fix(crd): AgentRuntime.spec.auth.outbound[].destination.hostRegex should be documented as glob, not regex

[Alan-Cha]

Problem

The AgentRuntime CRD field spec.auth.outbound[].destination.hostRegex is documented as accepting regex patterns, but AuthBridge's routing engine expects glob patterns.

Current CRD documentation:

// HostRegex is a regex pattern to match hostnames.
// Example: ".*\\.team1\\.svc\\.cluster\\.local"

AuthBridge reality:

// authbridge/authlib/routing/router.go
g, err := glob.Compile(r.Host, '.')  // Uses github.com/gobwas/glob, not regexp

Users who follow the CRD documentation and provide regex syntax (e.g., .*\.team1\.svc\.cluster\.local) will get routes that don't match because glob syntax is different from regex.

Impact

• Silent mismatch: Routes silently fail to match because regex metacharacters are interpreted as literal characters in glob matching
• Wrong examples: The CRD example shows regex syntax that won't work
• Confusing field name: hostRegex implies regex when it should be glob

Proposed Solution

Option A: Rename field + deprecate (breaking change)

// HostGlob is a glob pattern to match hostnames.
// Supports * (any chars) and ? (single char).
// Example: "*.team1.svc.cluster.local"
HostGlob string `json:"hostGlob,omitempty"`

// HostRegex is deprecated - use HostGlob instead.
// This field was misnamed; it expects glob syntax, not regex.
// +deprecated
HostRegex string `json:"hostRegex,omitempty"`

Option B: Fix documentation only (non-breaking)

// HostRegex is a glob pattern to match hostnames (name is misleading).
// Supports * (any chars) and ? (single char), NOT regex syntax.
// Example: "*.team1.svc.cluster.local"
HostRegex string `json:"hostRegex,omitempty"`

Workaround

PR #517 added a warning log when hostRegex is used:

mutatorLog.Info("hostRegex field is mapped to AuthBridge glob pattern (not regex)",
    "note", "use glob syntax like '*.team1.svc.cluster.local', not regex")

This helps users discover the issue but doesn't fix the root cause.

Related

• PR fix: generate AuthBridge routes in separate ConfigMap with correct format #517 discovered this while implementing routes generation
• No examples currently use hostRegex (all use exact host matches)
• AuthBridge glob implementation: https://github.com/gobwas/glob

/cc @alantech