Fix(controller,webhook): write client-id.txt in federated-jwt mode for inbound JWT validation

[Alan-Cha]

Problem

In federated-jwt mode, agent pods reject all inbound authenticated requests with HTTP 503:

identity not yet configured (credentials pending)

The authbridge-proxy sidecar polls indefinitely for /shared/client-id.txt — the file the inbound jwt-validation plugin reads to determine the expected audience when validating incoming JWTs.

Root cause

PR #476 correctly intended to skip writing client-secret.txt in federated-jwt mode. However it skipped the entire ensureClientCredentialsSecret call, which also skipped client-id.txt. It also skipped patchTemplate, so the Secret annotation was never set and the webhook never mounted the Secret into the pod at all. The broken chain:

1. ensureClientCredentialsSecret skipped → no Secret, no client-id.txt
2. patchTemplate skipped → no annotation on pod template → webhook doesn't mount Secret
3. Webhook separately skipped annotation pre-population → same result

Fix

Controller — in federated-jwt mode, pass an empty clientSecret to ensureClientCredentialsSecret instead of skipping the call. The Secret is always written with both keys: client-id.txt (the agent's SPIFFE ID) and client-secret.txt (empty string in federated-jwt mode). Writing an empty client-secret.txt rather than omitting the key avoids a Kubernetes quirk where a subPath mount for an absent Secret key creates a directory at the mount path instead of a file. Remove the authType guard so patchTemplate also runs in federated-jwt mode.

Webhook — remove the federated-jwt guard on annotation pre-population. The Secret now exists in this mode, so the volume mount annotation is needed for the first pod to start without a pod recreate.

In federated-jwt mode AuthBridge uses identity.type=spiffe for outbound token exchange and never reads client-secret.txt, so the empty value is harmless.

Testing

• go build ./... clean
• go vet ./internal/controller/... ./internal/webhook/... clean

Fixes #482

Assisted-By: Claude Code

[pdettori]

Correct, minimal fix that restores the inbound-JWT audience config broken by #476.

Verified the logic against the full head-branch files: the controller now always calls ensureClientCredentialsSecret + patchTemplate (passing an empty clientSecret in federated-jwt mode), and the webhook now always pre-populates the annotation. The two sides are consistent — the Secret is created for every auth type and the webhook annotates for every eligible workload. The subPath-creates-a-directory-for-absent-key rationale for writing an empty client-secret.txt is a real Kubernetes quirk and a sound defensive choice.

Supply-chain gate clear (no .claude//.vscode/ changes). All 16 CI checks green, both commits signed off.

One non-blocking nit inline.

Assisted-By: Claude Code

[pdettori]

nit: this comment says the Secret is "written by the operator with only client-id.txt, no client-secret.txt", but the controller change in this same PR writes client-secret.txt as an empty string rather than omitting it (that's the whole point of the subPath fix). Suggest rewording to "written with client-id.txt and an empty client-secret.txt" so it matches the actual behavior and the controller-side comment.