Use CA in cloudprofile for STACKIT clients by nschad · Pull Request #150 · stackitcloud/gardener-extension-provider-stackit

nschad · 2026-05-21T11:40:44Z

How to categorize this PR?

/kind enhancement

What this PR does / why we need it:

Removes the custom-ca secret and instead uses the CA from the Cloudprofile for all stackit components. OpenStack is unaffected.

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Breaking changes:

ske-prow · 2026-05-21T11:40:52Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign nschad for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

nschad · 2026-06-08T09:46:59Z

/retest

nschad · 2026-06-08T09:47:41Z

/test post-gardener-extension-provider-stackit-dev-artifacts

ske-prow · 2026-06-08T09:47:46Z

@nschad: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

/test pull-gardener-extension-provider-stackit-integration-tests

/test pull-gardener-extension-provider-stackit-validate-renovate

/test pull-gardener-extension-provider-stackit-verify

Use /test all to run the following jobs that were automatically triggered:

pull-gardener-extension-provider-stackit-integration-tests

pull-gardener-extension-provider-stackit-verify

Details

In response to this:

/test post-gardener-extension-provider-stackit-dev-artifacts

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

breuerfelix

Add tests for as much as possible. E.g. webhook, factory and maybe valuesprovider

breuerfelix · 2026-06-19T14:42:28Z

 		"podNetwork":        strings.Join(extensionscontroller.GetPodNetwork(cluster), ","),
 		"podAnnotations": map[string]any{
 			"checksum/secret-" + v1beta1constants.SecretNameCloudProvider: checksums[v1beta1constants.SecretNameCloudProvider],
 			"checksum/secret-" + openstack.CloudProviderConfigName:        checksums[openstack.CloudProviderConfigName],


We also need to add a checksum of the new stackit-ca here, we also need to make sure that the other pods that use the secret has the corresponding checksum in order for ca rotation to work properly

CA rotation? That's not really a thing to be honest, atleast in this case

dergeberl · 2026-07-03T06:17:48Z

+func newHTTPClientWithCustomCA(caBundle []byte) (*http.Client, error) {
+	caCertPool, err := x509.SystemCertPool()
+	if err != nil {
+		// we could also fall back here and use an empty pool via x509.NewCertPool()


I think erroring is fine but we should customize the error to state what is broken and where does it come from.

dergeberl · 2026-07-03T06:29:13Z

+apiVersion: v1
+kind: Secret
+metadata:
+  name: stackit-ca-bundle


As the CloudProfile.Spec.CABundle field is no STACKIT exclusive I am not sure if we should name it differently (like cloudprofile-ca-bundle), WDYT?

I've renamed this. Do you also want me to rename the "internal-path". For example it's called stackit-ca.crt everywhere. I thought its okay since this is the "stackit" extension. So 🤷

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

…ed Root CA's Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

…le instead Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

…lm-chart Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

…ending everytime Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

…verted Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

ske-prow Bot added kind/enhancement Enhancement, improvement, extension do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. labels May 21, 2026

ske-prow Bot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels May 21, 2026

nschad force-pushed the use-cloudprofile-ca branch from 2677cbd to ec54626 Compare May 22, 2026 07:42

jamand mentioned this pull request May 22, 2026

fix: Add nlb.admin for exposure integration test SA #152

Merged

nschad force-pushed the use-cloudprofile-ca branch from ec54626 to 3afb9c7 Compare June 1, 2026 11:18

nschad commented Jun 5, 2026

View reviewed changes

Comment thread charts/gardener-extension-provider-stackit/templates/deployment.yaml

nschad force-pushed the use-cloudprofile-ca branch 3 times, most recently from cffc406 to 6431448 Compare June 8, 2026 08:46

nschad changed the title ~~WIP: Use CA in cloudprofile for STACKIT clients~~ Use CA in cloudprofile for STACKIT clients Jun 8, 2026

ske-prow Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 8, 2026

nschad commented Jun 8, 2026

View reviewed changes

Comment thread ...plane/charts/stackit-blockstorage-csi-driver/templates/deployment-csi-driver-controller.yaml Outdated

breuerfelix requested changes Jun 9, 2026

View reviewed changes

Comment thread charts/internal/cloud-provider-config/values.yaml Outdated

Comment thread pkg/webhook/controlplane/ensurer.go Outdated

breuerfelix requested changes Jun 19, 2026

View reviewed changes

ske-prow Bot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Jun 23, 2026

nschad force-pushed the use-cloudprofile-ca branch from 2ef9925 to 38ef61c Compare June 24, 2026 07:30

dergeberl reviewed Jul 3, 2026

View reviewed changes

nschad added 5 commits July 3, 2026 09:19

Use CA in cloudprofile for STACKIT clients

3cac34c

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

Add CABundle to mcm-provider-stackit if specified

1d346d4

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

deduplicate CABundle for CSI/CCM

3fc27c4

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

align volumeName with CSI/CCM

3951f6d

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

fix some lint errors

1247bc8

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

nschad added 23 commits July 3, 2026 09:19

drop costuom-certs in provider-stackit

155c48e

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

do not double-encode cloudprofile caBundle

402ffcd

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

fix secret chart

36d70d0

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

decode cloudProfile.caBundle before using it

0e8fe95

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

use stackit SDK WithCustomHTTPClient for custom Transport with modifi…

521eb06

…ed Root CA's Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

format and simplify code

0cb5e9c

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

remove unused helm value

5b01a22

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

rename InjectCAIntoHTTPClient => newHTTPClientWithCustomCA

980bdbf

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

fix: use newObj instead of old machineDeployment

74fff99

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

add unit test for webhook

5b75cf3

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

add unit test for DecodeCloudProfileCABundle

059d603

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

use const variable instead of string for volume name

232f787

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

rename cloudProfileCABundleB64 => CABundleBase64

be9ae1a

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

remove stackitv1alpha1.Cloudprofile's CABundle; use gardener's CABund…

d8a0ca0

…le instead Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

Gardener's Cloudprofile CABundle is not encoded. Encode it for the he…

aa88233

…lm-chart Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

use EnsureVolumeWithName and EnsureVolumeMountWithName instead of app…

de1feea

…ending everytime Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

add stackit-ca-bundle from config chart to internal chart

e85a96e

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

use EnsureEnvVarWithName for the ENV vars

588e65e

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

keep caBundle in the Cloudprofile to not breaking strict decoding

a966878

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

improve error message for newHTTPClientWithCustomCA()

bcdf4ae

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

rename stackit-ca-bundle to cloudprofile-ca-bundle

85951a0

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

use constant for cloudprofile-ca-bundle

d1bc758

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

remove the mcm flag --resource-exhausted-retry as this version was re…

40db20c

…verted Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

nschad force-pushed the use-cloudprofile-ca branch from 38ef61c to 40db20c Compare July 3, 2026 07:38

remove gosec nolint directive

04db709

Signed-off-by: Niclas Schad <niclas.schad@stackit.cloud>

Uh oh!

Conversation

nschad commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ske-prow Bot commented May 21, 2026

Uh oh!

Uh oh!

nschad commented Jun 8, 2026

Uh oh!

nschad commented Jun 8, 2026

Uh oh!

ske-prow Bot commented Jun 8, 2026

Uh oh!

Uh oh!

breuerfelix left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

breuerfelix Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

nschad Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dergeberl Jul 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

dergeberl Jul 3, 2026

Choose a reason for hiding this comment

Uh oh!

nschad Jul 3, 2026

Choose a reason for hiding this comment

Uh oh!

nschad Jul 3, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

nschad commented May 21, 2026 •

edited

Loading

nschad Jun 19, 2026 •

edited

Loading