Drop the onboarding script, document console-based onboarding instead

Tenant onboarding is a UI flow in the CyberArk console, not something
customers run a script for, so the script does not belong in this repo.
Removes hack/onboard-disco-agent.sh and rewrites the chart README's
onboarding section to state what onboarding must produce (an authn-jwt
authenticator scoped to the cluster's issuer/JWKS, a registered workload
for the agent's ServiceAccount, and the grants to authenticate and upload)
and to point at the product documentation for the walkthrough.

Also removes references to server-side implementation details from code
comments — specific source files and internal service names — leaving the
protocol-level facts a reader of this repo needs: the authn-jwt exchange is
served by Secrets Manager rather than identity_administration, and the
returned base64 token is forwarded as an opaque Bearer credential.

No functional change; the agent's auth path is untouched.

Author: rzisholz

deploy/charts/disco-agent/README.md

@@ -94,33 +94,20 @@ configuration is required.
 
 ### Per-tenant Conjur onboarding
 
-Onboarding uses the Conjur Cloud **v2 REST API** (JSON objects), not v1 policy
-files — run `hack/onboard-disco-agent.sh` against the target tenant before
-deploying the agent. The script performs all of it with the **customer's own**
-Conjur Cloud admin token; DisCo holds no Conjur identity of its own:
+Before deploying the agent, the target tenant must be onboarded in Conjur
+Cloud: an `authn-jwt` authenticator scoped to the cluster's OIDC issuer and
+JWKS, a registered workload for the agent's ServiceAccount, and the grants that
+let that workload authenticate and upload. Onboarding is performed through the
+CyberArk web console — see the product documentation for the current
+walkthrough.
 
-```sh
-CONJUR_TOKEN="$(cat admin-token.txt)" \
-  hack/onboard-disco-agent.sh \
-    --ark-subdomain <tenant-subdomain> \
-    --issuer https://kubernetes.default.svc.cluster.local
-```
-
-Tenant-level (once per tenant per provider type): creates the `data/disco`
-branch, a per-type uploader group, and a value-less "probe" secret that only
-the uploader group can `read`+`execute` — that probe is the entire
-authorization decision at request time (no policy `!permit`/`!grant` needed).
-
-Per-cluster (each onboard): creates `data/<provider-type>/<cluster-UUID>` and
-its `workloads` sub-branch, an `authn-jwt` authenticator scoped to the
-cluster's real OIDC issuer + JWKS, registers the agent's workload under that
-branch, and grants it both the authenticator's `apps` group (to authenticate)
-and the uploader group (to pass the probe, i.e. to authorize).
+Onboarding needs only the tenant administrator's own Conjur Cloud credentials.
+The agent itself holds no Conjur identity beyond its projected ServiceAccount
+token, and nothing in this chart requires a Conjur admin credential at deploy
+time.
 
-`CLUSTER_UUID` (the `kube-system` namespace UID), the OIDC issuer, and the JWKS
-are auto-derived from the current `kubectl` context if not passed explicitly.
-See the script's header comment for the full `--dry-run`/`--skip-deploy` flag
-reference.
+Once onboarding is complete, note the authenticator's service ID — that is the
+value for `config.cyberark.serviceId` below.
 
 ### Deploy the agent
 
@@ -151,7 +138,7 @@ kubectl logs deployments/disco-agent --namespace "${NAMESPACE}" --follow
 | Symptom | Likely cause | Fix |
 |---|---|---|
 | Agent logs `401 Unauthorized` from Conjur | ServiceAccount token `audience` does not match the authenticator's configured `audience` value, or the authn-jwt authenticator is not enabled for the account | Confirm `audience=conjur` in both the projected volume (chart default) and the Conjur `conjur/authn-jwt/<serviceId>/audience` variable; ensure the authenticator is enabled (`CONJUR_AUTHENTICATORS` includes `authn-jwt/<serviceId>`) |
-| Agent logs `403 Forbidden` from the upload API | The agent's workload is not a member of `data/disco/<type>-uploaders` (fails the authz probe) | Re-run `hack/onboard-disco-agent.sh` for this cluster — it's idempotent |
+| Agent logs `403 Forbidden` from the upload API | The agent's workload is authenticated but not authorized to upload | Confirm in the CyberArk console that this cluster's workload was granted the uploader permission during onboarding |
 | Agent logs `500` / no upload attempt | Conjur is unreachable or returned an unexpected error | Check network policy / DNS; inspect Conjur audit logs for the host identity |
 
 ## Values

internal/cyberark/client.go

@@ -103,10 +103,10 @@ func selectAuthenticator(ctx context.Context, httpClient *http.Client, serviceMa
 			account = "conjur"
 		}
 		// The authn-jwt exchange is served by Secrets Manager (Conjur Cloud),
-		// not by identity_administration. Onboarding registers the
-		// authenticator on that same host (hack/onboard-disco-agent.sh builds
-		// https://<subdomain>.secretsmgr.<env>-cyberark.cloud/api), and the
-		// DisCo authorizer resolves it the same way when validating the token.
+		// not by identity_administration — those are different hosts. Tenant
+		// onboarding registers the authenticator on the Secrets Manager host,
+		// and the server that later validates the resulting token resolves the
+		// same service from service discovery.
 		smsAPI := serviceMap.SecretsManager.API
 		if smsAPI == "" {
 			return nil, errors.New("service discovery returned an empty secrets_manager API, which is required for the Conjur JWT exchange")

internal/cyberark/conjur/conjur.go

@@ -48,8 +48,8 @@ func (c *Client) exchange(ctx context.Context) (string, error) {
 	}
 	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 	// Request the base64-encoded access token — Conjur's canonical wire form for
-	// the token. The DisCo authorizer accepts this base64 blob directly (passes it
-	// to /whoami as-is, base64-decodes only for routing).
+	// the token. It is sent onwards as an opaque Bearer credential, so no
+	// decoding is needed on this side.
 	req.Header.Set("Accept-Encoding", "base64")
 	resp, err := c.httpClient.Do(req)
 	if err != nil {

internal/cyberark/servicediscovery/discovery.go

@@ -31,9 +31,8 @@ const (
 	// SecretsManagerServiceName is the name of the Secrets Manager (Conjur
 	// Cloud) API in responses from the Service Discovery API. This is the host
 	// that serves `authn-jwt/<service-id>/<account>/authenticate` — NOT the
-	// identity_administration host. The DisCo authorizer resolves the same
-	// service name when it validates the resulting token (see conjur_token.py
-	// `_SMS_SERVICE_NAME`).
+	// identity_administration host. The server that validates the resulting
+	// token resolves this same service name.
 	SecretsManagerServiceName = "secrets_manager"
 
 	// maxDiscoverBodySize is the maximum allowed size for a response body from the CyberArk Service Discovery subdomain endpoint