Skip to content

Add stackit-pod-identity-webhook image and configuration #53

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ske-prow merged 27 commits into from
Apr 17, 2026
Merged

Add stackit-pod-identity-webhook image and configuration #53

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
27 commits
Select commit Hold shift + click to select a range
f3333d2
feat(imagevector): add stackit-pod-identity-webhook image
jastBytes Mar 23, 2026
1c3d5d7
feat(charts): add stackit-pod-identity-webhook charts
jastBytes Mar 23, 2026
0f65310
feat(controlplane): implement STACKIT pod identity webhook deployment
jastBytes Mar 23, 2026
5d86145
test(controlplane): add tests for STACKIT pod identity webhook
jastBytes Mar 23, 2026
c9b9220
feat(review): apply post review suggestions
jastBytes Mar 25, 2026
261f36a
feat(controlplane): hide pod identity webhook through a new feature g…
jastBytes Apr 7, 2026
77d4080
feat(controlplane): update pod identity webhook image to use GHCR and…
jastBytes Apr 8, 2026
cfbe8a2
fix(naming): fix naming to match references
jastBytes Apr 8, 2026
df413aa
revert(chart): revert change of values
jastBytes Apr 9, 2026
ed52f33
refactor(webhook): remove topology spread constraints from deployment…
jastBytes Apr 10, 2026
196dbac
Update charts/internal/seed-controlplane/charts/stackit-pod-identity-…
jastBytes Apr 10, 2026
e5b72c2
refactor(pod-identity-webhook): Updates the deployment and associated…
jastBytes Apr 10, 2026
243a224
feat(webhook): expose metrics endpoint for identity webhook via pod l…
jastBytes Apr 13, 2026
430c657
chore(config): disable pod identity webhook in component values
jastBytes Apr 14, 2026
d501b9a
refactor(webhook): apply resource limits and clean up prometheus anno…
jastBytes Apr 15, 2026
4f20cdf
feat(webhook): expose metrics endpoint for pod identity service
jastBytes Apr 15, 2026
dff1e35
fix: gomod
jastBytes Apr 15, 2026
043a9a8
refactor(webhook): correct service monitor endpoint definition
jastBytes Apr 15, 2026
7ed07e4
refactor(webhook): set static resource requests for webhook deploymen…
jastBytes Apr 15, 2026
b3d21f4
fix(chart): missing port delimiter
jastBytes Apr 15, 2026
8f1ec10
fix(chart): servicemonitor targeting wrong prometheus
jastBytes Apr 15, 2026
d876159
fix(chart): servicemonitor targeting wrong prometheus and netpol
jastBytes Apr 15, 2026
26e2699
fix port
jastBytes Apr 15, 2026
75f585d
Update charts/internal/seed-controlplane/charts/stackit-pod-identity-…
jastBytes Apr 16, 2026
096da44
feat(controlplane): Implement layered logic for pod identity webhook …
jastBytes Apr 17, 2026
848f21b
refactor(controlplane): update pointer initialization in tests
jastBytes Apr 17, 2026
40ef9f3
refactor(controlplane): simplify annotation check for pod identity we…
jastBytes Apr 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions .../internal/seed-controlplane/charts/stackit-pod-identity-webhook/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ metadata:
app.kubernetes.io/name: stackit-pod-identity-webhook
high-availability-config.resources.gardener.cloud/type: server
spec:
Comment thread
jastBytes marked this conversation as resolved.
revisionHistoryLimit: 2
replicas: {{ .Values.replicaCount }}
selector:
matchLabels:
Expand Down Expand Up @@ -67,11 +68,9 @@ spec:
path: /readyz
port: health
resources:
limits:
memory: 128Mi
requests:
cpu: 50m
memory: 64Mi
cpu: {{ .Values.vpa.resourcePolicy.minAllowed.cpu }}
memory: {{ .Values.vpa.resourcePolicy.minAllowed.memory }}
volumeMounts:
- name: certs
mountPath: /etc/webhook/certs
Expand Down
4 changes: 4 additions & 0 deletions charts/internal/seed-controlplane/charts/stackit-pod-identity-webhook/templates/service.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,10 @@ spec:
targetPort: {{ .Values.webhook.port }}
protocol: TCP
name: https
- port: 8080
targetPort: 8080
protocol: TCP
name: metrics
selector:
app.kubernetes.io/name: stackit-pod-identity-webhook
trafficDistribution: PreferClose
8 changes: 6 additions & 2 deletions charts/internal/seed-controlplane/charts/stackit-pod-identity-webhook/templates/vpa.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,12 @@ spec:
containerPolicies:
- containerName: stackit-pod-identity-webhook
minAllowed:
memory: 80M
cpu: {{ .Values.vpa.resourcePolicy.minAllowed.cpu }}
memory: {{ .Values.vpa.resourcePolicy.minAllowed.memory }}
maxAllowed:
cpu: {{ .Values.vpa.resourcePolicy.maxAllowed.cpu }}
memory: {{ .Values.vpa.resourcePolicy.maxAllowed.memory }}
controlledValues: RequestsOnly
controlledValues: RequestsAndLimits
Comment thread
jastBytes marked this conversation as resolved.
Outdated
Comment thread
jastBytes marked this conversation as resolved.
Outdated
controlledResources:
- cpu
- memory
3 changes: 3 additions & 0 deletions charts/internal/seed-controlplane/charts/stackit-pod-identity-webhook/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,3 +13,6 @@ vpa:
maxAllowed:
cpu: 1
memory: 512Mi
minAllowed:
cpu: 50m
memory: 64Mi
20 changes: 11 additions & 9 deletions ...omponents/charts/stackit-pod-identity-webhook/templates/mutatingwebhookconfiguration.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,24 +7,26 @@ metadata:
webhooks:
- name: stackit-pod-identity-webhook.stackit.cloud
clientConfig:
url: {{ .Values.webhook.url | quote }}
caBundle: {{ .Values.webhook.caBundle | quote }}
url: {{ .Values.webhook.url | quote }}
caBundle: {{ .Values.webhook.caBundle | quote }}
rules:
- operations: ["CREATE"]
apiGroups: [""]
apiVersions: ["v1"]
resources: ["pods"]
admissionReviewVersions: ["v1"]
sideEffects: None
timeoutSeconds: 3 # Do not block control-plane API calls too long.
failurePolicy: Fail
namespaceSelector:
matchExpressions:
- key: kubernetes.io/metadata.name
operator: NotIn
values: ["kube-system", "garden"]
- key: workload-identity.stackit.cloud/skip-pod-identity-webhook
operator: DoesNotExist
- key: gardener.cloud/purpose # see https://github.com/gardener/gardener/blob/master/docs/usage/shoot/shoot_status.md#constraints
operator: NotIn
values:
- kube-system
- key: workload-identity.stackit.cloud/skip-pod-identity-webhook
operator: DoesNotExist
objectSelector:
matchExpressions:
- key: workload-identity.stackit.cloud/skip-pod-identity-webhook
operator: DoesNotExist
- key: workload-identity.stackit.cloud/skip-pod-identity-webhook
operator: DoesNotExist
1 change: 0 additions & 1 deletion charts/internal/shoot-system-components/charts/stackit-pod-identity-webhook/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,2 @@
webhook:
caBundle: "" # will be set by valuesprovider
controlPlaneNamespace: "" # will be set by valuesprovider
3 changes: 2 additions & 1 deletion imagevector/images.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,5 +136,6 @@ images:
repository: reg3.infra.ske.eu01.stackit.cloud/temp/alb-controller-manager
tag: "1245"
- name: stackit-pod-identity-webhook
sourceRepository: github.com/stackitcloud/stackit-pod-identity-webhook
repository: ghcr.io/stackitcloud/stackit-pod-identity-webhook
Comment thread
jastBytes marked this conversation as resolved.
tag: "v0.1.0@sha256:5c124efb00b5b5e0fd64b635e1643cebbd407b4abafdb966e02639627f41631c"
tag: "v0.1.0"
2 changes: 2 additions & 0 deletions pkg/controller/controlplane/valuesprovider.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -323,6 +323,8 @@ var (
Name: stackit.PodIdentityWebhookName,
Objects: []*chart.Object{
{Type: &admissionregistrationv1.MutatingWebhookConfiguration{}, Name: stackit.PodIdentityWebhookName},
Comment thread
jastBytes marked this conversation as resolved.
Comment thread
jastBytes marked this conversation as resolved.
{Type: &rbacv1.ClusterRole{}, Name: "extensions.gardener.cloud:provider-stackit:stackit-pod-identity-webhook"},
{Type: &rbacv1.ClusterRoleBinding{}, Name: "extensions.gardener.cloud:provider-stackit:stackit-pod-identity-webhook"},
},
},
},
Expand Down