fix(controller): return error instead of panicking on unknown auth mode

[SarthakB11]

summary

• getAuthenticator at go/core/cmd/controller/main.go:51 panicked when authCfg.Mode was anything other than trusted-proxy or unsecure. a panic at startup bypasses defer-driven cleanup (e.g. the tracing shutdown registered earlier in app.Start), surfaces to kubernetes only as a CrashLoopBackOff with no reason set on the pod, and prints a stack trace where a typed error message would be clearer.
• return fmt.Errorf("unknown auth mode %q (valid modes: unsecure, trusted-proxy)", authCfg.Mode) instead and propagate the error up through the ExtensionConfig closure so app.Start can log and exit cleanly.
• swap the panic-recover test for one that asserts the typed error path and that the returned authenticator is nil on error.

ai model disclosure

used claude code (claude opus 4.7) to triage and draft the diff. self-reviewed go/core/cmd/controller/main.go and the existing auth_mode_test.go to confirm getAuthenticator is only called from a closure that already returns error, so propagation is straightforward. verified locally via:

go vet ./core/cmd/controller/...
./bin/golangci-lint run ./core/cmd/controller/...      # 0 issues
go test -race -skip 'TestE2E.*' -count=1 ./core/cmd/controller/...   # ok

[Copilot]

Pull request overview

This PR changes the controller startup path so unknown auth-mode values return an error from getAuthenticator instead of panicking, and updates the unit test to cover the error-returning behavior. In the controller codebase, this affects early bootstrap/auth initialization before the HTTP server is wired up.

Changes:

• Change getAuthenticator to return (AuthProvider, error) and return an error for unsupported auth modes.
• Propagate authenticator construction failures through the controller's app.Start extension-config callback.
• Replace the panic-based test with an error-path test for unknown auth modes.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
go/core/cmd/controller/main.go	Updates controller bootstrap to propagate invalid auth-mode failures as errors from getAuthenticator.
go/core/cmd/controller/auth_mode_test.go	Adjusts unit tests to match the new error-returning authenticator behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[SarthakB11]

good catch. pushed 4431347f which asserts the error message includes both the invalid mode name and the list of supported modes, so a regression that drops either signal would fail the test now.

[SarthakB11]

you're right, the defer-skip is real. app.Start calls os.Exit(1) at app.go:496 when the extension-config callback returns err, skipping the tracing-shutdown defer registered at app.go:320 that the previous panic would have unwound through.

practical flush impact at this specific call site is small (very few spans are buffered between tracing init and getAuthenticator), but the defer-skip applies to every config-failure path in startup, not just this one. the underlying issue is app.Start using os.Exit rather than returning errors.

the suggested panic(err) keeps getAuthenticator returning a typed error (so the test assertions still hold) and panics at the call site so defers run. happy to apply it. otherwise i can refactor app.Start to thread errors back to main as a separate PR. which would you prefer?