fix(webhook): add defensive check for spireEnabled vs identity.type=spiffe lockstep

[akram]

Summary

The ensurePerAgentConfigMap() function now injects/scrubs the spiffe: block based on spireEnabled, while synthesizePipeline() sets identity.type=spiffe based on ClientAuthType == "federated-jwt". These two decisions are currently kept in lockstep by the mTLS-baseline auto-enable (pod_mutator.go:290), but they could diverge during the kagenti-extensions → operator webhook migration.

If a workload's effective config carries identity.type: spiffe while spireEnabled=false, the spiffe: block will be stripped, producing a startup crash ("spiffe identity requires a SPIFFE provider to be injected").

Suggested fix

Add a defensive check: if the synthesized pipeline contains identity.type=spiffe, force spireEnabled=true for the spiffe: block injection, or log a warning about the mismatch.

Context

• Flagged by @huang195 in review of PR #447
• Currently latent — mTLS-baseline keeps the values in sync

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. If this issue is still relevant, please comment or remove the stale label.

[github-actions]

This issue was closed because it has been stale for 14 days with no activity. Feel free to reopen if this is still relevant.