[Story] AgentWorkload CRD: spec.identity.spiffe fields

[shreyanshjain7174]

Parent

Part of #146 (Cross-Cluster Agent Identity Federation epic).

Status

Blocked by validation gate. Depends on SPIRE topology design completion.

Goal

Add optional spec.identity.spiffe fields to the AgentWorkload CRD in api/v1alpha1/agentworkload_types.go.

Scope

• New struct SpiffeIdentitySpec in api/v1alpha1/agentworkload_types.go:

  type SpiffeIdentitySpec struct {
      Enabled       bool     `json:"enabled,omitempty"`
      TrustDomain   string   `json:"trustDomain,omitempty"`
      IDPath        string   `json:"idPath,omitempty"`
      FederatedTo   []string `json:"federatedTo,omitempty"`
      InjectionMode string   `json:"injectionMode,omitempty"` // sidecar | init | hostpath
  }

• Extend IdentitySpec (create if absent) under AgentWorkloadSpec
• Webhook validation in api/v1alpha1/agentworkload_webhook.go:
  • trustDomain required if enabled=true
  • injectionMode must be one of three valid values
  • federatedTo entries must be valid trust domain names
• Regenerate CRD manifests via make manifests
• Regenerate deepcopy via make generate
• Unit tests for validation logic

Backward compatibility

All fields optional. Existing AgentWorkloads continue to validate without changes.

Acceptance

• CRD field documented in API reference
• Webhook tests pass
• make validate green