support token-auth-only in helm chart (#305)

Author: gossion

chart/templates/deployment.yaml

@@ -90,6 +90,10 @@ spec:
             - "--otlp-endpoint"
             - {{ .Values.telemetry.otlpEndpoint | quote }}
             {{- end }}
+            {{- if .Values.app.tokenAuthOnly }}
+            - "--token-auth-only"
+            - "true"
+            {{- end }}
           env:
             {{- if .Values.azure.subscriptionId }}
             - name: AZURE_SUBSCRIPTION_ID

chart/values.yaml

@@ -26,6 +26,10 @@ app:
   logLevel: "info"
   # Enable cache for better performance
   cache: true
+  # Enable token-only authentication mode for supported tools
+  # When enabled, tools like kubectl use Azure AKS RunCommand API with user tokens
+  # Requires transport to be sse or streamable-http (not compatible with stdio)
+  tokenAuthOnly: false
 
 # Azure authentication configuration
 azure: