feat: add secret access scope configuration for stackit service account keys

Author: slm0n87

deploy/stackit/README.md

@@ -35,10 +35,11 @@ A Helm chart for stackitcloud/stackit-cert-manager-webhook
 | service | object | `{"port":443,"type":"ClusterIP"}` | Configuration for the webhook service. |
 | service.port | int | `443` | port of the service. |
 | service.type | string | `"ClusterIP"` | type of the service. |
-| stackitSaAuthentication | object | `{"enabled":false,"fileName":"sa.json","mountPath":"/var/run/secrets/stackit","secretName":"stackit-sa-authentication"}` | Configuration for the stackit service account keys. |
+| stackitSaAuthentication | object | `{"enabled":false,"fileName":"sa.json","mountPath":"/var/run/secrets/stackit","secretAccessScope":"webhook","secretName":"stackit-sa-authentication"}` | Configuration for the stackit service account keys. |
 | stackitSaAuthentication.enabled | bool | `false` | enabled flag for the stackit service account keys. |
 | stackitSaAuthentication.fileName | string | `"sa.json"` | key of the service account key in the secret. Which will be later be used to load in keys in the pod as well. |
 | stackitSaAuthentication.mountPath | string | `"/var/run/secrets/stackit"` | Path where the secret will be mounted in the pod. |
+| stackitSaAuthentication.secretAccessScope | string | `"webhook"` | secret access scope for auth token lookup. Use `webhook` for namespace-scoped access (recommended) or `issuer` to allow issuer-namespace secret lookup. |
 | stackitSaAuthentication.secretName | string | `"stackit-sa-authentication"` | secret where the service account key is stored. Should be in the same namespace as the webhook since it will be mounted into the pod. |
 | tolerations | list | `[]` | Tolerations for the webhook. |
 

deploy/stackit/templates/deployment.yaml

@@ -32,6 +32,8 @@ spec:
           env:
             - name: GROUP_NAME
               value: {{ .Values.groupName | quote }}
+            - name: STACKIT_SECRET_ACCESS_SCOPE
+              value: {{ .Values.stackitSaAuthentication.secretAccessScope | quote }}
             {{- if .Values.stackitSaAuthentication.enabled }}
             - name: STACKIT_SERVICE_ACCOUNT_KEY_PATH
               value: "{{ .Values.stackitSaAuthentication.mountPath}}/{{ .Values.stackitSaAuthentication.fileName}}"

deploy/stackit/templates/rbac.yaml

@@ -94,10 +94,17 @@ subjects:
     name: {{ .Values.certManager.serviceAccountName }}
     namespace: {{ .Values.certManager.namespace }}
 ---
+{{- if eq (.Values.stackitSaAuthentication.secretAccessScope | default "webhook") "issuer" }}
+# Cluster-wide access to the webhook's authentication secret for issuer-scoped mode
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: {{ include "stackit-cert-manager-webhook.fullname" . }}:secret-reader
+  labels:
+    app: {{ include "stackit-cert-manager-webhook.name" . }}
+    chart: {{ include "stackit-cert-manager-webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
 rules:
   - apiGroups:
       - ""
@@ -106,11 +113,41 @@ rules:
     verbs:
       - "get"
       - "watch"
+{{- else }}
+# Namespace-scoped Role for reading the webhook's authentication secret
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "stackit-cert-manager-webhook.fullname" . }}:secret-reader
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ include "stackit-cert-manager-webhook.name" . }}
+    chart: {{ include "stackit-cert-manager-webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - "secrets"
+    verbs:
+      - "get"
+      - "watch"
+    resourceNames:
+      - {{ .Values.stackitSaAuthentication.secretName | default "stackit-cert-manager-webhook" }}
+{{- end }}
 ---
+# Binding for the webhook secret reader
+{{- if eq (.Values.stackitSaAuthentication.secretAccessScope | default "webhook") "issuer" }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: {{ include "stackit-cert-manager-webhook.fullname" . }}:secret-reader
+  labels:
+    app: {{ include "stackit-cert-manager-webhook.name" . }}
+    chart: {{ include "stackit-cert-manager-webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -120,6 +157,27 @@ subjects:
     kind: ServiceAccount
     name: {{ include "stackit-cert-manager-webhook.fullname" . }}
     namespace: {{ .Release.Namespace }}
+{{- else }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "stackit-cert-manager-webhook.fullname" . }}:secret-reader
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ include "stackit-cert-manager-webhook.name" . }}
+    chart: {{ include "stackit-cert-manager-webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "stackit-cert-manager-webhook.fullname" . }}:secret-reader
+subjects:
+  - apiGroup: ""
+    kind: ServiceAccount
+    name: {{ include "stackit-cert-manager-webhook.fullname" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole

deploy/stackit/values.yaml

@@ -39,6 +39,9 @@ fullnameOverride: ""
 stackitSaAuthentication:
   # -- enabled flag for the stackit service account keys.
   enabled: false
+  # -- controls whether the webhook secret is read only from the webhook namespace or may be read from the issuer namespace.
+  # -- secret access scope for auth token lookup. Use "webhook" for namespace-scoped access (recommended) or "issuer" to allow issuer-namespace secret lookup.
+  secretAccessScope: webhook
   # -- secret where the service account key is stored. Should be in the same namespace as the webhook since it will be mounted into the pod.
   secretName: stackit-sa-authentication
   # -- key of the service account key in the secret. Which will be later be used to load in keys in the pod as well.

internal/resolver/config.go

@@ -18,8 +18,14 @@ type ConfigProvider interface {
 
 type defaultConfigProvider struct {
 	fileNamespaceName string
+	secretAccessScope string
 }
 
+const (
+	secretAccessScopeWebhook = "webhook"
+	secretAccessScopeIssuer   = "issuer"
+)
+
 type StackitDnsProviderConfig struct {
 	ProjectId                string `json:"projectId"`
 	ApiBasePath              string `json:"apiBasePath"`
@@ -49,11 +55,12 @@ func (d defaultConfigProvider) LoadConfig(cfgJSON *extapi.JSON) (StackitDnsProvi
 		return cfg, err
 	}
 
-	if cfg.AuthTokenSecretNamespace == "" {
+	scope := d.secretAccessScope
+	if scope == "" || scope == secretAccessScopeWebhook {
 		cfg.AuthTokenSecretNamespace = webhookNamespace
 	}
 
-	if err := validateSecretNamespace(cfg.AuthTokenSecretNamespace, webhookNamespace); err != nil {
+	if err := validateSecretNamespace(cfg.AuthTokenSecretNamespace, webhookNamespace, scope); err != nil {
 		return cfg, err
 	}
 
@@ -64,12 +71,21 @@ func (d defaultConfigProvider) LoadConfig(cfgJSON *extapi.JSON) (StackitDnsProvi
 	return cfg, nil
 }
 
-func validateSecretNamespace(configuredNamespace, webhookNamespace string) error {
-	// Secrets must be in the same namespace as the webhook
-	if configuredNamespace != webhookNamespace {
-		return fmt.Errorf("authTokenSecretNamespace must be %s, got: %s", webhookNamespace, configuredNamespace)
+func validateSecretNamespace(configuredNamespace, webhookNamespace, accessScope string) error {
+	switch accessScope {
+	case "", secretAccessScopeWebhook:
+		if configuredNamespace != webhookNamespace {
+			return fmt.Errorf("authTokenSecretNamespace must be %s, got: %s", webhookNamespace, configuredNamespace)
+		}
+		return nil
+	case secretAccessScopeIssuer:
+		if configuredNamespace == "" {
+			return fmt.Errorf("authTokenSecretNamespace must be specified when secretAccessScope=issuer")
+		}
+		return nil
+	default:
+		return fmt.Errorf("invalid secretAccessScope %q", accessScope)
 	}
-	return nil
 }
 
 func unmarshalConfig(cfgJSON *extapi.JSON, cfg *StackitDnsProviderConfig) error {
@@ -152,5 +168,6 @@ func determineNamespace(fileNamespaceName string) (string, error) {
 func NewConfigProvider() ConfigProvider {
 	return defaultConfigProvider{
 		fileNamespaceName: "/var/run/secrets/kubernetes.io/serviceaccount/namespace",
+		secretAccessScope: strings.ToLower(strings.TrimSpace(os.Getenv("STACKIT_SECRET_ACCESS_SCOPE"))),
 	}
 }