feat(controlplane): implement STACKIT pod identity webhook deployment

Author: jastBytes

pkg/controller/controlplane/valuesprovider.go

@@ -10,7 +10,6 @@ import (
 	"fmt"
 	"maps"
 	"path/filepath"
-	"sort"
 	"strings"
 
 	"github.com/Masterminds/semver/v3"
@@ -28,6 +27,7 @@ import (
 	kutil "github.com/gardener/gardener/pkg/utils/kubernetes"
 	secretutils "github.com/gardener/gardener/pkg/utils/secrets"
 	secretsmanager "github.com/gardener/gardener/pkg/utils/secrets/manager"
+	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	networkingv1 "k8s.io/api/networking/v1"
@@ -37,13 +37,10 @@ import (
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/runtime/serializer"
 	"k8s.io/apimachinery/pkg/types"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-	"k8s.io/apimachinery/pkg/util/sets"
 	vpaautoscalingv1 "k8s.io/autoscaler/vertical-pod-autoscaler/pkg/apis/autoscaling.k8s.io/v1"
 	"k8s.io/utils/ptr"
 	k8sclient "sigs.k8s.io/controller-runtime/pkg/client"
@@ -59,8 +56,9 @@ import (
 )
 
 const (
-	caNameControlPlane               = "ca-" + openstack.Name + "-controlplane"
-	cloudControllerManagerServerName = openstack.CloudControllerManagerName + "-server"
+	caNameControlPlane                  = "ca-" + openstack.Name + "-controlplane"
+	cloudControllerManagerServerName    = openstack.CloudControllerManagerName + "-server"
+	stackitPodIdentityWebhookServerName = stackit.STACKITPodIdentityWebhookName + "-server"
 
 	CSIStackitPrefix = "stackit-blockstorage"
 
@@ -103,6 +101,16 @@ func secretConfigsFunc(namespace string) []extensionssecretmanager.SecretConfigW
 			},
 			Options: []secretsmanager.GenerateOption{secretsmanager.SignedByCA(caNameControlPlane)},
 		},
+		{
+			Config: &secretutils.CertificateSecretConfig{
+				Name:                        stackitPodIdentityWebhookServerName,
+				CommonName:                  stackit.STACKITPodIdentityWebhookName,
+				DNSNames:                    kutil.DNSNamesForService(stackit.STACKITPodIdentityWebhookName, namespace),
+				CertType:                    secretutils.ServerCert,
+				SkipPublishingCACertificate: true,
+			},
+			Options: []secretsmanager.GenerateOption{secretsmanager.SignedByCA(caNameControlPlane)},
+		},
 	}
 }
 
@@ -117,12 +125,6 @@ func shootAccessSecretsFunc(namespace string) []*gutil.AccessSecret {
 	}
 }
 
-func makeUnstructured(gvk schema.GroupVersionKind) *unstructured.Unstructured {
-	obj := &unstructured.Unstructured{}
-	obj.SetGroupVersionKind(gvk)
-	return obj
-}
-
 var (
 	configChart = &chart.Chart{
 		Name:       openstack.CloudProviderConfigName,
@@ -207,6 +209,14 @@ var (
 					{Type: &vpaautoscalingv1.VerticalPodAutoscaler{}, Name: openstack.STACKITALBControllerManagerName},
 				},
 			},
+			{
+				Name:   stackit.STACKITPodIdentityWebhookName,
+				Images: []string{imagevector.ImageNameStackitPodIdentityWebhook},
+				Objects: []*chart.Object{
+					{Type: &appsv1.Deployment{}, Name: stackit.STACKITPodIdentityWebhookName},
+					{Type: &corev1.Service{}, Name: stackit.STACKITPodIdentityWebhookName},
+				},
+			},
 		},
 	}
 
@@ -306,6 +316,12 @@ var (
 					{Type: &rbacv1.RoleBinding{}, Name: openstack.UsernamePrefix + openstack.CSIResizerName},
 				},
 			},
+			{
+				Name: stackit.STACKITPodIdentityWebhookName,
+				Objects: []*chart.Object{
+					{Type: &admissionregistrationv1.MutatingWebhookConfiguration{}, Name: stackit.STACKITPodIdentityWebhookName},
+				},
+			},
 		},
 	}
 
@@ -478,7 +494,7 @@ func (vp *valuesProvider) GetControlPlaneShootChartValues(
 	ctx context.Context,
 	cp *extensionsv1alpha1.ControlPlane,
 	cluster *extensionscontroller.Cluster,
-	_ secretsmanager.Reader,
+	secretsReader secretsmanager.Reader,
 	_ map[string]string,
 ) (map[string]any, error) {
 	// Decode providerConfig
@@ -493,7 +509,7 @@ func (vp *valuesProvider) GetControlPlaneShootChartValues(
 	if err != nil {
 		return nil, err
 	}
-	return vp.getControlPlaneShootChartValues(ctx, cpConfig, cp, cloudProfileConfig, cluster)
+	return vp.getControlPlaneShootChartValues(ctx, cpConfig, cp, cloudProfileConfig, cluster, secretsReader)
 }
 
 // GetStorageClassesChartValues returns the values for the shoot storageclasses chart applied by the generic actuator.
@@ -708,6 +724,11 @@ func (vp *valuesProvider) getControlPlaneChartValues(ctx context.Context, cpConf
 		}
 	}
 
+	podIdentityWebhook, err := getSTACKITPodIdentityWebhookChartValues(cluster, secretsReader, scaledDown)
+	if err != nil {
+		return nil, err
+	}
+
 	storageCSIDriver := getCSIDriver(cpConfig)
 	switch storageCSIDriver {
 	case stackitv1alpha1.OPENSTACK:
@@ -732,6 +753,7 @@ func (vp *valuesProvider) getControlPlaneChartValues(ctx context.Context, cpConf
 		},
 		openstack.CloudControllerManagerName:        ccm,
 		openstack.STACKITCloudControllerManagerName: stackitccm,
+		stackit.STACKITPodIdentityWebhookName:       podIdentityWebhook,
 	})
 
 	if vp.deployALBIngressController {
@@ -1028,7 +1050,7 @@ func DeploySTACKITALB(cpConfig *stackitv1alpha1.ControlPlaneConfig) bool {
 }
 
 // getControlPlaneShootChartValues collects and returns the control plane shoot chart values.
-func (vp *valuesProvider) getControlPlaneShootChartValues(ctx context.Context, cpConfig *stackitv1alpha1.ControlPlaneConfig, cp *extensionsv1alpha1.ControlPlane, cloudProfileConfig *stackitv1alpha1.CloudProfileConfig, cluster *extensionscontroller.Cluster) (map[string]any, error) {
+func (vp *valuesProvider) getControlPlaneShootChartValues(ctx context.Context, cpConfig *stackitv1alpha1.ControlPlaneConfig, cp *extensionsv1alpha1.ControlPlane, cloudProfileConfig *stackitv1alpha1.CloudProfileConfig, cluster *extensionscontroller.Cluster, secretsReader secretsmanager.Reader) (map[string]any, error) {
 	var csiNodeDriverValues map[string]any
 
 	values := make(map[string]any)
@@ -1056,8 +1078,14 @@ func (vp *valuesProvider) getControlPlaneShootChartValues(ctx context.Context, c
 		return nil, err
 	}
 
+	podIdentityWebhook, err := vp.getSTACKITPodIdentityWebhookShootChartValues(secretsReader)
+	if err != nil {
+		return nil, err
+	}
+
 	maps.Copy(values, map[string]any{
-		openstack.CloudControllerManagerName: map[string]any{"enabled": true},
+		openstack.CloudControllerManagerName:  map[string]any{"enabled": true},
+		stackit.STACKITPodIdentityWebhookName: podIdentityWebhook,
 	})
 
 	return values, nil
@@ -1225,16 +1253,6 @@ func (vp *valuesProvider) getControlPlaneShootChartCSISTACKITValues(ctx context.
 	return values
 }
 
-func (vp *valuesProvider) getAllWorkerPoolsZones(cluster *extensionscontroller.Cluster) []string {
-	zones := sets.NewString()
-	for _, worker := range cluster.Shoot.Spec.Provider.Workers {
-		zones.Insert(worker.Zones...)
-	}
-	list := zones.UnsortedList()
-	sort.Strings(list)
-	return list
-}
-
 func cleanupSeedLegacyCSISnapshotValidation(ctx context.Context, client k8sclient.Client, namespace string) error {
 	stackitSnapShotName := fmt.Sprintf("%s-%s", CSIStackitPrefix, openstack.CSISnapshotValidationName)
 
@@ -1276,3 +1294,36 @@ func cleanupCloudProviderConfigSecret(ctx context.Context, client k8sclient.Clie
 
 	return nil
 }
+
+func getSTACKITPodIdentityWebhookChartValues(
+	cluster *extensionscontroller.Cluster,
+	secretsReader secretsmanager.Reader,
+	scaledDown bool,
+) (map[string]any, error) {
+	tlsSecret, found := secretsReader.Get(stackitPodIdentityWebhookServerName)
+	if !found {
+		return nil, fmt.Errorf("secret %q not found", stackitPodIdentityWebhookServerName)
+	}
+
+	return map[string]any{
+		"replicaCount": extensionscontroller.GetControlPlaneReplicas(cluster, scaledDown, 2),
+		"webhook": map[string]any{
+			"tlsSecretName": tlsSecret.Name,
+		},
+	}, nil
+}
+
+func (vp *valuesProvider) getSTACKITPodIdentityWebhookShootChartValues(
+	secretsReader secretsmanager.Reader,
+) (map[string]any, error) {
+	caSecret, found := secretsReader.Get(caNameControlPlane)
+	if !found {
+		return nil, fmt.Errorf("secret %q not found", caNameControlPlane)
+	}
+
+	return map[string]any{
+		"webhook": map[string]any{
+			"caBundle": gardenerutils.EncodeBase64(caSecret.Data[secretutils.DataKeyCertificateBundle]),
+		},
+	}, nil
+}

pkg/stackit/types.go

@@ -16,6 +16,9 @@ const (
 	EtherTypeIPv6    = "IPv6"
 	DirectionEgress  = "egress"
 	DirectionIngress = "ingress"
+
+	// STACKITPodIdentityWebhookName is a constant for the name of the Pod Identity Webhook. (stackit)
+	STACKITPodIdentityWebhookName = "stackit-pod-identity-webhook"
 )
 
 var (