Skip to content

Conversation

@Zaggy21
Copy link
Contributor

@Zaggy21 Zaggy21 commented Dec 30, 2025

Description

This PR adds the Authorization Webhook in the authz chart and configures it in the local kind cluster setup. It uses NodePort service for the local setup. The authorizer is triggered after RBAC and only for greenhouse resources requests (see matchConditions in dev-env/webhook/structured-authz.yaml). Authorizer certificates generation is added into the setup-manager make target; mTLS is used for communication between kube-apiserver and authorization webhook.

What type of PR is this? (check all applicable)

  • 🍕 Feature
  • 🐛 Bug Fix
  • 📝 Documentation Update
  • 🎨 Style
  • 🧑‍💻 Code Refactor
  • 🔥 Performance Improvements
  • ✅ Test
  • 🤖 Build
  • 🔁 CI
  • 📦 Chore (Release)
  • ⏩ Revert

Related Tickets & Documents

Added tests?

  • 👍 yes
  • 🙅 no, because they aren't needed
  • 🙋 no, because I need help
  • Separate ticket for tests # (issue/pr)

Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration

Added to documentation?

  • 📜 README.md
  • 🤝 Documentation pages updated
  • 🙅 no documentation needed
  • (if applicable) generated OpenAPI docs for CRD changes

Checklist

  • My code follows the style guidelines of this project
  • I have performed a self-review of my code
  • I have commented my code, particularly in hard-to-understand areas
  • My changes generate no new warnings
  • New and existing unit tests pass locally with my changes

On-behalf-of: @SAP krzysztof.zagorski@sap.com
On-behalf-of: @SAP krzysztof.zagorski@sap.com
On-behalf-of: @SAP krzysztof.zagorski@sap.com
…dePort

On-behalf-of: @SAP krzysztof.zagorski@sap.com
…CoreDNS, use ClusterIP service for authz

On-behalf-of: @SAP krzysztof.zagorski@sap.com
…ned-by label; add serviceaccount with rbac to authz

On-behalf-of: @SAP krzysztof.zagorski@sap.com
On-behalf-of: @SAP krzysztof.zagorski@sap.com
On-behalf-of: @SAP krzysztof.zagorski@sap.com
On-behalf-of: @SAP krzysztof.zagorski@sap.com
…olv.conf and use NodePort service with loopback IP instead

On-behalf-of: @SAP krzysztof.zagorski@sap.com
@abhijith-darshan
Copy link
Contributor

abhijith-darshan commented Jan 6, 2026

e2e's are not working, was anything changed?

…fix lint suggestions

On-behalf-of: @SAP krzysztof.zagorski@sap.com
On-behalf-of: @SAP krzysztof.zagorski@sap.com
On-behalf-of: @SAP krzysztof.zagorski@sap.com
On-behalf-of: @SAP krzysztof.zagorski@sap.com
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[FEAT] - PoC authorizer webhook for resource owners

3 participants