feat(agent): add Helm chart support for Conjur JWT authentication

[roeezis]

Summary

Part 7 (final) of the SMS/Conjur JWT authentication series (split out of #817). Stacked on the prior 6 PRs in this series — diff will shrink to just this PR's own change once they merge.

Exposes config.cyberark's new Conjur JWT fields (serviceId, account, jwtSource) in values.yaml/values.schema.json, and documents per-cluster Conjur onboarding as a prerequisite in the chart README — the tenant administrator's own Conjur Cloud credentials, no admin credential needed at deploy time.

Test plan

• go build ./...
• helm lint deploy/charts/disco-agent/

[mladen-rusev-cyberark]

Chart renders cleanly and the env-var changes are right — ARK_SUBDOMAIN stays required, legacy keys become optional, so JWT-only installs need no username/password. expirationSeconds: 600 is the API-server minimum and works out fine given the kubelet rotates the file in place and jwtsource re-reads per exchange, so the 8-minute Conjur cache never outlives the projected token.

Findings are all in the volume wiring and the docs. One I couldn't leave inline:

Generated docs are stale. The ## Values section of README.md and values.schema.json are both generated by helm-tool (make/_shared/helm/helm.mk:98,106), and the new config.cyberark.* values are absent from the <!-- AUTO-GENERATED --> block (lines 146–520). So either the verify target fails in CI, or the schema was hand-edited into a shape helm-tool wouldn't produce. Please run make generate and commit the result — the existing values.yaml entries carry # +docs:property markers and the new block has none, which may be why generation skipped it.

Also: jwtSource has no enum in the schema, so a typo (fille) renders fine, deploys fine, and CrashLoops. Worth "enum": ["", "file"].

[roeezis]

Blocker fixed — took your recommended second option: dropped the jwtFilePath knob entirely (removed from values.yaml/values.schema.json/configmap.yaml) rather than trying to template mountPath from it. The agent's jwtsource.DefaultTokenPath already matches the chart's fixed mount path, so there's nothing left to misconfigure. Re-verified with your exact repro command — jwt_file_path no longer appears in the rendered config at all, and the mount is unconditionally the working path.

[roeezis]

Fixed — gated both the volume and the mount on a new disco-agent.conjurJWTEnabled named template (serviceId set AND jwtSource unset-or-"file"), used in both places so they can't drift out of sync again. A pure username/password install now renders zero references to the conjur-token volume.

On audience: documented in the README's troubleshooting table that it's fixed at conjur, not a values.yaml setting, rather than adding a config knob nothing currently needs.

[roeezis]

Both addressed:

• The startup-failure claim is now actually true independent of sendSecretValues — fixed the underlying agent-side gap in feat(agent): wire Conjur JWT config into the top-level CyberArk client #823 (config-validation now requires service_id or ARK_USERNAME at ValidateAndCombineConfig time, not deferred to first upload), so kept the README sentence as-is rather than hedging it.
• Replaced the kubectl patch --type=json snippet with two plain kubectl create secret variants (with/without ARK_DISCOVERY_API) — simpler, no shell-quoting/base64-portability issues.

[roeezis]

Added "enum": ["", "file"] — a typo now fails at helm install instead of a CrashLoopBackOff.

[roeezis]

Dropped the markers — nothing regenerates this chart, and they implied otherwise. The cyberark.* fields stay hand-documented above the section, where they already were.