Send the NGTS workspace ID on token requests and uploads

- VenafiConnection mode: bump venafi-connection-lib to pick up
  spec.ngts.workspaceID. The library sends it on the token request; the
  agent now adds it to the upload too, using the library's
  http_client.WithWorkspaceID.
- NGTS keypair mode: add an optional --workspace-id flag and a
  config.workspaceID value in the discovery-agent chart. It is rejected
  outside --ngts, and the chart fails to render if it is set together
  with config.venafiConnection.enabled.
- Regenerate the VenafiConnection CRD in both charts.
- The library bump also raises k8s.io/* to v0.37.0 and
  controller-runtime to v0.25.0, which venafi-connection-lib requires.

NGTS now only finds an OIDC (workload identity) service account that
lives in a workspace when the token request names that workspace, so
the agent cannot use such an account through a VenafiConnection
without this change.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Richard Wall <richard.wall@cyberark.com>

Author: wallrj-cyberark

LICENSES

@@ -58,11 +58,11 @@ github.com/go-openapi/swag,Apache-2.0
 github.com/go-openapi/swag/cmdutils,Apache-2.0
 github.com/go-openapi/swag/conv,Apache-2.0
 github.com/go-openapi/swag/fileutils,Apache-2.0
-github.com/go-openapi/swag/jsonname,Apache-2.0
 github.com/go-openapi/swag/jsonutils,Apache-2.0
 github.com/go-openapi/swag/loading,Apache-2.0
 github.com/go-openapi/swag/mangling,Apache-2.0
 github.com/go-openapi/swag/netutils,Apache-2.0
+github.com/go-openapi/swag/pools,Apache-2.0
 github.com/go-openapi/swag/stringutils,Apache-2.0
 github.com/go-openapi/swag/typeutils,Apache-2.0
 github.com/go-openapi/swag/yamlutils,Apache-2.0
@@ -100,6 +100,8 @@ github.com/sosodev/duration,MIT
 github.com/spf13/cobra,Apache-2.0
 github.com/spf13/pflag,BSD-3-Clause
 github.com/stretchr/testify,MIT
+github.com/stretchr/testify/internal/difflib,BSD-3-Clause
+github.com/stretchr/testify/internal/spew,ISC
 github.com/valyala/fastjson,MIT
 github.com/x448/float16,MIT
 go.opentelemetry.io/otel,Apache-2.0

deploy/charts/discovery-agent/README.md

@@ -30,6 +30,15 @@ The namespace in which the 'venafi-connection' service account lives. This is th
 The TSG (Tenant Service Group) ID to use when connecting to SCM. The production SCM server URL is derived from this value. Required unless config.serverURL is set. Mutually exclusive with config.serverURL. Must not be set when config.venafiConnection.enabled is true (the TSG ID is taken from the VenafiConnection's `spec.ngts` instead).
 
 
+#### **config.workspaceID** ~ `number,string`
+> Default value:
+> ```yaml
+> ""
+> ```
+
+The ID of the SCM workspace that the service account belongs to (optional). Sent as the `workspace_id` query parameter on the token request and on uploads. SCM uses the workspace of the service account that authenticated, so it ignores this value today. Must not be set when config.venafiConnection.enabled is true (set `spec.ngts.workspaceID` in the VenafiConnection instead).
+
+
 #### **config.clusterName** ~ `string`
 > Default value:
 > ```yaml
@@ -108,7 +117,7 @@ Must not be set when config.venafiConnection.enabled is true (the credentials Se
 > false
 > ```
 
-When set to true, config.tsgID, config.serverURL, config.clientID and config.clientId must not be set (the chart will fail to render otherwise), and the Secret named by config.secretName will _not_ be mounted into the Discovery Agent Pod.
+When set to true, config.tsgID, config.workspaceID, config.serverURL, config.clientID and config.clientId must not be set (the chart will fail to render otherwise), and the Secret named by config.secretName will _not_ be mounted into the Discovery Agent Pod.
 #### **config.venafiConnection.name** ~ `string`
 > Default value:
 > ```yaml

deploy/charts/discovery-agent/crd_bases/jetstack.io_venaficonnections.yaml

@@ -75,6 +75,9 @@ spec:
             {{- if .Values.config.tsgID }}
               {{- fail "config.tsgID must not be set when config.venafiConnection.enabled is true; the TSG ID is read from the VenafiConnection's spec.ngts" }}
             {{- end }}
+            {{- if .Values.config.workspaceID }}
+              {{- fail "config.workspaceID must not be set when config.venafiConnection.enabled is true; set spec.ngts.workspaceID in the VenafiConnection instead" }}
+            {{- end }}
             {{- if .Values.config.serverURL }}
               {{- fail "config.serverURL must not be set when config.venafiConnection.enabled is true; the server URL is read from the VenafiConnection's spec" }}
             {{- end }}
@@ -106,6 +109,10 @@ spec:
             - --tsg-id
             - {{ required "config.tsgID is required when config.serverURL is not set" .Values.config.tsgID | include "discovery-agent.stringOrNumber" | quote }}
             {{- end }}
+            {{- with .Values.config.workspaceID }}
+            - --workspace-id
+            - {{ . | include "discovery-agent.stringOrNumber" | quote }}
+            {{- end }}
             {{- if or .Values.config.clientID .Values.config.clientId }}
             - --client-id
             - {{ .Values.config.clientID | default .Values.config.clientId }}

deploy/charts/discovery-agent/templates/deployment.yaml

@@ -709,6 +709,20 @@ spec:
                         The URL to connect to the NGTS Data Plane. If not set, the default
                         value https://<tsgID>.ngts.paloaltonetworks.com is used.
                       type: string
+                    workspaceID:
+                      description: |-
+                        The ID of the NGTS workspace that the service account belongs to.
+                        Required when the service account uses OIDC (workload identity) and
+                        belongs to a workspace: without it, NGTS only looks for tenant-level
+                        service accounts, and the token request fails with "Not found". Leave it
+                        unset for a tenant-level service account. It has no effect with
+                        privateKeyJWT, because the client ID identifies the account. NGTS
+                        ignores it on API calls: they are scoped to the workspace of the service
+                        account that authenticated. NGTS does not report an unknown workspace
+                        ID: with OIDC, a wrong ID fails with the same "Not found" error as a
+                        wrong issuer, audience or subject, so check it carefully.
+                      minLength: 1
+                      type: string
                   required:
                     - jwt
                   type: object