec:
+  group: ""
+  names:
+    kind: ""
+    plural: ""
+  scope: ""
+  versions: null

operator/api/v1alpha1/agentruntime_types.go

@@ -167,24 +167,14 @@ type AgentRuntimeSpec struct {
 
 // AuthConfig defines authentication configuration for an agent or tool.
 type AuthConfig struct {
-	// Mode selects the authentication mechanism.
-	//
-	// Values:
-	//   federated-jwt    Use SPIFFE JWT-SVID for client authentication
-	//                    with Keycloak. Requires SPIRE and Keycloak 26.6+
-	//                    with federated client authentication enabled.
-	//   client-secret    Use traditional OAuth2 client credentials (default).
-	//                    The operator provisions a client secret.
-	//   disabled         No authentication configured. Use for public
-	//                    endpoints or when authentication is handled elsewhere.
-	//
-	// +kubebuilder:validation:Enum=federated-jwt;client-secret;disabled
-	// +kubebuilder:default=client-secret
-	Mode string `json:"mode"`
-
 	// Outbound defines token exchange routes for calling other services.
 	// Each route tells AuthBridge which audiences to request when calling
-	// a specific destination. Only used when mode is federated-jwt.
+	// a specific destination.
+	//
+	// Routes are only effective when the namespace is configured with
+	// SPIFFE authentication (authBridge.clientAuthType: federated-jwt).
+	// The authentication mode is set globally at the namespace level, not
+	// per-agent.
 	//
 	// +optional
 	Outbound []OutboundRoute `json:"outbound,omitempty"`

operator/config/crd/bases/agent.rossoctl.dev_agentruntimes.yaml

@@ -67,29 +67,16 @@ spec:
                   configures AuthBridge to perform token exchange when calling the
                   specified destinations, requesting the appropriate audiences.
                 properties:
-                  mode:
-                    default: client-secret
-                    description: |-
-                      Mode selects the authentication mechanism.
-
-                      Values:
-                        federated-jwt    Use SPIFFE JWT-SVID for client authentication
-                                         with Keycloak. Requires SPIRE and Keycloak 26.6+
-                                         with federated client authentication enabled.
-                        client-secret    Use traditional OAuth2 client credentials (default).
-                                         The operator provisions a client secret.
-                        disabled         No authentication configured. Use for public
-                                         endpoints or when authentication is handled elsewhere.
-                    enum:
-                    - federated-jwt
-                    - client-secret
-                    - disabled
-                    type: string
                   outbound:
                     description: |-
                       Outbound defines token exchange routes for calling other services.
                       Each route tells AuthBridge which audiences to request when calling
-                      a specific destination. Only used when mode is federated-jwt.
+                      a specific destination.
+
+                      Routes are only effective when the namespace is configured with
+                      SPIFFE authentication (authBridge.clientAuthType: federated-jwt).
+                      The authentication mode is set globally at the namespace level, not
+                      per-agent.
                     items:
                       description: OutboundRoute defines a token exchange route for
                         a specific destination.
@@ -124,8 +111,6 @@ spec:
                       - destination
                       type: object
                     type: array
-                required:
-                - mode
                 type: object
               authBridgeMode:
                 description: |-