helm: mount the hub internal token in the tracer container too (#1954)

The tracer polls the hub's /pods/all and /pods/targeted on every sync cycle,
but only the sniffer container received HUB_INTERNAL_TOKEN_PATH and the token
mount, so with auth enabled the tracer's requests were rejected and TLS hooking
never picked up newly started pods. Wire the same env var and projected-token
mount into the tracer container.

Requires the matching tracer2 change that sends the Bearer header.

helm-chart/templates/09-worker-daemon-set.yaml

@@ -284,6 +284,10 @@ spec:
             value: '{{ (include "sentry.enabled" .) }}'
           - name: SENTRY_ENVIRONMENT
             value: '{{ .Values.tap.sentry.environment }}'
+          {{- if eq (include "kubeshark.authEnabled" .) "true" }}
+          - name: HUB_INTERNAL_TOKEN_PATH
+            value: /var/run/secrets/kubeshark/hub-token/token
+          {{- end }}
           resources:
             limits:
               {{ if ne (toString .Values.tap.resources.tracer.limits.cpu) "0" }}
@@ -359,6 +363,11 @@ spec:
               mountPropagation: HostToContainer
               name: root
               readOnly: true
+            {{- if eq (include "kubeshark.authEnabled" .) "true" }}
+            - mountPath: /var/run/secrets/kubeshark/hub-token
+              name: hub-internal-token
+              readOnly: true
+            {{- end }}
       {{- end }}
       dnsPolicy: ClusterFirstWithHostNet
       hostNetwork: {{ .Values.tap.hostNetwork }}