[macastelaz]

Summary

Fixes two certificate discovery asymmetries between mTLS transport initialization (MtlsUtils / X509Provider) and Agent Identity bound-token acquisition (AgentIdentityUtils):

1. Add 30-second initial startup polling to MtlsUtils for the well-known SPIFFE directory:

   • When GOOGLE_API_CERTIFICATE_CONFIG (or certConfigPathOverride) or its referenced cert_path / key_path resides in /var/run/secrets/workload-spiffe-credentials/ (resolving ancestor symlinks via resolveRealPathAllowingMissing), MtlsUtils now polls for up to 30 seconds (50 × 100ms + 50 × 500ms) on initial container startup (!isInitialStartupCompleted()) until the configuration file, cert_path, and key_path are non-empty readable regular files and the JSON configuration parses cleanly.
   • MtlsUtils and AgentIdentityUtils share the initialStartupCompleted state so the JVM performs the 30-second cold-start poll at most once across both transport and token initialization.
   • Non-retryable states (missing files outside the well-known SPIFFE directory, directories, unreadable files, valid ECP-only configs, or incomplete workload configs missing cert_path/key_path) fail immediately with 0 sleeps.

2. Remove unconfigured legacy credentialbundle.pem and certificates.pem + private_key.pem fallbacks in AgentIdentityUtils:

   • When GOOGLE_API_CERTIFICATE_CONFIG is unset, AgentIdentityUtils.getWellKnownCertificatePathWithRetry() now checks only the GKE Pod Certificate bundle (/var/run/secrets/workload-spiffe-credentials/x509.credential-bundle.private-key.pem), matching MtlsUtils.getWorkloadCertPath() and X509Provider 1:1 so AgentIdentityUtils never mints a certificate-bound token for a certificate that the transport ignores.

Testing

• Added unit tests in MtlsUtilsTest, X509ProviderTest, and AgentIdentityUtilsTest covering:
  • Delayed config and cert/key creation in /var/run/secrets/workload-spiffe-credentials/
  • Config outside the well-known SPIFFE directory referencing cert_path/key_path inside the well-known SPIFFE directory
  • Partial/truncated JSON writes during startup polling
  • 0-byte certificate/key files during startup polling
  • Symlinked ancestor paths on the well-known SPIFFE directory
  • Startup poll timeout (99 sleeps) and shared initialStartupCompleted state across MtlsUtils and AgentIdentityUtils (0 sleeps on subsequent calls)
  • Ignoring unconfigured credentialbundle.pem and certificates.pem + private_key.pem when GOOGLE_API_CERTIFICATE_CONFIG is unset

[gemini-code-assist]

Code Review

This pull request introduces container startup polling in MtlsUtils to wait for credential file readiness when configuration or certificate files reside in the well-known SPIFFE directory, and unifies startup state tracking across mTLS transport initialization and Agent Identity token binding. The feedback suggests minor code simplifications by removing redundant checks in MtlsUtils (specifically in isExistingNonFileOrUnreadable and the exception handling block) and proposes a concurrency optimization to check the startup completion flag inside the polling loop to prevent unnecessary sleep cycles.