[macastelaz]

Summary

Fixes two certificate discovery asymmetries between mTLS transport initialization (MtlsUtils / X509Provider) and Agent Identity bound-token acquisition (AgentIdentityUtils):

1. Add 30-second initial startup polling to MtlsUtils for the well-known SPIFFE directory:

   • When GOOGLE_API_CERTIFICATE_CONFIG (or certConfigPathOverride) or its referenced cert_path / key_path resides in /var/run/secrets/workload-spiffe-credentials/ (resolving ancestor symlinks via resolveRealPathAllowingMissing), MtlsUtils now polls for up to 30 seconds (50 × 100ms + 50 × 500ms) on initial container startup (!isInitialStartupCompleted()) until the configuration file, cert_path, and key_path are non-empty readable regular files and the JSON configuration parses cleanly.
   • MtlsUtils and AgentIdentityUtils share the initialStartupCompleted state so the JVM performs the 30-second cold-start poll at most once across both transport and token initialization.
   • Non-retryable states (missing files outside the well-known SPIFFE directory, directories, unreadable files, valid ECP-only configs, or incomplete workload configs missing cert_path/key_path) fail immediately with 0 sleeps.

2. Remove unconfigured legacy credentialbundle.pem and certificates.pem + private_key.pem fallbacks in AgentIdentityUtils:

   • When GOOGLE_API_CERTIFICATE_CONFIG is unset, AgentIdentityUtils.getWellKnownCertificatePathWithRetry() now checks only the GKE Pod Certificate bundle (/var/run/secrets/workload-spiffe-credentials/x509.credential-bundle.private-key.pem), matching MtlsUtils.getWorkloadCertPath() and X509Provider 1:1 so AgentIdentityUtils never mints a certificate-bound token for a certificate that the transport ignores.

Testing

• Added unit tests in MtlsUtilsTest, X509ProviderTest, and AgentIdentityUtilsTest covering:
  • Delayed config and cert/key creation in /var/run/secrets/workload-spiffe-credentials/
  • Config outside the well-known SPIFFE directory referencing cert_path/key_path inside the well-known SPIFFE directory
  • Partial/truncated JSON writes during startup polling
  • 0-byte certificate/key files during startup polling
  • Symlinked ancestor paths on the well-known SPIFFE directory
  • Startup poll timeout (99 sleeps) and shared initialStartupCompleted state across MtlsUtils and AgentIdentityUtils (0 sleeps on subsequent calls)
  • Ignoring unconfigured credentialbundle.pem and certificates.pem + private_key.pem when GOOGLE_API_CERTIFICATE_CONFIG is unset

[gemini-code-assist]

Code Review

This pull request introduces container startup polling in MtlsUtils to wait for credential file readiness when configuration or certificate files reside in the well-known SPIFFE directory, and unifies startup state tracking across mTLS transport initialization and Agent Identity token binding. The feedback suggests minor code simplifications by removing redundant checks in MtlsUtils (specifically in isExistingNonFileOrUnreadable and the exception handling block) and proposes a concurrency optimization to check the startup completion flag inside the polling loop to prevent unnecessary sleep cycles.

[gemini-code-assist]

The expression (!file.canRead() && file.exists()) contains a redundant file.exists() check because file.exists() is already verified at the beginning of the method. This can be simplified to !file.isFile() || !file.canRead().

Suggested change

	private static boolean isExistingNonFileOrUnreadable(File file) {
	return file.exists() && (!file.isFile() || (!file.canRead() && file.exists()));
	}
	private static boolean isExistingNonFileOrUnreadable(File file) {
	return file.exists() && (!file.isFile() || !file.canRead());
	}

References

1. When implementing property parsing or validation logic, ensure that null checks and validation steps are not redundant with checks already performed by upstream callers or preceding logic in the same method.

[gemini-code-assist]

In a highly concurrent startup environment, multiple threads might call waitForExplicitConfigStartupIfNeeded simultaneously. Once one thread successfully completes the polling and sets initialStartupCompleted = true, other polling threads can immediately stop polling and return null instead of continuing to sleep and check. This avoids redundant disk I/O and sleep cycles.

    for (int cycle = 0; cycle < maxCycles; cycle++) {
      if (initialStartupCompleted) {
        return null;
      }

[gemini-code-assist]

The check configFile.length() > 0 is redundant here because isNonEmptyReadableFile(configFile) was already verified on line 227, which guarantees that configFile.length() > 0 is true. We can safely remove this check and directly mark startup as completed and rethrow the exception.

          // Valid JSON missing required cert_configs, cert_path, or key_path; do not poll.
          initialStartupCompleted = true;
          throw e;

References

1. When implementing property parsing or validation logic, ensure that null checks and validation steps are not redundant with checks already performed by upstream callers or preceding logic in the same method.