ci: Add CI/build for unified authbridge, deprecate old components (Phase 4)

[huang195]

Summary

Phase 4 of the modular token exchange library (#279). Makes the unified authbridge production-ready with CI, build pipeline, documentation, and deprecation markers.

Depends on: #312 (Phase 3), #311 (Phase 2), #310 (Phase 1)

CI changes

• Add Go CI (authlib) job for the authlib module (lint, build, test with -race -cover)
• Add Go CI (authbridge cmd) job for the cmd/authbridge module
• Add authbridge-unified image to build.yaml matrix

Documentation

• Updated CLAUDE.md with unified binary architecture, Go module structure, and 3 deployment modes
• Marked authbridge-unified as the recommended image
• Marked envoy-with-processor and old authbridge images as deprecated

Deprecation markers

• go-processor/main.go, Dockerfile.envoy, entrypoint-envoy.sh marked deprecated with pointers to replacements

Follow-up (separate repos)

• kagenti-operator: Add authbridge-unified to image config in kagenti-platform-config ConfigMap. The operator already supports image overrides via PlatformConfig.Images.
• kagenti: Add authbridge-unified-config ConfigMap to Helm chart agent-namespaces.yaml template, generated from existing Helm values.

Related issue(s)

Ref #279

Test plan

• All 80 tests pass (63 authlib + 17 listeners)
• CI passes
• Build pipeline produces authbridge-unified image

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

[pdettori]

Review Summary

Well-structured rewrite that replaces three separate Go codebases (go-processor, waypoint, klaviger) with a single modular binary. The architecture is clean: authlib/ is a pure Go library with no gRPC/Envoy deps, cmd/authbridge/ adds thin protocol listeners. 80 tests cover positive/negative paths with -race. All 10 commits are DCO signed-off.

Main feedback: the JWT verification error detail in DenyReason and the unbounded GracefulStop are worth addressing — one is a security hygiene issue, the other a potential stuck-shutdown in production.

Areas reviewed: Go code, CI/GitHub Actions, Dockerfile, Shell, YAML, Docs
Commits: 10 commits, all signed-off ✓
CI status: DCO passing
Verdict: COMMENT — suggestions only, no blocking issues

Highlights

• Fail-closed design (nil verifier → deny) is exactly right for a security component
• io.LimitReader(resp.Body, 1<<20) — good defense against malicious token endpoints
• Context propagation via NewRequestWithContext throughout is solid
• Clean protocol-agnostic auth layer with thin listener translators

4 of 10 commits lack emoji prefix (47d24e3, 0eaf70c, b0d9dbb, ec50850) — minor convention gap.

[pdettori]

suggestion: fmt.Sprintf("token validation failed: %v", err) — this JWT verification error is forwarded to the client via both ext_authz and ext_proc deny responses. Errors can reveal issuer URL, expected audience, or algorithm details.

Consider logging the detail server-side but returning a generic "token validation failed" to the client:

a.log.Info("JWT validation failed", "error", err)
return &InboundResult{
    Action:     ActionDeny,
    DenyStatus: http.StatusUnauthorized,
    DenyReason: "token validation failed",
}

[huang195]

Fixed in PR #311 (398f110). Now returns generic "token validation failed" to the client. Full error logged server-side at INFO level.

[pdettori]

suggestion: srv.GracefulStop() blocks indefinitely without using shutdownCtx. If a gRPC streaming connection stays open (e.g. ext_proc), the process hangs past the 15s SIGTERM grace period.

Consider wrapping in a goroutine with a timer that falls back to srv.Stop():

for _, srv := range grpcServers {
    s := srv
    go func() {
        <-shutdownCtx.Done()
        s.Stop() // force after timeout
    }()
    s.GracefulStop()
}

[huang195]

Already fixed in PR #312 review round. Phase 3 rebased to pick it up — goroutine calls srv.Stop() when shutdownCtx expires.

[pdettori]

nit: http.Server has no ReadHeaderTimeout. Go defaults to infinite, which is susceptible to slowloris-style resource exhaustion. Minor concern since this is an internal sidecar, but cheap defense-in-depth:

srv := &http.Server{
    Addr:              addr,
    Handler:           handler,
    ReadHeaderTimeout: 10 * time.Second,
}

[huang195]

Fixed. Added ReadHeaderTimeout: 10 * time.Second to all HTTP servers.

[pdettori]

nit: envoyproxy/envoy:v1.37.1 is pinned to a mutable tag while the UBI9 base correctly uses a SHA digest (@sha256:8300...). Consider SHA-pinning the Envoy image too for reproducible builds.

[huang195]

Already fixed in PR #312 review round. Envoy image pinned by SHA digest.

[pdettori]

/lgtm