Add provider_type segment to onboarding branches, fix configmap/tests/README

Cross-PR review caught real bugs missed by unit tests on both sides:

- onboard-disco-agent.sh created per-cluster branches at data/<cluster-UUID>,
  but the authorizer's agent_provider_from_identity() expects
  host/data/<provider_type>/<provider_id>/workloads/<sub>. Real onboarded
  agents produced an identity the authorizer's own parser rejects. Fixed by
  adding a data/<type> branch before the cluster branch (now C1-C7, was
  C1-C6); verified end-to-end against the real authorizer parser.

- templates/configmap.yaml never rendered the cyberark: block into the
  agent's config.yaml, despite values.yaml/values.schema.json declaring
  those fields — Conjur-JWT auth was silently unreachable via this chart.

- TestConfig_CyberArk_Validation had two subtests asserting a config-time
  "service_id is required" error that no longer exists (validation moved to
  runtime, ErrNoAuthMethod). Updated to assert the current contract.

- README's onboarding section documented a stale v1 policy-file mechanism
  that doesn't match what the v2-API script does, and never mentioned the
  script exists. Rewrote to point at hack/onboard-disco-agent.sh. Also fixed
  a self-contradicting serviceId example in both the README table and
  values.schema.json (prose said "bare segment", the example showed the
  full policy path).

Author: rzisholz

deploy/charts/disco-agent/README.md

@@ -82,7 +82,7 @@ CyberArk-hosted tenants:
 
 | Value | Default | Description |
 |---|---|---|
-| `config.cyberark.serviceId` | `""` | Conjur authn-jwt service ID (required). Example: `conjur/authn-jwt/disco-agent` |
+| `config.cyberark.serviceId` | `""` | Conjur authn-jwt service ID (required). Example: `disco-agent` |
 | `config.cyberark.account` | `conjur` | Conjur account name. Always `conjur` for CyberArk-hosted tenants. |
 | `config.cyberark.jwtSource` | `file` | Token source. `file` = projected SA-token volume (default). `spiffe` deferred. |
 | `config.cyberark.jwtFilePath` | `/var/run/secrets/tokens/jwt` | Path to the projected token file. Auto-mounted by the chart when `jwtSource=file`. |
@@ -94,68 +94,33 @@ configuration is required.
 
 ### Per-tenant Conjur onboarding
 
-Before deploying the agent against a new tenant, complete the following steps
-in the Conjur tenant:
-
-1. **Enable the authn-jwt authenticator** with `audience=conjur` and
-   `token-app-property=sub`.
-
-   ```yaml
-   # conjur-authn-jwt-policy.yml
-   - !policy
-     id: conjur/authn-jwt/disco-agent
-     body:
-       - !webservice
-
-       - !variable jwks-uri
-       - !variable token-app-property
-       - !variable issuer
-       - !variable audience
-
-       - !group hosts
-       - !permit
-         role: !group hosts
-         privilege: [ read, authenticate ]
-         resource: !webservice
-   ```
-
-2. **Set the authenticator variables** (values shown as examples):
-
-   ```sh
-   conjur variable set -i conjur/authn-jwt/disco-agent/token-app-property -v sub
-   conjur variable set -i conjur/authn-jwt/disco-agent/audience           -v conjur
-   conjur variable set -i conjur/authn-jwt/disco-agent/issuer             -v https://kubernetes.default.svc.cluster.local
-   conjur variable set -i conjur/authn-jwt/disco-agent/jwks-uri           -v https://kubernetes.default.svc.cluster.local/openid/v1/jwks
-   ```
-
-3. **Pre-create a Conjur host** for the agent ServiceAccount. The `id` must
-   match the Kubernetes ServiceAccount's `sub` claim
-   (`system:serviceaccount:<namespace>:<sa-name>`):
-
-   ```yaml
-   # conjur-agent-host-policy.yml
-   - !host
-     id: system:serviceaccount/cyberark/disco-agent
-     annotations:
-       authn-jwt/disco-agent/sub: system:serviceaccount/cyberark/disco-agent
-   ```
-
-4. **Add the host to the `data/disco/snapshot-uploaders` group** so the
-   authorizer grants it upload access:
-
-   ```yaml
-   - !grant
-     role: !group data/disco/snapshot-uploaders
-     member: !host system:serviceaccount/cyberark/disco-agent
-   ```
-
-5. **Add the host to the authn-jwt authenticator's hosts group**:
-
-   ```yaml
-   - !grant
-     role: !group conjur/authn-jwt/disco-agent/hosts
-     member: !host system:serviceaccount/cyberark/disco-agent
-   ```
+Onboarding uses the Conjur Cloud **v2 REST API** (JSON objects), not v1 policy
+files — run `hack/onboard-disco-agent.sh` against the target tenant before
+deploying the agent. The script performs all of it with the **customer's own**
+Conjur Cloud admin token; DisCo holds no Conjur identity of its own:
+
+```sh
+CONJUR_TOKEN="$(cat admin-token.txt)" \
+  hack/onboard-disco-agent.sh \
+    --ark-subdomain <tenant-subdomain> \
+    --issuer https://kubernetes.default.svc.cluster.local
+```
+
+Tenant-level (once per tenant per provider type): creates the `data/disco`
+branch, a per-type uploader group, and a value-less "probe" secret that only
+the uploader group can `read`+`execute` — that probe is the entire
+authorization decision at request time (no policy `!permit`/`!grant` needed).
+
+Per-cluster (each onboard): creates `data/<provider-type>/<cluster-UUID>` and
+its `workloads` sub-branch, an `authn-jwt` authenticator scoped to the
+cluster's real OIDC issuer + JWKS, registers the agent's workload under that
+branch, and grants it both the authenticator's `apps` group (to authenticate)
+and the uploader group (to pass the probe, i.e. to authorize).
+
+`CLUSTER_UUID` (the `kube-system` namespace UID), the OIDC issuer, and the JWKS
+are auto-derived from the current `kubectl` context if not passed explicitly.
+See the script's header comment for the full `--dry-run`/`--skip-deploy` flag
+reference.
 
 ### Deploy the agent
 
@@ -186,7 +151,7 @@ kubectl logs deployments/disco-agent --namespace "${NAMESPACE}" --follow
 | Symptom | Likely cause | Fix |
 |---|---|---|
 | Agent logs `401 Unauthorized` from Conjur | ServiceAccount token `audience` does not match the authenticator's configured `audience` value, or the authn-jwt authenticator is not enabled for the account | Confirm `audience=conjur` in both the projected volume (chart default) and the Conjur `conjur/authn-jwt/<serviceId>/audience` variable; ensure the authenticator is enabled (`CONJUR_AUTHENTICATORS` includes `authn-jwt/<serviceId>`) |
-| Agent logs `403 Forbidden` from the upload API | The agent's Conjur host is not a member of `data/disco/snapshot-uploaders` | Add the host to the group per step 4 of the onboarding runbook above |
+| Agent logs `403 Forbidden` from the upload API | The agent's workload is not a member of `data/disco/<type>-uploaders` (fails the authz probe) | Re-run `hack/onboard-disco-agent.sh` for this cluster — it's idempotent |
 | Agent logs `500` / no upload attempt | Conjur is unreachable or returned an unexpected error | Check network policy / DNS; inspect Conjur audit logs for the host identity |
 
 ## Values

deploy/charts/disco-agent/templates/configmap.yaml

@@ -10,6 +10,11 @@ data:
     cluster_name: {{ .Values.config.clusterName | quote }}
     cluster_description: {{ .Values.config.clusterDescription | quote }}
     period: {{ .Values.config.period | quote }}
+    cyberark:
+      service_id: {{ .Values.config.cyberark.serviceId | quote }}
+      account: {{ .Values.config.cyberark.account | quote }}
+      jwt_source: {{ .Values.config.cyberark.jwtSource | quote }}
+      jwt_file_path: {{ .Values.config.cyberark.jwtFilePath | quote }}
     {{- with .Values.config.excludeAnnotationKeysRegex }}
     exclude-annotation-keys-regex:
       {{- . | toYaml | nindent 6 }}

deploy/charts/disco-agent/values.schema.json

@@ -188,7 +188,7 @@
     },
     "helm-values.config.cyberark.serviceId": {
       "default": "",
-      "description": "The Conjur authn-jwt authenticator service ID configured for this tenant. Example: conjur/authn-jwt/disco-agent",
+      "description": "The Conjur authn-jwt authenticator service ID configured for this tenant. Bare segment, not the policy path. Example: disco-agent",
       "type": "string"
     },
     "helm-values.config.excludeAnnotationKeysRegex": {

hack/onboard-disco-agent.sh

@@ -15,12 +15,20 @@
 #     T3  POST /secrets/static                    -> data/disco/<type>-uploaders-probe
 #         (NO value; group granted ["read","execute"] — the authz probe object)
 #   Per-cluster (each onboard)
-#     C1  POST /branches                          -> data/<cluster-UUID>
-#     C2  POST /branches                          -> data/<cluster-UUID>/workloads
-#     C3  POST /authenticators                    -> authn-jwt/<cluster-UUID> (enabled)
-#     C4  POST /workloads/                        -> workload under .../workloads
-#     C5  POST /groups/<apps>/members             -> workload (authenticate grant)
-#     C6  POST /groups/<uploaders>/members        -> workload (authorize grant, Layer 1)
+#     C1  POST /branches                          -> data/<type>
+#     C2  POST /branches                          -> data/<type>/<cluster-UUID>
+#     C3  POST /branches                          -> data/<type>/<cluster-UUID>/workloads
+#     C4  POST /authenticators                    -> authn-jwt/<cluster-UUID> (enabled)
+#     C5  POST /workloads/                        -> workload under .../workloads
+#     C6  POST /groups/<apps>/members             -> workload (authenticate grant)
+#     C7  POST /groups/<uploaders>/members        -> workload (authorize grant, Layer 1)
+#
+#   Workload branch is data/<type>/<cluster-UUID>/workloads/<sub> so the agent's
+#   whoami identity is host/data/<type>/<cluster-UUID>/workloads/<sub> — the
+#   provider-neutral (provider_type, provider_id) shape the authorizer's
+#   agent_provider_from_identity() parses (Layer 2: route-type match + FIS
+#   cluster-forgery check). A bare data/<cluster-UUID>/workloads branch (missing
+#   the <type> segment) produces an identity the authorizer's parser rejects.
 #   Then (unless --skip-deploy): create the agent-credentials Secret + helm install.
 #
 # Requirements: curl, jq, kubectl, helm. A Conjur Cloud admin access token
@@ -139,7 +147,8 @@ if [[ -z "$CONJUR_BASE_URL" ]]; then
 fi
 
 SA_SUB="system:serviceaccount:${SA_NAMESPACE}:${SA_NAME}"   # real k8s sub claim
-CLUSTER_BRANCH="data/${CLUSTER_UUID}"
+TYPE_BRANCH="data/${PROVIDER_TYPE}"
+CLUSTER_BRANCH="${TYPE_BRANCH}/${CLUSTER_UUID}"
 WORKLOAD_BRANCH="${CLUSTER_BRANCH}/workloads"
 UPLOADERS_GROUP="data/disco/${PROVIDER_TYPE}-uploaders"
 PROBE_SECRET="${UPLOADERS_GROUP}-probe"
@@ -222,13 +231,19 @@ echo
 # ---------------------------------------------------------------------------
 echo "--- Per-cluster (${CLUSTER_UUID}) ---"
 
-# C1/C2: cluster branch + workloads sub-branch
-api POST /branches "{\"name\":\"${CLUSTER_UUID}\",\"branch\":\"data\",\"owner\":{\"kind\":\"group\",\"id\":\"Conjur_Cloud_Admins\"}}" >/dev/null
-echo "  C1 branch ${CLUSTER_BRANCH}"
+# C1/C2/C3: provider-type branch + cluster branch + workloads sub-branch.
+# The type segment is required — the authorizer's agent_provider_from_identity()
+# parses whoami identities as host/data/<type>/<cluster-UUID>/workloads/<sub>;
+# without it, the identity is structurally rejected and Layer-2 (route-type
+# match + FIS cluster-forgery check) silently never resolves for this agent.
+api POST /branches "{\"name\":\"${PROVIDER_TYPE}\",\"branch\":\"data\",\"owner\":{\"kind\":\"group\",\"id\":\"Conjur_Cloud_Admins\"}}" >/dev/null
+echo "  C1 branch ${TYPE_BRANCH}"
+api POST /branches "{\"name\":\"${CLUSTER_UUID}\",\"branch\":\"${TYPE_BRANCH}\",\"owner\":{\"kind\":\"group\",\"id\":\"Conjur_Cloud_Admins\"}}" >/dev/null
+echo "  C2 branch ${CLUSTER_BRANCH}"
 api POST /branches "{\"name\":\"workloads\",\"branch\":\"${CLUSTER_BRANCH}\",\"owner\":{\"kind\":\"group\",\"id\":\"Conjur_Cloud_Admins\"}}" >/dev/null
-echo "  C2 branch ${WORKLOAD_BRANCH}"
+echo "  C3 branch ${WORKLOAD_BRANCH}"
 
-# C3: authn-jwt authenticator named after the cluster-UUID. Trust root is the
+# C4: authn-jwt authenticator named after the cluster-UUID. Trust root is the
 # REAL cluster OIDC (issuer + jwks/public-keys), never a snapshot.
 if [[ -n "$PUBLIC_KEYS" ]]; then
   KEYS_FIELD="\"public_keys\":{\"type\":\"jwks\",\"value\":${PUBLIC_KEYS}}"
@@ -241,30 +256,30 @@ api POST /authenticators "$(cat <<JSON
    "identity":{"token_app_property":"sub","identity_path":"${WORKLOAD_BRANCH}"}}}
 JSON
 )" >/dev/null
-echo "  C3 authenticator authn-jwt/${CLUSTER_UUID} (enabled)"
+echo "  C4 authenticator authn-jwt/${CLUSTER_UUID} (enabled)"
 
-# C4: the agent workload, under the cluster's workloads sub-branch.
+# C5: the agent workload, under the cluster's workloads sub-branch.
 api POST /workloads/ "$(cat <<JSON
 {"name":"${SA_SUB}","branch":"${WORKLOAD_BRANCH}","type":"other",
  "authn_descriptors":[{"type":"jwt","service_id":"${CLUSTER_UUID}","data":{"sub":"${SA_SUB}"}}]}
 JSON
 )" >/dev/null
-echo "  C4 workload ${WORKLOAD_BRANCH}/${SA_SUB}"
+echo "  C5 workload ${WORKLOAD_BRANCH}/${SA_SUB}"
 
 WORKLOAD_ID="${WORKLOAD_BRANCH}/${SA_SUB}"
 
-# C5: authenticate grant — add the workload to the authenticator's apps group.
-# The apps-group identifier is created by C3. Confirm its exact id against the
+# C6: authenticate grant — add the workload to the authenticator's apps group.
+# The apps-group identifier is created by C4. Confirm its exact id against the
 # create-authenticator response for your tenant; convention below.
 APPS_GROUP="conjur/authn-jwt/${CLUSTER_UUID}/apps"
 api POST "/groups/$(urlencode "$APPS_GROUP")/members" \
   "{\"id\":\"${WORKLOAD_ID}\",\"kind\":\"workload\"}" >/dev/null
-echo "  C5 authenticate grant: ${WORKLOAD_ID} -> ${APPS_GROUP}"
+echo "  C6 authenticate grant: ${WORKLOAD_ID} -> ${APPS_GROUP}"
 
-# C6: authorize grant (Layer 1) — add the workload to the per-type uploader group.
+# C7: authorize grant (Layer 1) — add the workload to the per-type uploader group.
 api POST "/groups/$(urlencode "$UPLOADERS_GROUP")/members" \
   "{\"id\":\"${WORKLOAD_ID}\",\"kind\":\"workload\"}" >/dev/null
-echo "  C6 authorize grant: ${WORKLOAD_ID} -> ${UPLOADERS_GROUP}"
+echo "  C7 authorize grant: ${WORKLOAD_ID} -> ${UPLOADERS_GROUP}"
 
 echo
 echo "=== Conjur onboarding complete for cluster ${CLUSTER_UUID} ==="

pkg/agent/config_test.go

@@ -1330,25 +1330,30 @@ func TestConfig_CyberArk_Validation(t *testing.T) {
 		t.Setenv("ARK_SUBDOMAIN", "tlspk")
 	}
 
-	t.Run("empty service_id produces an error", func(t *testing.T) {
+	// service_id is no longer required at config-validation time: the agent
+	// also supports the legacy username/password method (ARK_USERNAME/ARK_SECRET,
+	// set via env, not config), and cyberark.selectAuthenticator fails closed at
+	// runtime (ErrNoAuthMethod) if neither method ends up configured. See the
+	// comment on this validation block in config.go.
+	t.Run("empty service_id is valid at config time", func(t *testing.T) {
 		setEnv(t)
-		_, _, err := ValidateAndCombineConfig(discardLogs(),
+		_, combined, err := ValidateAndCombineConfig(discardLogs(),
 			withConfig(testutil.Undent(`
 				cyberark:
 				  service_id: ""
 			`)),
 			withCmdLineFlags("--period", "1m", "--machine-hub"))
-		require.Error(t, err)
-		assert.Contains(t, err.Error(), "cyberark.service_id is required in MachineHub mode")
+		require.NoError(t, err)
+		assert.Equal(t, "", combined.CyberArk.ServiceID)
 	})
 
-	t.Run("missing cyberark block produces a service_id error", func(t *testing.T) {
+	t.Run("missing cyberark block is valid at config time", func(t *testing.T) {
 		setEnv(t)
-		_, _, err := ValidateAndCombineConfig(discardLogs(),
+		_, combined, err := ValidateAndCombineConfig(discardLogs(),
 			withConfig(""),
 			withCmdLineFlags("--period", "1m", "--machine-hub"))
-		require.Error(t, err)
-		assert.Contains(t, err.Error(), "cyberark.service_id is required in MachineHub mode")
+		require.NoError(t, err)
+		assert.Equal(t, "", combined.CyberArk.ServiceID)
 	})
 
 	t.Run("jwt_source spiffe is rejected", func(t *testing.T) {