Add stackit-pod-identity-webhook image and configuration by jastBytes · Pull Request #53 · stackitcloud/gardener-extension-provider-stackit

jastBytes · 2026-03-13T14:00:41Z

How to categorize this PR?

/kind enhancement

What this PR does / why we need it:
The changes introduce a new Pod Identity Webhook component for STACKIT cloud provider, adding a new chart for the webhook and its associated resources (Deployment, Service, RBAC, MutatingWebhookConfiguration). The webhook is configured to validate pod identities and enforce workload identity. The changes are integrated into the control plane and shoot system components, with proper configuration and error handling.

Special notes for your reviewer:

Breaking changes:

No breaking changes.

ske-prow · 2026-03-13T14:00:44Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

ske-prow · 2026-03-13T14:00:48Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign xoxys for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

timebertt · 2026-03-25T07:25:13Z

Oops, accidentally marked this PR as ready for review, sorry about that.

timebertt

Thanks for the PR, looking forward to this feature :)

imagevector/images.yaml

charts/internal/seed-controlplane/charts/stackit-pod-identity-webhook/templates/deployment.yaml

pkg/stackit/types.go

pkg/controller/controlplane/valuesprovider.go

Copilot

Pull request overview

This PR introduces a new STACKIT Pod Identity Webhook component and wires it into the extension’s seed control-plane and shoot system components charts/values so that workload identity can be enforced via a mutating admission webhook.

Changes:

Add a new stackit-pod-identity-webhook image entry and image name constant.
Add new Helm charts for the webhook (seed-controlplane: Deployment/Service/RBAC/PDB; shoot-system-components: MutatingWebhookConfiguration).
Extend the controlplane values provider and tests to generate TLS/CA-related chart values and required secrets.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
pkg/stackit/types.go	Adds a constant for the webhook name.
pkg/controller/controlplane/valuesprovider.go	Generates webhook TLS secret config and passes chart values for seed + shoot charts.
pkg/controller/controlplane/valuesprovider_test.go	Extends expected chart values and fake secrets for the new component.
imagevector/images.yaml	Adds the webhook image (repo/tag+digest).
imagevector/images.go	Adds `ImageNameStackitPodIdentityWebhook`.
charts/internal/shoot-system-components/charts/stackit-pod-identity-webhook/*	New shoot chart for MutatingWebhookConfiguration.
charts/internal/seed-controlplane/charts/stackit-pod-identity-webhook/*	New seed chart for webhook runtime resources (Deployment/Service/RBAC/PDB).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pkg/controller/controlplane/valuesprovider.go

pkg/controller/controlplane/valuesprovider_test.go

charts/internal/seed-controlplane/charts/stackit-pod-identity-webhook/templates/rbac.yaml

...m-components/charts/stackit-pod-identity-webhook/templates/mutatingwebhookconfiguration.yaml

charts/internal/seed-controlplane/charts/stackit-pod-identity-webhook/templates/service.yaml

charts/internal/seed-controlplane/charts/stackit-pod-identity-webhook/values.yaml

jastBytes · 2026-03-31T08:33:19Z

Post review changes implemented and tested via ondemand. All working now. One question open from my point of view. See comment in code.

...m-components/charts/stackit-pod-identity-webhook/templates/mutatingwebhookconfiguration.yaml

…ate `EnableSTACKITWorkloadIdentity`

… v0.1.0

jastBytes · 2026-04-08T13:06:09Z

This is finally finished. It is hidden behind a feature flag. The feature is disabled by default. Behavior of the webhook and the featureflag has been tested in an ondemand.

charts/internal/seed-controlplane/charts/stackit-pod-identity-webhook/templates/deployment.yaml

...m-components/charts/stackit-pod-identity-webhook/templates/mutatingwebhookconfiguration.yaml

… since this is automatically added by gardener

timebertt

Awesome, this looks great. Thanks for addressing my suggestions!

charts/internal/seed-controlplane/charts/stackit-pod-identity-webhook/templates/vpa.yaml

charts/internal/seed-controlplane/requirements.yaml

charts/internal/shoot-system-components/requirements.yaml

imagevector/images.yaml

pkg/controller/controlplane/valuesprovider.go

charts/internal/seed-controlplane/charts/stackit-pod-identity-webhook/templates/deployment.yaml

…webhook/templates/vpa.yaml Co-authored-by: Tim Ebert <timebertt@gmail.com>

… configurations for the pod identity webhook across multiple chart components. This refinement includes several operational improvements: - Exposes an additional metrics port on the service definition. - Configures resource requests using VPA definitions, enforcing usage policies for the webhook pod. - Updates the mutating webhook configuration with a timeout and refined namespace selectivity.

…abels Adds Prometheus scraping labels and configurations for the pod identity webhook, allowing metrics exposition via standard Kubernetes service definitions..

Sets the stackit-pod-identity-webhook to permanently disabled in the values files for the seed-controlplane and the shoot-system-components.

timebertt · 2026-04-14T13:47:47Z

charts/internal/seed-controlplane/charts/stackit-pod-identity-webhook/templates/vpa.yaml

        cpu: {{ .Values.vpa.resourcePolicy.maxAllowed.cpu }}
        memory: {{ .Values.vpa.resourcePolicy.maxAllowed.memory }}
-      controlledValues: RequestsOnly
+      controlledValues: RequestsAndLimits


You don't set limits in the deployment 👀

timebertt · 2026-04-14T14:01:45Z

charts/internal/seed-controlplane/charts/stackit-pod-identity-webhook/templates/deployment.yaml

+        prometheus.io/scrape: "true"
+        prometheus.io/port: {{ .Values.metrics.port | quote }}
+        prometheus.io/name: "{{ .Release.Name }}"


I don't believe this works. Reading the code, it would need to be an annotation: https://github.com/gardener/gardener/blob/60a86001eca7145ff54b6555bcd17acea90d2933/pkg/component/observability/monitoring/prometheus/shoot/scrapeconfigs.go#L71-L138

I suggest making use of ServiceMonitor objects: https://github.com/gardener/gardener/blob/7c2403c7ed756245486d8ebbcdb6e17366f567ee/docs/extensions/logging-and-monitoring.md#servicemonitor

ske-prow bot added kind/enhancement Enhancement, improvement, extension do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. labels Mar 13, 2026

ske-prow bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Mar 13, 2026

jastBytes force-pushed the feat/STACKITSKE-6021-pod-identity-webhook branch 2 times, most recently from fb04800 to 6d649ce Compare March 23, 2026 13:13

jastBytes requested a review from timebertt March 24, 2026 09:24

timebertt marked this pull request as ready for review March 25, 2026 07:24

Copilot AI review requested due to automatic review settings March 25, 2026 07:24

ske-prow bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 25, 2026

timebertt marked this pull request as draft March 25, 2026 07:24

ske-prow bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 25, 2026

Copilot started reviewing on behalf of timebertt March 25, 2026 07:25 View session

timebertt requested changes Mar 25, 2026

View reviewed changes

ske-prow bot assigned timebertt Mar 25, 2026

Copilot AI reviewed Mar 25, 2026

View reviewed changes

jastBytes added 4 commits March 27, 2026 11:42

feat(imagevector): add stackit-pod-identity-webhook image

f3333d2

feat(charts): add stackit-pod-identity-webhook charts

1c3d5d7

feat(controlplane): implement STACKIT pod identity webhook deployment

0f65310

test(controlplane): add tests for STACKIT pod identity webhook

5d86145

jastBytes force-pushed the feat/STACKITSKE-6021-pod-identity-webhook branch 2 times, most recently from 8e62bb2 to 6ad65f7 Compare March 30, 2026 13:12

feat(review): apply post review suggestions

c9b9220

jastBytes force-pushed the feat/STACKITSKE-6021-pod-identity-webhook branch from 3b068dc to c9b9220 Compare March 31, 2026 08:50

jastBytes requested a review from timebertt March 31, 2026 08:51

jastBytes commented Mar 31, 2026

View reviewed changes

...m-components/charts/stackit-pod-identity-webhook/templates/mutatingwebhookconfiguration.yaml Outdated Show resolved Hide resolved

feat(controlplane): hide pod identity webhook through a new feature g…

261f36a

…ate `EnableSTACKITWorkloadIdentity`

feat(controlplane): update pod identity webhook image to use GHCR and…

77d4080

… v0.1.0

jastBytes marked this pull request as ready for review April 8, 2026 12:57

ske-prow bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Apr 8, 2026

fix(naming): fix naming to match references

cfbe8a2

jastBytes force-pushed the feat/STACKITSKE-6021-pod-identity-webhook branch from 92c143b to cfbe8a2 Compare April 8, 2026 13:04

revert(chart): revert change of values

df413aa

jastBytes requested a review from maboehm April 9, 2026 09:13

crigertg requested changes Apr 9, 2026

View reviewed changes

charts/internal/seed-controlplane/charts/stackit-pod-identity-webhook/templates/deployment.yaml Outdated Show resolved Hide resolved

...m-components/charts/stackit-pod-identity-webhook/templates/mutatingwebhookconfiguration.yaml Outdated Show resolved Hide resolved

ske-prow bot assigned crigertg Apr 9, 2026

jastBytes removed request for maboehm and timebertt April 10, 2026 07:57

refactor(webhook): remove topology spread constraints from deployment…

ed52f33

… since this is automatically added by gardener

jastBytes requested review from crigertg and timebertt April 10, 2026 09:15

timebertt requested changes Apr 10, 2026

View reviewed changes

jastBytes and others added 4 commits April 10, 2026 12:08

Update charts/internal/seed-controlplane/charts/stackit-pod-identity-…

196dbac

…webhook/templates/vpa.yaml Co-authored-by: Tim Ebert <timebertt@gmail.com>

feat(webhook): expose metrics endpoint for identity webhook via pod l…

243a224

…abels Adds Prometheus scraping labels and configurations for the pod identity webhook, allowing metrics exposition via standard Kubernetes service definitions..

chore(config): disable pod identity webhook in component values

430c657

Sets the stackit-pod-identity-webhook to permanently disabled in the values files for the seed-controlplane and the shoot-system-components.

jastBytes requested a review from timebertt April 14, 2026 09:57

timebertt reviewed Apr 14, 2026

View reviewed changes

Conversation

jastBytes commented Mar 13, 2026 • edited by timebertt Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ske-prow bot commented Mar 13, 2026

Uh oh!

ske-prow bot commented Mar 13, 2026

Uh oh!

timebertt commented Mar 25, 2026

Uh oh!

timebertt left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jastBytes commented Mar 31, 2026

Uh oh!

Uh oh!

jastBytes commented Apr 8, 2026

Uh oh!

Uh oh!

Uh oh!

timebertt left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

timebertt Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

timebertt Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jastBytes commented Mar 13, 2026 •

edited by timebertt

Loading