fix(helm/provisioner): fail if psk and key are both set (#15157)

Relates to https://github.com/coder/coder/issues/14985

Context:
https://github.com/coder/coder/pull/15122#discussion_r1808458819

Specifying both `provisionerDaemon.pskSecretName` and
`provisionerDaemon.keySecretName` will now result in an error.

This prevents a potential `CrashLoopBackoff` debug session due to the
following error:

```
error: cannot provide both provisioner key --key and pre-shared key --psk
```

helm/provisioner/templates/_coder.tpl

@@ -34,6 +34,8 @@ env:
   value: "0.0.0.0:2112"
 {{- if and (empty .Values.provisionerDaemon.pskSecretName) (empty .Values.provisionerDaemon.keySecretName) }}
 {{ fail "Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified." }}
+{{- else if and (.Values.provisionerDaemon.pskSecretName) (.Values.provisionerDaemon.keySecretName) }}
+{{ fail "Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified, but not both." }}
 {{- end }}
 {{- if .Values.provisionerDaemon.pskSecretName }}
 - name: CODER_PROVISIONER_DAEMON_PSK

helm/provisioner/tests/chart_test.go

@@ -58,7 +58,7 @@ var testCases = []testCase{
 	},
 	{
 		name:          "provisionerd_psk_and_key",
-		expectedError: "",
+		expectedError: `Either provisionerDaemon.pskSecretName or provisionerDaemon.keySecretName must be specified, but not both.`,
 	},
 	{
 		name:          "provisionerd_no_psk_or_key",

helm/provisioner/tests/testdata/provisionerd_psk_and_key.golden

@@ -1,142 +0,0 @@
----
-# Source: coder-provisioner/templates/coder.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  annotations: {}
-  labels:
-    app.kubernetes.io/instance: release-name
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: coder-provisioner
-    app.kubernetes.io/part-of: coder-provisioner
-    app.kubernetes.io/version: 0.1.0
-    helm.sh/chart: coder-provisioner-0.1.0
-  name: coder-provisioner
----
-# Source: coder-provisioner/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: coder-provisioner-workspace-perms
-rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
-  - apiGroups: [""]
-    resources: ["persistentvolumeclaims"]
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
-  - apiGroups:
-    - apps
-    resources:
-    - deployments
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
----
-# Source: coder-provisioner/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: "coder-provisioner"
-subjects:
-  - kind: ServiceAccount
-    name: "coder-provisioner"
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: coder-provisioner-workspace-perms
----
-# Source: coder-provisioner/templates/coder.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  annotations: {}
-  labels:
-    app.kubernetes.io/instance: release-name
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: coder-provisioner
-    app.kubernetes.io/part-of: coder-provisioner
-    app.kubernetes.io/version: 0.1.0
-    helm.sh/chart: coder-provisioner-0.1.0
-  name: coder-provisioner
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: release-name
-      app.kubernetes.io/name: coder-provisioner
-  template:
-    metadata:
-      annotations: {}
-      labels:
-        app.kubernetes.io/instance: release-name
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: coder-provisioner
-        app.kubernetes.io/part-of: coder-provisioner
-        app.kubernetes.io/version: 0.1.0
-        helm.sh/chart: coder-provisioner-0.1.0
-    spec:
-      containers:
-      - args:
-        - provisionerd
-        - start
-        command:
-        - /opt/coder
-        env:
-        - name: CODER_PROMETHEUS_ADDRESS
-          value: 0.0.0.0:2112
-        - name: CODER_PROVISIONER_DAEMON_PSK
-          valueFrom:
-            secretKeyRef:
-              key: psk
-              name: coder-provisionerd-psk
-        - name: CODER_PROVISIONER_DAEMON_KEY
-          valueFrom:
-            secretKeyRef:
-              key: provisionerd-key
-              name: coder-provisionerd-key
-        - name: CODER_PROVISIONERD_TAGS
-          value: clusterType=k8s,location=auh
-        - name: CODER_URL
-          value: http://coder.default.svc.cluster.local
-        image: ghcr.io/coder/coder:latest
-        imagePullPolicy: IfNotPresent
-        lifecycle: {}
-        name: coder
-        ports: null
-        resources: {}
-        securityContext:
-          allowPrivilegeEscalation: false
-          readOnlyRootFilesystem: null
-          runAsGroup: 1000
-          runAsNonRoot: true
-          runAsUser: 1000
-          seccompProfile:
-            type: RuntimeDefault
-        volumeMounts: []
-      restartPolicy: Always
-      serviceAccountName: coder-provisioner
-      terminationGracePeriodSeconds: 600
-      volumes: []