Allow shoots to use WorkloadIdentity as DNS credentials (#1730)

Author: vpnachev

pkg/admission/validator/secrets.go

@@ -26,6 +26,11 @@ func NewSecretValidator() extensionswebhook.Validator {
 
 // Validate checks whether the given new secret contains valid AWS credentials.
 func (s *secret) Validate(_ context.Context, newObj, oldObj client.Object) error {
+	return ValidateSecret(newObj, oldObj)
+}
+
+// ValidateSecret checks whether the given new secret contains valid AWS credentials.
+func ValidateSecret(newObj, oldObj client.Object) error {
 	secret, ok := newObj.(*corev1.Secret)
 	if !ok {
 		return fmt.Errorf("wrong object type %T", newObj)

pkg/admission/validator/shoot.go

@@ -13,7 +13,9 @@ import (
 	"github.com/gardener/gardener/pkg/apis/core"
 	gardencorehelper "github.com/gardener/gardener/pkg/apis/core/helper"
 	gardencorev1beta1 "github.com/gardener/gardener/pkg/apis/core/v1beta1"
+	securityv1alpha1 "github.com/gardener/gardener/pkg/apis/security/v1alpha1"
 	"github.com/gardener/gardener/pkg/utils/gardener"
+	"github.com/gardener/gardener/pkg/utils/kubernetes"
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -241,25 +243,60 @@ func (s *shoot) validateDNS(ctx context.Context, shoot *core.Shoot) field.ErrorL
 
 		providerFldPath := dnsProvidersPath.Index(i)
 
-		if p.SecretName == nil || *p.SecretName == "" {
-			allErrs = append(allErrs, field.Required(providerFldPath.Child("secretName"),
-				fmt.Sprintf("secretName must be specified for %v provider", aws.DNSType)))
-			continue
-		}
+		// TODO(vpnachev): Enable this validation once the extension does not support github.com/gardener/gardener < v1.135.0
+		// if p.CredentialsRef == nil {
+		// 	allErrs = append(allErrs, field.Required(providerFldPath.Child("credentialsRef"), "must be set"))
+		// }
 
-		secret := &corev1.Secret{}
-		key := client.ObjectKey{Namespace: shoot.Namespace, Name: *p.SecretName}
-		if err := s.apiReader.Get(ctx, key, secret); err != nil {
-			if apierrors.IsNotFound(err) {
-				allErrs = append(allErrs, field.Invalid(providerFldPath.Child("secretName"),
-					*p.SecretName, "referenced secret not found"))
-			} else {
-				allErrs = append(allErrs, field.InternalError(providerFldPath.Child("secretName"), err))
+		if p.CredentialsRef != nil {
+			credentialsFldPath := providerFldPath.Child("credentialsRef")
+
+			credentials, err := kubernetes.GetCredentialsByCrossVersionObjectReference(ctx, s.apiReader, *p.CredentialsRef, shoot.GetNamespace())
+			if err != nil {
+				if apierrors.IsNotFound(err) {
+					allErrs = append(allErrs, field.NotFound(credentialsFldPath, p.CredentialsRef.String()))
+				} else {
+					allErrs = append(allErrs, field.InternalError(credentialsFldPath, err))
+				}
+				continue
 			}
-			continue
-		}
 
-		allErrs = append(allErrs, awsvalidation.ValidateCloudProviderSecret(secret, providerFldPath)...)
+			switch creds := credentials.(type) {
+			case *securityv1alpha1.WorkloadIdentity:
+				if err := ValidateWorkloadIdentity(creds, nil); err != nil {
+					allErrs = append(allErrs, field.Invalid(credentialsFldPath, p.CredentialsRef.String(), err.Error()))
+				}
+			case *corev1.Secret:
+				if err := ValidateSecret(creds, nil); err != nil {
+					allErrs = append(allErrs, field.Invalid(credentialsFldPath, p.CredentialsRef.String(), err.Error()))
+				}
+			default:
+				allErrs = append(allErrs, field.Invalid(credentialsFldPath, p.CredentialsRef.String(), "supported credentials types are Secret and WorkloadIdentity"))
+			}
+		} else { // TODO(vpnachev): Remove the else block once the extension does not support github.com/gardener/gardener < v1.135.0
+			secretNameFldPath := providerFldPath.Child("secretName")
+			if p.SecretName == nil || *p.SecretName == "" {
+				allErrs = append(allErrs, field.Required(secretNameFldPath,
+					fmt.Sprintf("secretName must be specified for %v provider", aws.DNSType)))
+				continue
+			}
+
+			secret := &corev1.Secret{}
+			key := client.ObjectKey{Namespace: shoot.Namespace, Name: *p.SecretName}
+			if err := s.apiReader.Get(ctx, key, secret); err != nil {
+				if apierrors.IsNotFound(err) {
+					allErrs = append(allErrs, field.Invalid(secretNameFldPath,
+						*p.SecretName, "referenced secret not found"))
+				} else {
+					allErrs = append(allErrs, field.InternalError(secretNameFldPath, err))
+				}
+				continue
+			}
+
+			if err := ValidateSecret(secret, nil); err != nil {
+				allErrs = append(allErrs, field.Invalid(secretNameFldPath, p.SecretName, err.Error()))
+			}
+		}
 	}
 
 	return allErrs