test(e2e): add token exchange verification tests for AgentRuntime.spec.auth.outbound routes

Problem

PR #517 added support for generating AuthBridge routes from AgentRuntime.spec.auth.outbound, but the test coverage is limited to configuration generation. There are no E2E tests that verify token exchange actually works at runtime.

Current Test Coverage ✅

Unit tests (added in PR #517):

• Routes ConfigMap is created with correct format
• Config references routes file correctly (/etc/authproxy/routes.yaml)
• Volume mounting works
• Routes use flat format (host + target_audience)

What's missing ❌:

• AuthBridge actually reads those routes from the file
• Token exchange happens when agent calls a tool
• Exchanged token has the correct audience
• Routes match correctly (glob patterns work)
• Multiple routes work (priority/ordering)

Proposed E2E Test Scenarios

Test 1: Basic Token Exchange

Deploy agent + tool with SPIFFE auth and verify token exchange:

apiVersion: agent.rossoctl.dev/v1alpha1
kind: AgentRuntime
metadata:
  name: weather-agent
  namespace: team1
spec:
  auth:
    outbound:
      - destination:
          host: weather-tool-mcp.team1.svc.cluster.local
        audiences:
          - spiffe://localtest.me/ns/team1/sa/weather-tool

Verify:

1. Agent pod has routes ConfigMap mounted
2. Agent can call tool successfully
3. AuthBridge logs show route matched
4. Token exchange occurred (check logs for "token-exchange" plugin activity)
5. Tool received token with correct audience

Test 2: Glob Pattern Matching

Test wildcard routes:

outbound:
  - destination:
      host: "*.team1.svc.cluster.local"
    audiences:
      - spiffe://localtest.me/ns/team1/sa/default

Verify:

• Multiple services match the pattern
• Each gets token exchange with correct audience

Test 3: Multiple Routes (Priority)

Test route ordering when multiple patterns could match:

outbound:
  - destination:
      host: specific-tool.team1.svc.cluster.local
    audiences:
      - spiffe://specific-audience
  - destination:
      host: "*.team1.svc.cluster.local"
    audiences:
      - spiffe://default-audience

Verify:

• First (more specific) route wins

Test 4: No Route Match (Passthrough)

Agent calls service without a matching route.

Verify:

• Request passes through without token exchange (based on default_policy)

Implementation Approach

Option A: Extend existing E2E test suite (test/e2e/e2e_test.go)

• Add new Describe("AgentRuntime Token Exchange E2E") block
• Use existing test helpers (kubectl, pod waiting, etc.)
• Deploy simple agent + tool fixtures
• Verify via logs and actual HTTP calls

Option B: Separate token exchange test file (test/e2e/token_exchange_test.go)

• Cleaner separation
• Can be run independently
• Easier to skip if SPIRE/Keycloak not available

Recommendation: Option B with test fixtures from the weather agent demo (rossoctl/examples/agents/weather_service_deployment.yaml).

Test Infrastructure Needed

1. Keycloak with SPIFFE identity provider configured
2. SPIRE for JWT-SVID issuance
3. Weather tool (or simple mock MCP server)
4. Weather agent with routes configured
5. Namespace with authbridge-runtime-config ConfigMap (SPIFFE auth enabled)

Much of this already exists in .github/scripts/local-setup/kind-full-test.sh - the E2E test suite could reuse that setup.

Success Criteria

• E2E test deploys agent with spec.auth.outbound routes
• Test verifies AuthBridge reads routes from file (not inline config)
• Test confirms token exchange occurs (via logs or token inspection)
• Test validates exchanged token has correct audience
• Test verifies agent can successfully call tool
• Test covers at least one wildcard route pattern

Related

• PR #517: Added routes generation (config-level tests only)
• Issue #518: Multiple audiences warning
• Issue #520: HostRegex vs glob mismatch
• Weather demo: rossoctl/examples/agents/weather_service_deployment.yaml

/cc @alantech

Start with test/e2e/e2e_test.go, the existing helpers, and .github/scripts/local-setup/kind-full-test.sh; compare them with rossoctl/examples/agents/weather_service_deployment.yaml. Add an E2E test file or suite that deploys the agent and tool, exercises outbound routes including a wildcard, and verifies route loading, token exchange, audience, and tool success through logs or token inspection.