CP-21164: wire Conjur JWT config into the top-level CyberArk client

NewCyberArk and the agent config schema were still legacy-username/password-only
at the top level, even though the underlying authenticator selection (previous
PR) already supports Conjur JWT. Threads service_id/account/jwt_source/jwt_file_path
through cyberark.service_id in the agent config down to NewCyberArk, so the
config file is the single place an operator chooses which authentication method
to use.

config.go's call site and client_cyberark.go's signature change together —
splitting them across two PRs would leave one non-building at every commit
in between.

jwt_source validation now delegates to the shared cyberark.ValidateJWTSource
(previous PR) instead of re-implementing the same rule with different wording.

Requiring an auth method is now checked at config-validation time rather than
left to cyberark.selectAuthenticator alone — that only runs at first upload,
so a misconfigured agent could otherwise report healthy for up to a full
config.period before failing. Checks both ARK_USERNAME and ARK_SECRET, since
selectAuthenticator's hasUP requires both — checking only ARK_USERNAME would
pass validation and still fail at runtime for the one credential missing.

MachineHub's cluster_name fallback order is cluster_name > cluster_id >
ARK_USERNAME > empty. Explicit config always wins over the env var; the
ARK_USERNAME fallback exists only for pre-Conjur installs that set neither
config field — the chart never emits cluster_id, so a chart-installed agent
can't have set it. This also keeps a migrating install's reported name
unchanged: adding service_id to test Conjur alongside still-present
ARK_USERNAME, before also setting cluster_id, doesn't blank out the name.

Adds FakeCyberArkUsernamePassword and matching integration tests: the only
existing test exercising NewCyberArk's username/password path set
ARK_USERNAME/ARK_SECRET but also passed a non-empty serviceID, which
selectAuthenticator prioritises — so it silently tested Conjur regardless of
those env vars, leaving the legacy path with no coverage through this seam.
Also adds a two-upload regression test for the previous PR's cfg.Secret
zeroing fix, which a single-upload test can't catch.

Author: rzisholz

pkg/agent/config.go

@@ -17,6 +17,7 @@ import (
 	"k8s.io/client-go/rest"
 
 	"github.com/jetstack/preflight/api"
+	"github.com/jetstack/preflight/internal/cyberark"
 	"github.com/jetstack/preflight/pkg/client"
 	"github.com/jetstack/preflight/pkg/datagatherer"
 	"github.com/jetstack/preflight/pkg/datagatherer/k8sdiscovery"
@@ -64,6 +65,9 @@ type Config struct {
 	DataGatherers  []DataGatherer     `yaml:"data-gatherers"`
 	VenafiCloud    *VenafiCloudConfig `yaml:"venafi-cloud,omitempty"`
 
+	// CyberArk holds configuration for MachineHub mode (POC).
+	CyberArk *CyberArkConfig `yaml:"cyberark,omitempty"`
+
 	// For testing purposes.
 	InputPath string `yaml:"input-path"`
 	// For testing purposes.
@@ -101,6 +105,19 @@ type VenafiCloudConfig struct {
 	UploadPath string `yaml:"upload_path,omitempty"`
 }
 
+// CyberArkConfig holds YAML configuration for MachineHub (CyberArk) mode (POC).
+type CyberArkConfig struct {
+	// ServiceID is the authn-jwt service ID configured in Conjur (e.g. "dev-cluster").
+	ServiceID string `yaml:"service_id"`
+	// Account is the Conjur account name. Defaults to "conjur" when empty.
+	Account string `yaml:"account"`
+	// JWTSource selects how the agent obtains its JWT. Must be "" or "file" in the POC.
+	JWTSource string `yaml:"jwt_source"`
+	// JWTFilePath is the path to the JWT file when jwt_source is "file".
+	// Defaults to the standard projected service-account token path when empty.
+	JWTFilePath string `yaml:"jwt_file_path"`
+}
+
 type AgentCmdFlags struct {
 	// ConfigFilePath (--config-file, -c) is the path to the agent configuration
 	// YAML file.
@@ -459,6 +476,9 @@ type CombinedConfig struct {
 	TSGID         string
 	NGTSServerURL string
 
+	// MachineHub mode only.
+	CyberArk CyberArkConfig
+
 	// Only used for testing purposes.
 	OutputPath string
 	InputPath  string
@@ -753,17 +773,31 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
 			clusterID = cfg.ClusterID
 		case MachineHub:
 			clusterName = cfg.ClusterName
+			if clusterName == "" && cfg.ClusterID != "" {
+				log.Info("Using cluster_id as cluster_name", "clusterID", cfg.ClusterID)
+				clusterName = cfg.ClusterID
+			}
 			if clusterName == "" {
-				if arkUsername, found := os.LookupEnv("ARK_USERNAME"); found {
-					log.Info("Using ARK_USERNAME environment variable as cluster name", "clusterName", arkUsername)
+				// Legacy fallback: pre-Conjur installs set neither
+				// cluster_name nor cluster_id — the chart only ever emitted
+				// cluster_name — and were named after ARK_USERNAME. Kept
+				// below both config fields so explicit configuration always
+				// wins; this never overrides a value the operator actually
+				// set. Naming a cluster after a login identity is an
+				// accident of the original design, worth retiring once
+				// installs set cluster_name explicitly, but the env var
+				// itself stays since it's still the username/password
+				// credential.
+				if arkUsername := os.Getenv("ARK_USERNAME"); arkUsername != "" {
+					log.Info("Using ARK_USERNAME as cluster name because neither cluster_name nor cluster_id is set; prefer setting cluster_name explicitly", "clusterName", arkUsername)
 					clusterName = arkUsername
 				}
 			}
 			if cfg.OrganizationID != "" {
 				log.Info(fmt.Sprintf(`Ignoring the organization_id field in the config file. This field is not needed in %s mode.`, res.OutputMode))
 			}
-			if cfg.ClusterID != "" {
-				log.Info(fmt.Sprintf(`Ignoring the cluster_id field in the config file. This field is not needed in %s mode.`, res.OutputMode))
+			if clusterName == "" {
+				log.Info("cluster_name is not set in MachineHub mode; cluster name will be empty")
 			}
 		}
 		res.OrganizationID = organizationID
@@ -773,6 +807,27 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
 		res.ClaimableCerts = cfg.ClaimableCerts
 	}
 
+	// Validation of `cyberark.*` (MachineHub mode only).
+	if res.OutputMode == MachineHub {
+		ark := CyberArkConfig{}
+		if cfg.CyberArk != nil {
+			ark = *cfg.CyberArk
+		}
+		// service_id selects the Conjur JWT exchange. It is no longer required:
+		// the agent also supports the legacy username/password method via
+		// ARK_USERNAME/ARK_SECRET. Checked here, at config-validation time,
+		// rather than left to cyberark.selectAuthenticator alone — that only
+		// runs at first upload, so a misconfigured agent would otherwise
+		// report healthy for up to a full config.period before failing.
+		if ark.ServiceID == "" && (os.Getenv("ARK_USERNAME") == "" || os.Getenv("ARK_SECRET") == "") {
+			errs = multierror.Append(errs, fmt.Errorf("MachineHub mode requires either cyberark.service_id or ARK_USERNAME/ARK_SECRET"))
+		}
+		if err := cyberark.ValidateJWTSource(ark.JWTSource); err != nil {
+			errs = multierror.Append(errs, fmt.Errorf("cyberark.jwt_source %w", err))
+		}
+		res.CyberArk = ark
+	}
+
 	// Validation of `data-gatherers`.
 	{
 		if dgErr := ValidateDataGatherers(cfg.DataGatherers); dgErr != nil {
@@ -987,7 +1042,7 @@ func validateCredsAndCreateClient(log logr.Logger, flagCredentialsPath, flagClie
 			rootCAs *x509.CertPool
 		)
 		httpClient := http_client.NewDefaultClient(version.UserAgent(), rootCAs)
-		outputClient, err = client.NewCyberArk(httpClient)
+		outputClient, err = client.NewCyberArk(httpClient, cfg.CyberArk.ServiceID, cfg.CyberArk.Account, cfg.CyberArk.JWTSource, cfg.CyberArk.JWTFilePath)
 		if err != nil {
 			errs = multierror.Append(errs, err)
 		}