feat: refactor authentication flows inside of the webhook - #225
Merged
ondbeh merged 5 commits intoAug 26, 2026
Merged
Conversation
Copy link
Copy Markdown
Contributor
Sorry, something went wrong.
Remove the obsolete long-live token authentication option. Add the possibility to setup multitenant environment using SA keys per namespace. Add the possibility to use WIF auth flow.
Copy link
Copy Markdown
There was a problem hiding this comment.
Pull request overview
This PR refactors how the webhook authenticates against the STACKIT DNS API by moving authentication selection into a clearer, SDK-driven flow (dynamic SA secret, static SA key path, or Workload Identity Federation), and updates documentation plus E2E/conformance test assets to reflect the new configuration surface.
Changes:
- Introduces explicit auth-mode selection (dynamic secret, static mounted key, WIF) and constructs a preconfigured STACKIT DNS SDK client accordingly.
- Refactors repository layer to consume a pre-initialized SDK API client via repository.Config instead of constructing clients internally.
- Expands E2E coverage (multi-tenant dynamic SA flow) and updates docs/testdata manifests for the new auth configuration fields.
Reviewed changes
Copilot reviewed 23 out of 24 changed files in this pull request and generated 8 comments.
Show a summary per file| File | Description |
|---|---|
| internal/resolver/resolver.go | Builds STACKIT SDK client based on auth mode and passes it via repository config. |
| internal/resolver/config.go | Updates solver config schema (new SA/WIF fields) and auth-mode determination logic. |
| internal/resolver/resolver_test.go | Restructures resolver test suites and adds auth-mode selection coverage. |
| internal/resolver/config_test.go | Updates config-provider tests for new fields and namespace-file handling. |
| internal/repository/config.go | Simplifies repository config to ProjectId + prebuilt ApiClient. |
| internal/repository/zone_repository.go | Uses Config.ApiClient directly and errors if missing. |
| internal/repository/zone_repository_test.go | Updates tests to build a test API client via SDK config options. |
| internal/repository/rrset_repository.go | Uses Config.ApiClient and adjusts DeleteRRSet error handling/return. |
| internal/repository/rrset_repositry_test.go | Updates RRSet tests to use a prebuilt SDK client. |
| internal/repository/dns_client.go | Removes internal DNS client-construction helpers (now done in resolver). |
| README.md | Rewrites authentication documentation into Dynamic / Static / WIF options and updates test procedure docs. |
| deploy/stackit/values.yaml | Clarifies Helm values for static SA mount and WIF annotations. |
| deploy/stackit/README.md | Regenerates chart README/values table and bumps chart/app version badge. |
| testdata/stackit/config.json | Updates example solver config to dynamic secret fields. |
| testdata/stackit/secret.yaml.example | Updates example secret structure to SA JSON key field. |
| testdata/stackit/README.md | Updates instructions for generating/applying the example secret. |
| e2e_test/README.md | Updates conformance test docs to use secret-based SA key setup. |
| Makefile | Adjusts conformance target env usage and adds namespace/secret creation for multi-tenant E2E. |
| cmd/webhook/main.go | Minor formatting-only change in transport settings. |
| tests/e2e/test-suite/wildcard-certificate/00-issuer-cert.yaml | Switches wildcard test Issuer to ClusterIssuer and updates references. |
| tests/e2e/test-suite/dynamic-sa-auth/00-issuer-cert.yaml | Adds multi-tenant dynamic-SA Issuer+Certificate resources for E2E. |
| tests/e2e/test-suite/dynamic-sa-auth/00-assert.yaml | Adds assertions that dynamic-SA certificates become Ready. |
| tests/e2e/test-suite/dynamic-sa-auth/01-delete.yaml | Adds delete step for dynamic-SA certificates. |
| tests/e2e/test-suite/dynamic-sa-auth/01-assert.yaml | Adds DNS TXT record deletion assertions after cleanup. |
README.md:90
- This YAML example uses a Markdown link for server: which is not valid YAML and can't be copy/pasted into a ClusterIssuer. Use the raw URL string instead.
acme:
server: [https://acme-v02.api.letsencrypt.org/directory](https://acme-v02.api.letsencrypt.org/directory)
email: example@example.com
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Sorry, something went wrong.
Comment thread
internal/resolver/config.go
Outdated
Comment thread
tests/e2e/test-suite/dynamic-sa-auth/01-assert.yaml
Outdated
Comment thread
testdata/stackit/secret.yaml.example
Comment thread
README.md
Comment thread
internal/resolver/resolver_test.go
Outdated
Comment thread
testdata/stackit/README.md
Comment thread
README.md
Outdated
Comment thread
README.md
Outdated
fsandel
approved these changes
Aug 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Reviewers
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request significantly improves the documentation and configuration for STACKIT Cert Manager Webhook authentication methods, making it much clearer how to set up and use dynamic, static, and Workload Identity Federation (WIF) authentication.