Prometheus token Secret not created by addon framework — requires manual step

[bjoydeep]

Description

After the addon deploys the agent to a managed cluster, the agent cannot authenticate to Prometheus. The agent reads its authentication token from a Secret by name via the Kubernetes API (not from a volume mount), but the addon framework creates only the ServiceAccount and ClusterRoleBinding — it does not create the corresponding kubernetes.io/service-account-token Secret.
Users must manually create the Secret on each managed cluster before scoring can begin.

Steps to Reproduce

1. Install the DSF Helm chart and let the addon deploy to managed clusters
2. Check agent logs — authentication to Prometheus fails
3. The token Secret does not exist until manually created

Suggested Fix

Add a new template (e.g., serviceaccount-token.yaml) to pkg/dynamic_scoring/manifests/templates/:

apiVersion: v1
 kind: Secret
 metadata:
   name: dynamic-scoring-agent-token
   namespace: {{ .AddonInstallNamespace }}
   annotations:
     kubernetes.io/service-account.name: dynamic-scoring-agent-sa
 type: kubernetes.io/service-account-token

This ensures the token is created alongside the ServiceAccount as part of the addon deployment lifecycle.