feat(plugins): flux helm releases for OIDC clusters via ObjectLevelWorkloadIdentity - #2201
Open
mikolajkucinski wants to merge 10 commits into
Open
feat(plugins): flux helm releases for OIDC clusters via ObjectLevelWorkloadIdentity#2201mikolajkucinski wants to merge 10 commits into
mikolajkucinski wants to merge 10 commits into
Conversation
24 tasks
abhijith-darshan
force-pushed
the
feat/1637-object-level-workload-identity
branch
3 times, most recently
from
September 9, 2026 09:09
e6d971c to
eab1e74
Compare
Base automatically changed from
feat/1637-object-level-workload-identity
to
main
September 9, 2026 14:12
On-behalf-of: @SAP <mikolaj.kucinski@sap.com> Signed-off-by: Mikolaj Kucinski <osidu12@gmail.com>
Add configMapRef selection for OIDC clusters, a fallback to the kubeconfig Secret while the ConfigMap is missing, and an e2e for the emitted reference. On-behalf-of: @SAP <mikolaj.kucinski@sap.com> Signed-off-by: Mikolaj Kucinski <osidu12@gmail.com>
Enable the feature gate on helm-controller in the flux install used by dev-env and e2e, and assert the release installs through the access ConfigMap instead of only checking the reference Greenhouse emits. On-behalf-of: @SAP <mikolaj.kucinski@sap.com> Signed-off-by: Mikolaj Kucinski <osidu12@gmail.com>
On-behalf-of: @SAP <mikolaj.kucinski@sap.com> Signed-off-by: Mikolaj Kucinski <osidu12@gmail.com>
On-behalf-of: @SAP <mikolaj.kucinski@sap.com> Signed-off-by: Mikolaj Kucinski <osidu12@gmail.com>
On-behalf-of: @SAP <mikolaj.kucinski@sap.com> Signed-off-by: Mikolaj Kucinski <osidu12@gmail.com>
…cluster access On-behalf-of: @SAP <mikolaj.kucinski@sap.com> Signed-off-by: Mikolaj Kucinski <osidu12@gmail.com>
mikolajkucinski
force-pushed
the
feat/1637-plugin-object-level-workload-identity
branch
from
September 9, 2026 14:37
4dc156c to
9e66b6b
Compare
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
There are confirmed logic/config wiring issues that can break workload identity behavior (bootstrap feature flags config not passed; HelmRelease can reference a missing ConfigMap).
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Enables Plugins (Flux HelmReleases) to target OIDC-onboarded clusters via Flux’s ObjectLevelWorkloadIdentity by switching from kubeconfig Secrets to a workload-identity ConfigMap reference, and adds E2E coverage for the end-to-end OIDC onboarding + install path.
Changes:
- Add HelmRelease builder support for
kubeConfig.configMapRefand corresponding unit tests. - Update Plugin controller logic to use workload identity (and mint SA tokens) when the feature flag is enabled and the target Cluster is OIDC.
- Add an E2E scenario validating HelmRelease connectivity through the workload identity ConfigMap, plus suite wiring.
File summaries
| File | Description |
|---|---|
| internal/flux/helm_release_builder.go | Adds WithKubeConfigFromConfigMap to build HelmRelease specs targeting OIDC clusters via ConfigMap. |
| internal/flux/helm_release_builder_test.go | Unit tests for the new ConfigMap-based kubeConfig behavior. |
| internal/controller/plugin/util.go | Chooses REST client getter based on WI feature flag + OIDC annotation (TokenRequest vs kubeconfig Secret). |
| internal/controller/plugin/plugin_controller.go | Adds WI feature flag field and RBAC for TokenRequest creation. |
| internal/controller/plugin/plugin_controller_flux.go | Switches HelmRelease creation to use configMapRef for OIDC clusters (gated by WI flag). |
| internal/controller/plugin/oci_mirror.go | Uses WI-aware initClientGetter when initializing remote access for OCI mirroring logic. |
| e2e/plugin/scenarios/flux_object_level_workload_identity.go | New E2E scenario covering OIDC onboarding → ConfigMap render → HelmRelease uses configMapRef and becomes Ready. |
| e2e/plugin/e2e_test.go | Adds OIDC cluster name, cleanup, and registers the new scenario. |
| cmd/greenhouse/controllers.go | Wires WI feature flag into Plugin reconciler startup; adjusts Bootstrap reconciler wiring. |
Review details
- Files reviewed: 9/9 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
127
to
130
| func startBootstrapReconciler(name string, mgr ctrl.Manager) error { | ||
| return (&clustercontrollers.BootstrapReconciler{ | ||
| WorkloadIdentityEnabled: featureFlags.IsWorkloadIdentityEnabled(), | ||
| FeatureFlagsName: clientutil.GetEnvOrDefault(featureFlagsEnv, defaultFeatureFlagConfigMapName), | ||
| FeatureFlagsNamespace: clientutil.GetEnvOrDefault(podNamespaceEnv, defaultPodNamespace), | ||
| }).SetupWithManager(name, mgr) |
abhijith-darshan
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
#2192 made the bootstrap controller write a ConfigMap describing how to reach an OIDC onboarded cluster. This one makes Plugins use it. The HelmRelease points at that ConfigMap with
configMapRefinstead of the kubeconfig Secret, and helm templating builds its client the same way throughNewRestClientGetterForWI, so helm-controller and the Plugin controller each mint their own token and there is nothing left to rotate.Which path a Plugin takes follows the
workloadIdentityfeature gate and the cluster connectivity annotation, so the Plugin controller no longer probes for the ConfigMap and falls back. Clusters onboarded with a kubeconfig keep the Secret either way, and with the gate off nothing changes at all.What type of PR is this? (check all applicable)
Related Tickets & Documents
Added tests?
Added to documentation?
Checklist