Fix k8s workload attestor Broker API config docs and remove dead code

[amartinezfayo]

The SPIFFE Broker API support for the k8s workload attestor merged in #6915. This is a small follow-up addressing a few items noted during that review.

The agent_full.conf example for the k8s plugin still placed the broker block at the top level of plugin_data, but the plugin now expects it under experimental, so uncommenting the example as written would be rejected as an unknown key. This nests the broker block under experimental and adds the missing experimental.api_server.cache.enabled example.

The plugin documentation listed the experimental options as fully-qualified dotted rows in the main configuration table. This moves them into a dedicated experimental configuration sub-table, matching how spire_agent.md, spire_server.md, and the upstreamauthority_spire plugin doc present experimental settings.

Finally, checkPodReferenceScope became dead code once agent_node pod resolution was limited to the kubelet and stopped falling back to the API server. It was only reachable on the cluster-scope path, where it is a no-op, so this removes the function and its two call sites.

[Copilot]

Pull request overview

Follow-up to Broker API support in the k8s workload attestor, focusing on aligning documentation/examples with the plugin’s current experimental config shape and removing now-dead scope-check logic from the attestation implementation.

Changes:

• Removed dead checkPodReferenceScope logic and its call sites in the k8s workload attestor.
• Reworked k8s workload attestor plugin docs to present experimental settings in a dedicated sub-table.
• Updated agent_full.conf k8s plugin example to nest broker under experimental and include the missing experimental.api_server.cache.enabled example.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
pkg/agent/plugin/workloadattestor/k8s/k8s.go	Removes unreachable pod-scope validation helper and call sites.
doc/plugin_agent_workloadattestor_k8s.md	Moves experimental options into a dedicated “experimental” configuration sub-table.
conf/agent/agent_full.conf	Updates the k8s plugin example to correctly nest Broker/API server cache config under experimental.

[matheuscscp]

Good catch! Since now we only look at the kubelet results for the agent_node scope, we no longer need this explicit check. Another good thing is that we no longer need to rely on the node name being properly configured in the plugin :)

Great catch on the docs as well!