helm: kubeshark-cli ServiceAccount + token-minter RBAC + allowlist (phase 2a)

When tap.auth.cli.enabled, create the kubeshark-cli ServiceAccount and a
Role granting 'create' on serviceaccounts/token for it (bound to
configurable tap.auth.cli.subjects), and set AUTH_CLI_SERVICE_ACCOUNTS so
the Hub allowlists it. Binding the Role to a subject is what grants that
subject CLI access to a gated Hub.

helm-chart/templates/12-config-map.yaml

@@ -30,6 +30,7 @@ data:
                 {{- end }}'
     AUTH_SAML_IDP_METADATA_URL: '{{ .Values.tap.auth.saml.idpMetadataUrl }}'
     AUTH_ROLES: '{{ .Values.tap.auth.roles | toJson }}'
+    AUTH_CLI_SERVICE_ACCOUNTS: '{{ if (((.Values.tap).auth).cli).enabled }}{{ .Release.Namespace }}:kubeshark-cli{{ end }}'
     AUTH_ROLES_CLAIM: '{{ .Values.tap.auth.rolesClaim }}'
     AUTH_DEFAULT_ROLE: '{{ default "" .Values.tap.auth.defaultRole }}'
     AUTH_OIDC_ISSUER: '{{ default "not set" (((.Values.tap).auth).oidc).issuer }}'

helm-chart/templates/22-cli-auth.yaml

@@ -0,0 +1,44 @@
+{{- if (((.Values.tap).auth).cli).enabled }}
+---
+# ServiceAccount the CLI mints a short-lived token for (TokenRequest API) to
+# authenticate to a gated Hub. Its name must match the Hub's
+# AUTH_CLI_SERVICE_ACCOUNTS allowlist and the CLI's kubeshark-cli constant.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    {{- include "kubeshark.labels" . | nindent 4 }}
+  name: kubeshark-cli
+  namespace: {{ .Release.Namespace }}
+---
+# Permission to mint a token for the kubeshark-cli SA. Binding this Role to a
+# subject is what grants that subject CLI access to a gated Hub.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    {{- include "kubeshark.labels" . | nindent 4 }}
+  name: kubeshark-cli-token-minter
+  namespace: {{ .Release.Namespace }}
+rules:
+  - apiGroups: [""]
+    resources: ["serviceaccounts/token"]
+    resourceNames: ["kubeshark-cli"]
+    verbs: ["create"]
+{{- with .Values.tap.auth.cli.subjects }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    {{- include "kubeshark.labels" $ | nindent 4 }}
+  name: kubeshark-cli-token-minter
+  namespace: {{ $.Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kubeshark-cli-token-minter
+subjects:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- end }}

helm-chart/values.yaml

@@ -169,6 +169,21 @@ tap:
     rolesClaim: role
     defaultRole: ""
     defaultFilter: ""
+    # CLI ServiceAccount-token auth (gated-auth phase 2a). When enabled, the
+    # chart creates a `kubeshark-cli` ServiceAccount and a Role permitting
+    # `create` on its token, and the Hub allowlists it via
+    # AUTH_CLI_SERVICE_ACCOUNTS. The CLI mints a short-lived token for that SA
+    # to authenticate to a gated Hub. Map `kubeshark-cli` to a role via
+    # `groupMapping` (or `defaultRole`); without a mapping it falls back to
+    # `defaultRole`.
+    cli:
+      enabled: false
+      # RBAC subjects allowed to mint the kubeshark-cli token — i.e. who may
+      # use the CLI against a gated Hub. Example:
+      #   - kind: User
+      #     name: alice@example.com
+      #     apiGroup: rbac.authorization.k8s.io
+      subjects: []
     saml:
       idpMetadataUrl: ""
       x509crt: ""