Audience Uniqueness Warning

Description

When reconciling an MCPOIDCConfig, detect duplicate audience values across workloads referencing the same config and emit a Warning event. If two servers sharing the same OIDC config have the same audience, a token obtained for one is valid at the other — this is a security concern.

Implementation Notes

Location: Add to the MCPOIDCConfig controller reconciliation loop (02-C).

Logic:

1. For each referencing workload, resolve the effective audience:
   • If spec.oidcConfig.audience is set, use it
   • Otherwise, use the default {kind}/{namespace}/{name}
2. Check for duplicates in the resolved audience list
3. If duplicates found, emit a Warning event on the MCPOIDCConfig resource:

   Warning AudienceDuplicate Duplicate audience "foo" found on workloads: server-a, server-b. Tokens may be replayable between these servers.
   

Event recorder: Use the controller's record.EventRecorder (already available in the controller struct pattern).

Testing

• Two workloads with different audiences → no warning event
• Two workloads with same explicit audience → Warning event emitted
• Workload with default audience matching another's explicit audience → Warning event emitted

Acceptance Criteria

• Duplicate audience detection runs during MCPOIDCConfig reconciliation
• Warning event emitted on the MCPOIDCConfig resource when duplicates found
• Event message identifies the duplicate audience value and the affected workloads
• No warning emitted when all audiences are unique
• Default audience computation ({kind}/{namespace}/{name}) is included in uniqueness check
• Unit tests cover all audience uniqueness scenarios
• Tests pass in CI (task test)

Locate the MCPOIDCConfig controller reconciliation loop (02-C) and review the controller struct's available EventRecorder. Trace how referencing workloads and their effective audiences are resolved, then cover the three listed uniqueness scenarios with unit tests. Done means duplicate audiences emit the specified Warning event on MCPOIDCConfig, unique audiences emit none, and task test passes.