Feat(operator): implement SPIFFE JWT-SVID authentication for client registration

[Alan-Cha]

Summary

Implements #1421 — eliminates admin credentials from operator client registration
by using the operator's SPIFFE identity (JWT-SVID) to authenticate with the
Keycloak Admin API.

Problem

The operator currently uses admin credentials to register OAuth clients. This means:

• Admin credentials stored as secrets, requiring manual rotation
• Operator compromise = full realm admin access
• Long-lived credentials in the cluster

Solution

The operator authenticates with its SPIFFE JWT-SVID via Keycloak's federated-jwt
client authenticator, using only the scoped manage-clients role.

Architecture

Operator Pod
├─> spiffe-helper sidecar (standalone container)
│   └─> writes JWT-SVID to /opt/jwt_svid.token (auto-rotates)
├─> Manager reads JWT-SVID from file
└─> POST /realms/kagenti/protocol/openid-connect/token
    client_assertion_type: urn:ietf:params:oauth:client-assertion-type:jwt-spiffe
    → access token with manage-clients role
    → same Admin API endpoints as before

Changes

Go (internal/keycloak/admin.go)

New JWTSVIDGrantToken() method authenticates the operator using JWT-SVID.

Go (internal/controller/clientregistration_controller.go)

Dual authentication path:

• UseSpiffeAuth=true: reads JWT-SVID from file, calls JWTSVIDGrantToken()
• UseSpiffeAuth=false: admin credentials (legacy, default)

Security: path traversal protection (filepath.Clean + whitelist), JWT-SVID
never logged, all failures surface as Kubernetes Events.

Go (cmd/main.go)

Registers --use-spiffe-auth, --jwt-svid-path, --operator-client-id flags.

Helm (charts/kagenti-operator/)

• configmap-spiffe-helper.yaml (new): configures spiffe-helper to write
  JWT-SVID to /opt/jwt_svid.token. Set spiffe.operatorAuth.jwtAudience
  explicitly — the fallback uses keycloak.publicUrl which defaults to empty.
• manager.yaml: conditionally adds spiffe-helper sidecar (UID 65532, matching
  the manager so the 600-mode file is readable), jwt-svid emptyDir volume, SPIFFE
  flags — all gated on spiffe.operatorAuth.enabled.
• values.yaml: new spiffe: block, both enabled and operatorAuth.enabled
  default to false.

Security improvements

Before	After
Admin credentials (full realm)	JWT-SVID (cryptographic, short-lived)
manage-* roles	manage-clients only
Manual rotation	Auto-rotates (spiffe-helper)
Secrets in namespace	No secrets

E2E testing

Complete — multiple fresh-cluster runs, all 9 steps passed.
See https://gist.github.com/Alan-Cha/527be60c79b40aedd54fe7be586c3452

Related

• Implements Eliminate admin credentials from operator client registration #410
• Platform bootstrap: feat(operator): add SPIFFE authentication bootstrap for operator client registration kagenti#2141 (companion clean PR)
• Replaces: Feat: SPIFFE authentication for operator client registration (Admin API) #349 (superseded by this clean PR)

Checklist

• All commits signed-off (DCO)
• Feature gated (default: disabled)
• Backward compatible — UseSpiffeAuth=false uses admin credentials

Assisted-By: Claude Code (Anthropic AI) noreply@anthropic.com

[esnible]

Clean, well-scoped implementation of JWT-SVID operator auth. The dual-auth split is correct: both paths converge on RegisterOrFetchClientWithToken with identical params, the SPIFFE path is fully feature-gated (spiffe.enabled + spiffe.operatorAuth.enabled, both default false), and legacy admin-credential auth is untouched as the default.

Verified against the branch:

• All reused helpers (trimBaseURL, truncate, httpc, adminTokenResponse) and imports already exist in admin.go.
• corev1 is imported and owner is in scope for all Recorder.Event calls.
• The spiffe-workload-api CSI volume guard is correctly widened to or verifiedFetch.enabled (spiffe operatorAuth), so the sidecar's mount is satisfied.
• Path-traversal protection (filepath.Clean + /opt/, /var/run/secrets/ prefix whitelist) is sound against .. sequences.
• Error classification is appropriate: permanent failure on bad config path, transient requeue on read/auth failure. JWT-SVID is never logged.

All 16 CI checks green (including E2E), all commits signed-off. Two non-blocking suggestions inline.

Assisted-By: Claude Code