From bad778d4783ce096f4a1b1082fd59ed90b53b673 Mon Sep 17 00:00:00 2001
From: Volodymyr Stoiko <me@volodymyrstoiko.com>
Date: Fri, 7 Aug 2026 06:13:40 +0000
Subject: [PATCH] helm: mount the hub internal token in the tracer container
 too (#1954)

The tracer polls the hub's /pods/all and /pods/targeted on every sync cycle,
but only the sniffer container received HUB_INTERNAL_TOKEN_PATH and the token
mount, so with auth enabled the tracer's requests were rejected and TLS hooking
never picked up newly started pods. Wire the same env var and projected-token
mount into the tracer container.

Requires the matching tracer2 change that sends the Bearer header.
---
 helm-chart/templates/09-worker-daemon-set.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/helm-chart/templates/09-worker-daemon-set.yaml b/helm-chart/templates/09-worker-daemon-set.yaml
index 49810bb91..61485b249 100644
--- a/helm-chart/templates/09-worker-daemon-set.yaml
+++ b/helm-chart/templates/09-worker-daemon-set.yaml
@@ -284,6 +284,10 @@ spec:
             value: '{{ (include "sentry.enabled" .) }}'
           - name: SENTRY_ENVIRONMENT
             value: '{{ .Values.tap.sentry.environment }}'
+          {{- if eq (include "kubeshark.authEnabled" .) "true" }}
+          - name: HUB_INTERNAL_TOKEN_PATH
+            value: /var/run/secrets/kubeshark/hub-token/token
+          {{- end }}
           resources:
             limits:
               {{ if ne (toString .Values.tap.resources.tracer.limits.cpu) "0" }}
@@ -359,6 +363,11 @@ spec:
               mountPropagation: HostToContainer
               name: root
               readOnly: true
+            {{- if eq (include "kubeshark.authEnabled" .) "true" }}
+            - mountPath: /var/run/secrets/kubeshark/hub-token
+              name: hub-internal-token
+              readOnly: true
+            {{- end }}
       {{- end }}
       dnsPolicy: ClusterFirstWithHostNet
       hostNetwork: {{ .Values.tap.hostNetwork }}