From 292a4691da90a19fd58524309d320f98ec5c2f3d Mon Sep 17 00:00:00 2001 From: Alan Cha Date: Mon, 10 Aug 2026 21:40:20 -0400 Subject: [PATCH] fix: clarify SPIRE warning message to avoid confusion The existing warning 'SPIRE not detected for mTLS-enabled workload' is confusing because: 1. SPIRE may be running (via Helm) but not detected by this check 2. JWT-SVID authentication works fine despite this warning 3. The check only looks for socket volumes in the pod spec This commit clarifies that: - The check is specific to X.509-SVID based mTLS - JWT-SVID authentication is unaffected - The message explains what's actually being checked Fixes rossoctl/rossoctl#2361 Signed-off-by: Alan Cha --- operator/internal/controller/agentruntime_controller.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/operator/internal/controller/agentruntime_controller.go b/operator/internal/controller/agentruntime_controller.go index 39b50acc..ff4e1135 100644 --- a/operator/internal/controller/agentruntime_controller.go +++ b/operator/internal/controller/agentruntime_controller.go @@ -854,7 +854,11 @@ func (r *AgentRuntimeReconciler) evaluateMTLSReady(ctx context.Context, rt *agen r.Recorder.Eventf(rt, nil, corev1.EventTypeWarning, "SPIREUnavailable", "MTLSReadyCheck", msg) } - logger.Info("SPIRE not detected for mTLS-enabled workload", + // This check only verifies X.509-SVID volumes for mTLS certificate management. + // This is expected with Helm-managed SPIRE deployments where volumes aren't + // pre-injected. Other SPIRE features like SPIFFE auth (JWT-SVID) still work + // as long as SPIRE is installed and the feature is enabled. + logger.Info("SPIRE socket volumes not detected (X.509-SVID mTLS unavailable)", "workload", rt.Spec.TargetRef.Name, "mtlsMode", mtlsMode) } }