Add stackit-pod-identity-webhook image and configuration by jastBytes · Pull Request #53 · stackitcloud/gardener-extension-provider-stackit

jastBytes · 2026-03-13T14:00:41Z

How to categorize this PR?

/kind enhancement

What this PR does / why we need it:
The changes introduce a new Pod Identity Webhook component for STACKIT cloud provider, adding a new chart for the webhook and its associated resources (Deployment, Service, RBAC, MutatingWebhookConfiguration). The webhook is configured to validate pod identities and enforce workload identity. The changes are integrated into the control plane and shoot system components, with proper configuration and error handling.

Special notes for your reviewer:

Breaking changes:

No breaking changes.

ske-prow · 2026-03-13T14:00:44Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

ske-prow · 2026-03-13T14:00:48Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign xoxys for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

timebertt · 2026-03-25T07:25:13Z

Oops, accidentally marked this PR as ready for review, sorry about that.

timebertt

Thanks for the PR, looking forward to this feature :)

timebertt · 2026-03-25T06:51:18Z

imagevector/images.yaml

  tag: "1245"
+- name: stackit-pod-identity-webhook
+  repository: reg3.infra.ske.eu01.stackit.cloud/stackitcloud/stackit-pod-identity-webhook
+  tag: "726f2f0@sha256:fca1f67cd7e6a515e795a34ae45d0c239379d051e494dc202033f6987b41b154"


For the record (as discussed in chat): the stackit-pod-identity-webhook repository should be public and released before merging this integration PR in the extension.

timebertt · 2026-03-25T06:53:49Z

charts/internal/seed-controlplane/charts/stackit-pod-identity-webhook/templates/deployment.yaml

+  name: {{ include "stackit-pod-identity-webhook.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "stackit-pod-identity-webhook.labels" . | nindent 4 }}


This should have the high-availability-config.resources.gardener.cloud/type=server label, ref https://github.com/gardener/gardener/blob/master/docs/development/component-checklist.md#high-availability--stability

timebertt · 2026-03-25T06:54:52Z

charts/internal/seed-controlplane/charts/stackit-pod-identity-webhook/templates/deployment.yaml

+        {{- include "stackit-pod-identity-webhook.selectorLabels" . | nindent 8 }}
+        workload-identity.stackit.cloud/skip-pod-identity-webhook: "true"
+        gardener.cloud/role: controlplane
+        high-availability-config.resources.gardener.cloud/type: controller


This looks wrong here on the pod template.

timebertt · 2026-03-25T06:57:37Z

charts/internal/seed-controlplane/charts/stackit-pod-identity-webhook/templates/deployment.yaml

+        high-availability-config.resources.gardener.cloud/type: controller
+        networking.gardener.cloud/to-dns: allowed
+        networking.gardener.cloud/to-public-networks: allowed
+        networking.gardener.cloud/to-private-networks: allowed


Why does this component need the to-public-networks and to-private-networks network policies?
I would expect that we only need a policy for talking to kube-apiserver (+dns) and allowing kube-apiserver to talk to this webhook server, see https://github.com/gardener/gardener/blob/master/docs/operations/network_policies.md#webhook-servers

timebertt · 2026-03-25T06:58:46Z

charts/internal/seed-controlplane/charts/stackit-pod-identity-webhook/templates/deployment.yaml

+        networking.gardener.cloud/to-private-networks: allowed
+        networking.resources.gardener.cloud/to-kube-apiserver-tcp-443: allowed
+    spec:
+      serviceAccountName: {{ .Values.serviceAccount.name | default (include "stackit-pod-identity-webhook.fullname" .) }}


I'm almost certain that this component doesn't need to talk to the seed's API server, so it doesn't need a ServiceAccount. It should set automountServiceAccountToken=false and use a shoot access secret, ref https://github.com/gardener/gardener/blob/master/docs/development/component-checklist.md#security

timebertt · 2026-03-25T07:20:36Z

pkg/stackit/types.go

 	DirectionIngress = "ingress"
+
+	// STACKITPodIdentityWebhookName is a constant for the name of the Pod Identity Webhook. (stackit)
+	STACKITPodIdentityWebhookName = "stackit-pod-identity-webhook"


Nit: the package name is already stackit, consider renaming this to PodIdentityWebhookName to remove the duplicated "STACKIT" from references.

timebertt · 2026-03-25T07:21:14Z

pkg/controller/controlplane/valuesprovider.go

+			{
+				Name:   stackit.STACKITPodIdentityWebhookName,
+				Images: []string{imagevector.ImageNameStackitPodIdentityWebhook},
+				Objects: []*chart.Object{


This list looks incomplete.

timebertt · 2026-03-25T07:22:47Z

pkg/controller/controlplane/valuesprovider.go

 	return nil
 }
+
+func getSTACKITPodIdentityWebhookChartValues(


Nit: consider removing STACKIT from these function names to increase readability

timebertt · 2026-03-25T07:23:23Z

pkg/controller/controlplane/valuesprovider.go

+	}
+
+	return map[string]any{
+		"replicaCount": extensionscontroller.GetControlPlaneReplicas(cluster, scaledDown, 2),


Nit: typically 1 is specified here, because the high availability config webhook will manage the replica count

timebertt · 2026-03-25T07:24:05Z

pkg/controller/controlplane/valuesprovider.go

+
+	return map[string]any{
+		"webhook": map[string]any{
+			"caBundle": gardenerutils.EncodeBase64(caSecret.Data[secretutils.DataKeyCertificateBundle]),


Consider passing the raw PEM bundle here and encoding it as base64 in the chart template.

Copilot

Pull request overview

This PR introduces a new STACKIT Pod Identity Webhook component and wires it into the extension’s seed control-plane and shoot system components charts/values so that workload identity can be enforced via a mutating admission webhook.

Changes:

Add a new stackit-pod-identity-webhook image entry and image name constant.
Add new Helm charts for the webhook (seed-controlplane: Deployment/Service/RBAC/PDB; shoot-system-components: MutatingWebhookConfiguration).
Extend the controlplane values provider and tests to generate TLS/CA-related chart values and required secrets.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
pkg/stackit/types.go	Adds a constant for the webhook name.
pkg/controller/controlplane/valuesprovider.go	Generates webhook TLS secret config and passes chart values for seed + shoot charts.
pkg/controller/controlplane/valuesprovider_test.go	Extends expected chart values and fake secrets for the new component.
imagevector/images.yaml	Adds the webhook image (repo/tag+digest).
imagevector/images.go	Adds `ImageNameStackitPodIdentityWebhook`.
charts/internal/shoot-system-components/charts/stackit-pod-identity-webhook/*	New shoot chart for MutatingWebhookConfiguration.
charts/internal/seed-controlplane/charts/stackit-pod-identity-webhook/*	New seed chart for webhook runtime resources (Deployment/Service/RBAC/PDB).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-25T07:31:36Z

pkg/controller/controlplane/valuesprovider.go

+	return map[string]any{
+		"webhook": map[string]any{
+			"caBundle": gardenerutils.EncodeBase64(caSecret.Data[secretutils.DataKeyCertificateBundle]),


caBundle is derived from caSecret.Data[secretutils.DataKeyCertificateBundle] without validating that the key exists / is non-empty. If the CA secret is malformed, this will silently configure an empty bundle and the webhook will fail TLS verification. Consider validating the presence of the certificate bundle and returning an explicit error if it's missing.

Suggested change

return map[string]any{

"webhook": map[string]any{

"caBundle": gardenerutils.EncodeBase64(caSecret.Data[secretutils.DataKeyCertificateBundle]),

caBundle, ok := caSecret.Data[secretutils.DataKeyCertificateBundle]

if !ok || len(caBundle) == 0 {

return nil, fmt.Errorf("secret %q is missing non-empty %q data", caNameControlPlane, secretutils.DataKeyCertificateBundle)

}

return map[string]any{

"webhook": map[string]any{

"caBundle": gardenerutils.EncodeBase64(caBundle),

Copilot · 2026-03-25T07:31:37Z

pkg/controller/controlplane/valuesprovider_test.go

+		stackitPodIdentityWebhookChartShootValues := map[string]any{
+			"webhook": map[string]any{
+				"caBundle": "",
+			},
+		}


The new shoot chart values test asserts caBundle is empty. Since the valuesprovider now base64-encodes the CA bundle from the CA secret, it would be better to populate the fake ca-provider-openstack-controlplane secret with a non-empty secretutils.DataKeyCertificateBundle and assert the expected base64 output, so the encoding and wiring are actually exercised.

Copilot · 2026-03-25T07:31:37Z

charts/internal/seed-controlplane/charts/stackit-pod-identity-webhook/templates/rbac.yaml

+    app.kubernetes.io/name: {{ .Chart.Name }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+automountServiceAccountToken: false


The ServiceAccount sets automountServiceAccountToken: false, and the Pod spec does not override it or mount any kubeconfig/token. At the same time, RBAC is granted to read ServiceAccounts, which typically requires in-cluster authentication. If the webhook needs to call the Kubernetes API, it will fail without credentials. Either mount credentials explicitly / enable token automount for this workload, or remove the RBAC rules if no API access is required.

Suggested change

automountServiceAccountToken: false

Copilot · 2026-03-25T07:31:37Z

...m-components/charts/stackit-pod-identity-webhook/templates/mutatingwebhookconfiguration.yaml

+kind: MutatingWebhookConfiguration
+metadata:
+  name: {{ include "stackit-pod-identity-webhook.fullname" . }}
+  namespace: {{ .Release.Namespace }}


MutatingWebhookConfiguration is cluster-scoped; setting metadata.namespace makes the manifest invalid and will be rejected by the API server. Remove the namespace field from metadata (keep clientConfig.service.namespace or switch to url as appropriate).

Suggested change

namespace: {{ .Release.Namespace }}

Copilot · 2026-03-25T07:31:37Z

...m-components/charts/stackit-pod-identity-webhook/templates/mutatingwebhookconfiguration.yaml

+      service:
+        name: {{ include "stackit-pod-identity-webhook.fullname" . }}
+        namespace: {{ .Release.Namespace }}
+        path: "/mutate--v1-pod"


clientConfig currently references a Service in .Release.Namespace, but this chart does not deploy that Service into the shoot cluster (the Service/Deployment are in the seed-controlplane chart). As a result, the webhook will be unreachable and pod admissions will fail. Additionally, the webhook config is missing clientConfig.caBundle even though .Values.webhook.caBundle is provided by the valuesprovider. Fix by either (a) deploying the webhook Service/Endpoints into the shoot cluster and referencing it here, or (b) switching to clientConfig.url that points to the webhook Service in the seed control-plane namespace, and set caBundle from .Values.webhook.caBundle.

Suggested change

service:

name: {{ include "stackit-pod-identity-webhook.fullname" . }}

namespace: {{ .Release.Namespace }}

path: "/mutate--v1-pod"

url: {{ .Values.webhook.url | quote }}

caBundle: {{ .Values.webhook.caBundle | quote }}

Copilot · 2026-03-25T07:31:37Z

...m-components/charts/stackit-pod-identity-webhook/templates/mutatingwebhookconfiguration.yaml

+        resources: ["pods"]
+    admissionReviewVersions: ["v1"]
+    sideEffects: None
+    failurePolicy: {{ .Values.webhook.failurePolicy | default "Ignore" }}


The template defaults failurePolicy to Ignore, but the chart values/comments state that the default should be Fail to enforce workload identity. Align the default behavior (prefer defaulting to Fail here) to avoid accidentally weakening enforcement when failurePolicy isn't explicitly set.

Suggested change

failurePolicy: {{ .Values.webhook.failurePolicy | default "Ignore" }}

failurePolicy: {{ .Values.webhook.failurePolicy | default "Fail" }}

Copilot · 2026-03-25T07:31:38Z

charts/internal/seed-controlplane/charts/stackit-pod-identity-webhook/templates/service.yaml

+  selector:
+    app.kubernetes.io/name: {{ .Chart.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}


The Service selector uses app.kubernetes.io/name: {{ .Chart.Name }}, but the Deployment's pod labels come from include "stackit-pod-identity-webhook.selectorLabels", which can differ when nameOverride is set. This can break Service -> Pod selection. Use the same helper-generated selector labels in the Service (and keep labels/selectors consistent across resources).

Copilot · 2026-03-25T07:31:38Z

charts/internal/seed-controlplane/charts/stackit-pod-identity-webhook/values.yaml

+    memory: 64Mi
+
+serviceAccount:
+  create: true


serviceAccount.create is defined in values but not used in the templates (the ServiceAccount is always created). Either honor this flag with a conditional around the ServiceAccount manifest or remove the value to avoid misleading configuration.

Suggested change

create: true

…tern

…loyment since they're static

…remove dynamic name generation

…oyment

…ity webhook

…e helpers template

…late

…ode for pod identity webhook service

…k service

…ions

…base64 encoded version in webhook config and values provider

… for pod-identity-webhook tests

… identity webhook

…ead of shoot name

…entity webhook Updated the service to prefer close traffic distribution and add endpoint slice hints to improve pod identity handling. Also adjusted the allowed ports to 9443 for the webhook service. Modified the mutating webhook configuration to exclude the gardener extension provider stackit to prevent conflicts.

ske-prow bot added kind/enhancement Enhancement, improvement, extension do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. labels Mar 13, 2026

ske-prow bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Mar 13, 2026

jastBytes force-pushed the feat/STACKITSKE-6021-pod-identity-webhook branch from 28ea07b to fb04800 Compare March 23, 2026 10:50

jastBytes added 4 commits March 23, 2026 13:52

feat(imagevector): add stackit-pod-identity-webhook image

4b76d70

feat(charts): add stackit-pod-identity-webhook charts

0ce3a7b

feat(controlplane): implement STACKIT pod identity webhook deployment

d1af818

test(controlplane): add tests for STACKIT pod identity webhook

6d649ce

jastBytes force-pushed the feat/STACKITSKE-6021-pod-identity-webhook branch from fb04800 to 6d649ce Compare March 23, 2026 13:13

jastBytes requested a review from timebertt March 24, 2026 09:24

timebertt marked this pull request as ready for review March 25, 2026 07:24

Copilot AI review requested due to automatic review settings March 25, 2026 07:24

ske-prow bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 25, 2026

timebertt marked this pull request as draft March 25, 2026 07:24

ske-prow bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 25, 2026

Copilot started reviewing on behalf of timebertt March 25, 2026 07:25 View session

timebertt requested changes Mar 25, 2026

View reviewed changes

ske-prow bot assigned timebertt Mar 25, 2026

Copilot AI reviewed Mar 25, 2026

View reviewed changes

jastBytes added 8 commits March 25, 2026 08:53

feat(seed-controlplane): add stackit-pod-identity-webhook dependency

0a53819

feat(stackit): update pod identity webhook name to match standard pat…

8c280a9

…tern

feat(deployment): add high-availability server type label

0581182

chore(deployment): remove unused networking labels

de0e87d

chore(deployment): disable service account token automount

63334f9

feat(pod-identity-webhook): move security settings from values to dep…

3418936

…loyment since they're static

chore(deployment): simplify webhook component with static labels and …

2ee89ba

…remove dynamic name generation

feat(webhook): add image repository and tag configuration

6eec584

jastBytes added 30 commits March 25, 2026 09:14

feat(vpa): add vertical pod autoscaler for pod identity webhook

dd6b24f

feat(service): use webhook port as targetPort

0d39e54

feat(pod-identity-webhook): move security and resource limits in depl…

2112708

…oyment

feat(service): set service type to ClusterIP permanently

88f1e77

feat(webhook): remove comment about certmanager

9cc20da

feat(controlplane): add vertical pod autoscaler for stackit pod ident…

02b1d95

…ity webhook

feat(controlplane): add stackit pod identity webhook access secret

07e7328

chore(deps): add stackit-pod-identity-webhook as dependency and remov…

1b4cc73

…e helpers template

chore(deployment): remove unused end block in webhook deployment temp…

c638edd

…late

feat(service): add port annotation for webhook service access

ff4a6dd

feat(deployment): add topology spread constraints and auto topology m…

4d3b5ab

…ode for pod identity webhook service

feat(controlplane): add pod disruption budget for pod identity webhoo…

8d1499c

…k service

feat(controlplane): rename pod identity webhook chart and shoot funct…

08f12c7

…ions

feat(controlplane): reduce replica count to 1

f7391c0

feat(pod-identity-webhook): use raw CA bundle from secret instead of …

ccd2e13

…base64 encoded version in webhook config and values provider

feat(controlplane): check ca bundle is not empty

adfa94d

feat(pod-identity-webhook): set failurePolicy to Fail in webhook config

b654ddb

fix(controlplane): reduce replica count to 1 in tests

8a22694

test: add fake CA bundle to ca-provider-openstack-controlplane secret…

c9b6ef0

… for pod-identity-webhook tests

fix chart naming after type rename

51f213d

feat(webhook): add kubeconfig and token from projected secret for pod…

9a26125

… identity webhook

feat(webhook): update kubeconfig path to include kubeconfig file

c727fea

feat(webhook): set fixed port and update webhook URL with seed name

6945759

feat(service): set fixed port 443 for pod identity webhook service

e7ab405

feat(webhook): update webhook URL to use shoot name instead of seed name

a4eba0d

feat(webhook): update webhook URL to use control plane namespace inst…

d0f7f09

…ead of shoot name

feat(service): use dynamic port from values instead of fixed 9443

6e04c55

feat(controlplane): update webhook DNS names to include stackit prefix

7a46db7

feat(webhook): update webhook URL to use server namespace suffix

31429b5

	failurePolicy: {{ .Values.webhook.failurePolicy \| default "Ignore" }}
	failurePolicy: {{ .Values.webhook.failurePolicy \| default "Fail" }}

Conversation

jastBytes commented Mar 13, 2026 • edited by timebertt Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ske-prow bot commented Mar 13, 2026

Uh oh!

ske-prow bot commented Mar 13, 2026

Uh oh!

timebertt commented Mar 25, 2026

Uh oh!

timebertt left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jastBytes commented Mar 13, 2026 •

edited by timebertt

Loading