Send the VenafiConnection's NGTS workspace ID on the token request

[wallrj-cyberark]

The agent can now use an NGTS Workload Identity Federation (OIDC) service account that belongs to a workspace. Set spec.ngts.workspaceID on the VenafiConnection, and the agent sends it on the token request.

Why now?

NGTS changed how it finds OIDC service accounts. If the token request has no workspace_id, NGTS now only looks at tenant-level accounts. So an OIDC account that lives in a workspace fails with 400 invalid_client "Not found", and the agent cannot use it through a VenafiConnection.

jetstack/venafi-connection-lib#472 added spec.ngts.workspaceID and sends it on the token request. This PR picks that up. Until it is released, you can work around the problem by using a tenant-level service account.

What changes

• Bump venafi-connection-lib to the jetstack/venafi-connection-lib#472 merge commit (62e2d37). No release contains it yet. We can switch to a tagged version once one is cut.
• Regenerate the VenafiConnection CRD in both charts. Without the new field in the CRD, the API server drops spec.ngts.workspaceID.
• Add an NGTS case to the VenafiConnection envtest suite. It checks that workspace_id reaches the token request.

Without workspaceID, nothing changes: the token request has no workspace_id parameter.

Example

A VenafiConnection for an agent whose WIF service account belongs to workspace 1000:

apiVersion: jetstack.io/v1alpha1
kind: VenafiConnection
metadata:
  name: ngts-connection
  namespace: venafi
spec:
  ngts:
    tsgID: "<your-tsgID>"
    workspaceID: "1000" # The workspace that the service account belongs to
    jwt:
    - serviceAccountToken:
        name: workload-identity-sa
        audiences: ["<audience-configured-on-the-service-account>"]

The discovery-agent chart then points at it as usual:

config:
  venafiConnection:
    enabled: true
    name: ngts-connection
    namespace: venafi

Leave workspaceID unset for a tenant-level service account, and for a private key JWT service account.

Please check before merging

The library bump raises k8s.io/* to v0.37.0 and controller-runtime to v0.25.0. venafi-connection-lib's main branch requires them, so Go picks them up automatically.

How this was tested

• Live NGTS e2e (test-ngts). It passed against a QA tenant, which shows that keypair (private key) auth and uploads still work after the dependency bump. It doesn't use a workspace, so it doesn't exercise the new field.
• make test-unit: 466 tests pass. The new case TestVenConnClient_PostDataReadingsWithOptions/ngts_with_workspaceID creates a VenafiConnection with workspaceID: "1000". It checks that the NGTS token request carries workspace_id=1000. With the old CRD, the test fails because the API server prunes the unknown field.
• make verify passes.
• Not yet tested: a WIF service account in a workspace on a live tenant, through the agent. jetstack/venafi-connection-lib#472 has live tests for that token request. We plan to test the agent with an alpha release after merge.

What this PR deliberately does not do

• No workspace_id on uploads. NGTS ignores it there: uploads are scoped to the workspace of the service account that authenticated.
• No --workspace-id flag or config.workspaceID value for keypair mode. NGTS identifies a private-key service account by its client ID and ignores workspace_id, so the option would have no effect.

Generated files

• The four VenafiConnection CRD copies (two charts, with and without validations) come from make generate. They also pick up other changes made to the library since the previous pin.
• LICENSES changes come from the dependency bump.

Release note: the agent can use an NGTS Workload Identity Federation service account that belongs to a workspace. Set spec.ngts.workspaceID on the VenafiConnection.

[with Claude]

[mladen-rusev-cyberark]

LGTM,