Fix: preserve explicitly-set authbridge-config keys per namespace (#433)

[pdettori]

Summary

AuthbridgeConfigReconciler unconditionally overwrote every key of an existing authbridge-config ConfigMap with platform-global defaults on each reconcile, silently discarding any explicitly-set per-namespace value such as KEYCLOAK_REALM. A workload in a namespace using a non-default realm had its realm reset to kagenti within one reconcile cycle, so the client-registration controller registered the client in the wrong realm and client_credentials grants returned invalid_client (401). Regression introduced in cdbed3b.

Fixes #433.

Root cause

In the update path of authbridgeconfig_controller.go:

for k, v := range desired {
    cm.Data[k] = v   // clobbers KEYCLOAK_REALM (and every other key)
}

Fix

authbridge-config is a namespace-defaults source (labeled kagenti.io/defaults=true, consumed by defaults_config_reconciler.go / agentruntime_controller.go), and cdbed3b introduced it purely as operator-driven defaulting. Defaults should fill gaps, not override explicit values. On the update path the reconciler now only fills keys that are missing or empty, preserving any existing non-empty value:

for k, v := range desired {
    if existing, ok := cm.Data[k]; ok && existing != "" {
        continue // preserve explicitly-set per-namespace value
    }
    cm.Data[k] = v
}

Unchanged: the create path (a fresh kagenti-enabled namespace still receives full operator-provided defaults) and the ownership/defaults label stamping. So the cdbed3b defaulting behavior is preserved for namespaces that have no config yet.

Tests

The controller previously had no test. Adds authbridgeconfig_controller_test.go (plain testing + fake client, matching clientregistration_controller_test.go) covering:

Case	Asserts
Per-namespace realm preserved	existing KEYCLOAK_REALM=tx-e2e survives reconcile (the regression)
Create path	no CM → created with full platform defaults + labels
Missing/empty-key fill	present non-empty key kept; missing & empty keys filled from defaults
Label stamping	externally-created CM gets managed-by + kagenti.io/defaults
Skip	non-kagenti-enabled namespace → no CM created

The first two/three cases were written failing first (clobber reproduced), then made green by the fix.

ok  github.com/kagenti/operator/internal/controller  (5/5 subtests pass)

gofmt, go vet, and go build ./... clean.

Cross-refs

• Interim mitigation in kagenti made the token-exchange E2E step non-fatal (kagenti/kagenti #1982); this PR restores the underlying behavior so that suite can go green again.

Assisted-By: Claude Code

[esnible]

Summary

Clean, focused fix. The update path now fills only missing/empty keys instead of clobbering every key, so an explicitly-set per-namespace value (e.g. KEYCLOAK_REALM=tx-e2e) survives reconciliation while the create path still gets full operator-provided defaults. This matches Option 1 in #433 and correctly preserves the cdbed3b defaulting behavior for fresh namespaces.

Verified against upstream/main: the diff applies to the pre-fix clobbering loop; LabelNamespaceDefaults == "kagenti.io/defaults", authbridgeConfigCM, and clientRegistrationTestScheme all exist and are used consistently; and authbridge-config is genuinely consumed as a namespace-defaults source (via MatchingLabels{LabelNamespaceDefaults: "true"}). Good first test for a controller that previously had none — the regression case is written to fail on the old behavior.

One behavior trade-off worth noting (non-blocking): once a key is non-empty, the operator can no longer push an updated platform default to it on the update path. That's the intended "defaults fill gaps, don't override" semantics per #433, so this is correct as designed.

Author: pdettori (MEMBER — maintainer)
Areas reviewed: Go (controller + test)
Agent/IDE config (.claude/.vscode): none
Commits: 1 commit, signed-off: yes
CI status: passing (all 16 checks green, incl. E2E + Integration + Unit)