From c8a9ba119630a91b453e8a198a1e86b821175d58 Mon Sep 17 00:00:00 2001
From: Volodymyr Stoiko <me@volodymyrstoiko.com>
Date: Fri, 7 Aug 2026 05:34:58 +0000
Subject: [PATCH] helm: gate worker hub token on the same condition as hub
 AUTH_ENABLED (#1954)

The hub's AUTH_ENABLED is derived from cloudLicenseEnabled/demoModeEnabled/
tap.auth.enabled, but the worker DaemonSet gated HUB_INTERNAL_TOKEN_PATH, its
volumeMount and the projected serviceAccountToken on tap.auth.enabled alone.
With demoModeEnabled: true (or the default cloudLicenseEnabled: true) and
tap.auth.enabled unset, the hub required a bearer token the workers never got,
so every worker -> hub call returned 401: tracer target refresh and name
resolution history silently stopped while capture kept working.

Extract the condition into a kubeshark.authEnabled helper and consume it from
both 12-config-map.yaml and 09-worker-daemon-set.yaml so the two cannot drift.
AUTH_ENABLED renders identically to before for all combinations of
cloudLicenseEnabled/license/demoModeEnabled/tap.auth.enabled/tap.auth.type.
---
 helm-chart/templates/09-worker-daemon-set.yaml |  6 +++---
 helm-chart/templates/12-config-map.yaml        |  6 +-----
 helm-chart/templates/_helpers.tpl              | 14 ++++++++++++++
 3 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/helm-chart/templates/09-worker-daemon-set.yaml b/helm-chart/templates/09-worker-daemon-set.yaml
index 713062e35..49810bb91 100644
--- a/helm-chart/templates/09-worker-daemon-set.yaml
+++ b/helm-chart/templates/09-worker-daemon-set.yaml
@@ -146,7 +146,7 @@ spec:
             value: '{{ (include "sentry.enabled" .) }}'
           - name: SENTRY_ENVIRONMENT
             value: '{{ .Values.tap.sentry.environment }}'
-          {{- if (((.Values.tap).auth).enabled) }}
+          {{- if eq (include "kubeshark.authEnabled" .) "true" }}
           - name: HUB_INTERNAL_TOKEN_PATH
             value: /var/run/secrets/kubeshark/hub-token/token
           {{- end }}
@@ -239,7 +239,7 @@ spec:
 {{- if .Values.tap.persistentStorage }}
               subPathExpr: $(NODE_NAME)
 {{- end }}
-            {{- if (((.Values.tap).auth).enabled) }}
+            {{- if eq (include "kubeshark.authEnabled" .) "true" }}
             - mountPath: /var/run/secrets/kubeshark/hub-token
               name: hub-internal-token
               readOnly: true
@@ -439,7 +439,7 @@ spec:
           emptyDir:
             sizeLimit: {{ .Values.tap.storageLimit }}
 {{- end }}
-        {{- if (((.Values.tap).auth).enabled) }}
+        {{- if eq (include "kubeshark.authEnabled" .) "true" }}
         - name: hub-internal-token
           projected:
             sources:
diff --git a/helm-chart/templates/12-config-map.yaml b/helm-chart/templates/12-config-map.yaml
index aa7d8aa9f..ecc396f5c 100644
--- a/helm-chart/templates/12-config-map.yaml
+++ b/helm-chart/templates/12-config-map.yaml
@@ -18,11 +18,7 @@ data:
     INGRESS_ENABLED: '{{ .Values.tap.ingress.enabled }}'
     INGRESS_HOST: '{{ .Values.tap.ingress.host }}'
     PROXY_FRONT_PORT: '{{ .Values.tap.proxy.front.port }}'
-    AUTH_ENABLED: '{{- if and .Values.cloudLicenseEnabled (not (empty .Values.license)) -}}
-                        {{ (default false .Values.demoModeEnabled) | ternary true ((and .Values.tap.auth.enabled (or (eq .Values.tap.auth.type "oidc") (eq .Values.tap.auth.type "dex"))) | ternary true false) }}
-                  {{- else -}}
-                        {{ .Values.cloudLicenseEnabled | ternary "true" ((default false .Values.demoModeEnabled) | ternary "true" .Values.tap.auth.enabled) }}
-                  {{- end }}'
+    AUTH_ENABLED: '{{ include "kubeshark.authEnabled" . }}'
     AUTH_TYPE: '{{- if and .Values.cloudLicenseEnabled (not (or (eq .Values.tap.auth.type "oidc") (eq .Values.tap.auth.type "dex"))) -}}
                   default
                 {{- else -}}
diff --git a/helm-chart/templates/_helpers.tpl b/helm-chart/templates/_helpers.tpl
index dd60cd68d..fde9514e2 100644
--- a/helm-chart/templates/_helpers.tpl
+++ b/helm-chart/templates/_helpers.tpl
@@ -110,3 +110,17 @@ Dex IdP: retrieve a secret for static client with a specific ID
     {{- end }}
   {{- end }}
 {{- end }}
+
+{{/*
+Single source of truth for whether the hub enforces authentication.
+Consumed by the hub ConfigMap (AUTH_ENABLED) and by the worker DaemonSet, which
+must mount an internal hub token whenever the hub requires one. Keeping the two
+in sync prevents workers from being issued no token while the hub demands one.
+*/}}
+{{- define "kubeshark.authEnabled" -}}
+{{- if and .Values.cloudLicenseEnabled (not (empty .Values.license)) -}}
+{{ (default false .Values.demoModeEnabled) | ternary true ((and .Values.tap.auth.enabled (or (eq .Values.tap.auth.type "oidc") (eq .Values.tap.auth.type "dex"))) | ternary true false) }}
+{{- else -}}
+{{ .Values.cloudLicenseEnabled | ternary "true" ((default false .Values.demoModeEnabled) | ternary "true" .Values.tap.auth.enabled) }}
+{{- end -}}
+{{- end -}}