[Story] SPIRE Workload API integration (sidecar/init/hostpath modes)

[shreyanshjain7174]

Parent

Part of #146 (Cross-Cluster Agent Identity Federation epic).

Status

Blocked by validation gate and depends on the CRD field story.

Goal

Inject a SPIRE Workload API client into agent pods when spec.identity.spiffe.enabled=true, in one of three modes (sidecar, init, hostpath).

Scope

• Mutating admission webhook in internal/webhook/spiffe_injector.go reads spec.identity.spiffe.injectionMode and injects:
  • sidecar mode: SPIRE Workload API client container + shared emptyDir volume + agent reads SVID from /var/run/spire/svid/
  • init mode: init container fetches SVID once, writes to shared volume
  • hostpath mode: mount /run/spire/sockets/agent.sock directly (requires DaemonSet)
• Python helper agents/identity/spiffe.py that abstracts the three modes for user code
• Health probes for sidecar mode (SVID rotation working)
• Resource limits sensible defaults for sidecar (50m CPU / 64Mi RAM)
• Unit tests on the injector for all three modes
• Integration test with a real SPIRE server in KinD

Reference

RFC-0001 § 4.4

Acceptance

• Each injection mode demonstrably fetches a valid SVID
• KinD integration test passes
• Documented in docs/security/cross-cluster-identity.md