Add spiffe-helper sidecar injection webhook

Add a MutatingAdmissionWebhook that automatically injects spiffe-helper
init containers and sidecars into pods annotated with
spiffe.openshift.io/inject-helper: "true", eliminating manual sidecar
configuration for applications that need on-disk TLS certificates from
SPIRE.

The webhook injects:
- Init container (spiffe-helper-init) for initial SVID fetch
- Sidecar container (spiffe-helper) for continuous certificate rotation
- CSI volume (csi.spiffe.io) for SPIRE workload API access
- EmptyDir volume for certificate storage
- ConfigMap volume for helper configuration

Optional annotations allow customizing the cert directory
(spiffe.openshift.io/cert-dir) and ConfigMap name
(spiffe.openshift.io/helper-config).

Closes #96

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fabien Dupont <fdupont@redhat.com>

Author: fabiendupont

bindata/spiffe-helper/spiffe-helper-mutating-webhook.yaml

@@ -0,0 +1,26 @@
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: spiffe-helper-sidecar-injector
+  labels:
+    app.kubernetes.io/name: spiffe-helper
+    app.kubernetes.io/instance: spire
+    app.kubernetes.io/managed-by: "zero-trust-workload-identity-manager"
+    app.kubernetes.io/part-of: "zero-trust-workload-identity-manager"
+  annotations:
+    service.beta.openshift.io/inject-cabundle: "true"
+webhooks:
+  - admissionReviewVersions: ["v1"]
+    clientConfig:
+      service:
+        name: spiffe-helper-webhook
+        namespace: zero-trust-workload-identity-manager
+        path: /mutate-pods-spiffe-helper
+    failurePolicy: Ignore
+    name: spiffe-helper.spiffe.openshift.io
+    rules:
+      - apiGroups: [""]
+        apiVersions: ["v1"]
+        operations: ["CREATE"]
+        resources: ["pods"]
+    sideEffects: None

bindata/spiffe-helper/spiffe-helper-webhook-deployment.yaml

@@ -0,0 +1,82 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: spiffe-helper-webhook
+  namespace: zero-trust-workload-identity-manager
+  labels:
+    app.kubernetes.io/name: spiffe-helper
+    app.kubernetes.io/instance: spire
+    app.kubernetes.io/managed-by: "zero-trust-workload-identity-manager"
+    app.kubernetes.io/part-of: "zero-trust-workload-identity-manager"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: spiffe-helper-webhook
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: spiffe-helper-webhook
+        app.kubernetes.io/instance: spire
+        app.kubernetes.io/managed-by: "zero-trust-workload-identity-manager"
+        app.kubernetes.io/part-of: "zero-trust-workload-identity-manager"
+    spec:
+      serviceAccountName: controller-manager
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - name: webhook
+        image: controller:latest
+        command:
+        - /usr/bin/zero-trust-workload-identity-manager
+        args:
+        - --serve-webhook
+        - --webhook-cert-dir=/tmp/k8s-webhook-server/serving-certs
+        - --health-probe-bind-address=:8082
+        ports:
+        - containerPort: 9443
+          name: webhook
+          protocol: TCP
+        - containerPort: 8082
+          name: health
+          protocol: TCP
+        env:
+        - name: OPERATOR_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: RELATED_IMAGE_SPIFFE_HELPER
+          value: ghcr.io/spiffe/spiffe-helper:0.11.0
+        securityContext:
+          readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - "ALL"
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 8082
+          initialDelaySeconds: 10
+          periodSeconds: 20
+        readinessProbe:
+          httpGet:
+            path: /readyz
+            port: 8082
+          initialDelaySeconds: 5
+          periodSeconds: 10
+        resources:
+          requests:
+            cpu: 50m
+            memory: 64Mi
+        volumeMounts:
+        - name: webhook-certs
+          mountPath: /tmp/k8s-webhook-server/serving-certs
+          readOnly: true
+      volumes:
+      - name: webhook-certs
+        secret:
+          secretName: spiffe-helper-webhook-certs
+      terminationGracePeriodSeconds: 10

bindata/spiffe-helper/spiffe-helper-webhook-service.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: spiffe-helper-webhook
+  namespace: zero-trust-workload-identity-manager
+  labels:
+    app.kubernetes.io/name: spiffe-helper
+    app.kubernetes.io/instance: spire
+    app.kubernetes.io/managed-by: "zero-trust-workload-identity-manager"
+    app.kubernetes.io/part-of: "zero-trust-workload-identity-manager"
+  annotations:
+    service.beta.openshift.io/serving-cert-secret-name: spiffe-helper-webhook-certs
+spec:
+  type: ClusterIP
+  ports:
+    - name: https
+      port: 443
+      targetPort: 9443
+      protocol: TCP
+  selector:
+    app.kubernetes.io/name: spiffe-helper-webhook

bundle/manifests/zero-trust-workload-identity-manager.clusterserviceversion.yaml

@@ -211,7 +211,7 @@ metadata:
     capabilities: Basic Install
     console.openshift.io/disable-operand-delete: "true"
     containerImage: openshift.io/zero-trust-workload-identity-manager
-    createdAt: "2026-02-23T10:55:35Z"
+    createdAt: "2026-03-04T19:58:03Z"
     features.operators.openshift.io/cnf: "false"
     features.operators.openshift.io/cni: "false"
     features.operators.openshift.io/csi: "true"
@@ -344,6 +344,7 @@ spec:
         - apiGroups:
           - ""
           resourceNames:
+          - spiffe-helper-webhook
           - spire-agent
           - spire-controller-manager-webhook
           - spire-server
@@ -354,6 +355,25 @@ spec:
           - delete
           - get
           - update
+        - apiGroups:
+          - admissionregistration.k8s.io
+          resources:
+          - mutatingwebhookconfigurations
+          verbs:
+          - create
+          - get
+          - list
+          - watch
+        - apiGroups:
+          - admissionregistration.k8s.io
+          resourceNames:
+          - spiffe-helper-sidecar-injector
+          resources:
+          - mutatingwebhookconfigurations
+          verbs:
+          - delete
+          - patch
+          - update
         - apiGroups:
           - admissionregistration.k8s.io
           resources:
@@ -397,6 +417,7 @@ spec:
         - apiGroups:
           - apps
           resourceNames:
+          - spiffe-helper-webhook
           - spire-spiffe-oidc-discovery-provider
           resources:
           - deployments
@@ -707,6 +728,10 @@ spec:
                   value: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.9.4
                 - name: RELATED_IMAGE_SPIFFE_CSI_INIT_CONTAINER
                   value: registry.access.redhat.com/ubi9:latest
+                - name: RELATED_IMAGE_SPIFFE_HELPER
+                  value: ghcr.io/spiffe/spiffe-helper:0.11.0
+                - name: RELATED_IMAGE_SPIFFE_HELPER_WEBHOOK
+                  value: controller:latest
                 - name: OPERATOR_LOG_LEVEL
                   value: "2"
                 - name: METRICS_BIND_ADDRESS
@@ -799,4 +824,8 @@ spec:
     name: node-driver-registrar
   - image: registry.access.redhat.com/ubi9:latest
     name: spiffe-csi-init-container
+  - image: ghcr.io/spiffe/spiffe-helper:0.11.0
+    name: spiffe-helper
+  - image: controller:latest
+    name: spiffe-helper-webhook
   version: 1.0.0

cmd/zero-trust-workload-identity-manager/main.go

@@ -43,6 +43,7 @@ import (
 	operatoropenshiftiov1alpha1 "github.com/openshift/zero-trust-workload-identity-manager/api/v1alpha1"
 	customClient "github.com/openshift/zero-trust-workload-identity-manager/pkg/client"
 	spiffeCsiDriverController "github.com/openshift/zero-trust-workload-identity-manager/pkg/controller/spiffe-csi-driver"
+	spiffeHelperController "github.com/openshift/zero-trust-workload-identity-manager/pkg/controller/spiffe-helper"
 	spireAgentController "github.com/openshift/zero-trust-workload-identity-manager/pkg/controller/spire-agent"
 	spireOIDCDiscoveryProviderController "github.com/openshift/zero-trust-workload-identity-manager/pkg/controller/spire-oidc-discovery-provider"
 	spireServerController "github.com/openshift/zero-trust-workload-identity-manager/pkg/controller/spire-server"
@@ -88,6 +89,8 @@ func main() {
 		enableHTTP2          bool
 		logLevel             int
 		metricsCerts         string
+		serveWebhook         bool
+		webhookCertDir       string
 		metricsTLSOpts       []func(*tls.Config)
 		webhookTLSOpts       []func(*tls.Config)
 	)
@@ -105,6 +108,10 @@ func main() {
 	flag.StringVar(&metricsCerts, "metrics-cert-dir", "",
 		"Secret name containing the certificates for the metrics server which should be present in operator namespace. "+
 			"If not provided self-signed certificates will be used")
+	flag.BoolVar(&serveWebhook, "serve-webhook", false,
+		"Run in webhook server mode: only serve admission webhooks, skip controllers")
+	flag.StringVar(&webhookCertDir, "webhook-cert-dir", "/tmp/k8s-webhook-server/serving-certs",
+		"Directory containing TLS certificates for the webhook server")
 	opts := zap.Options{
 		Development: true,
 	}
@@ -122,6 +129,12 @@ func main() {
 	}
 	setupLog.Info("Operator namespace configured", "namespace", operatorNamespace)
 
+	// Webhook-only mode: serve admission webhooks without controllers
+	if serveWebhook {
+		runWebhookServer(webhookCertDir, probeAddr, enableHTTP2, logLevel)
+		return
+	}
+
 	if !enableHTTP2 {
 		// if the enable-http2 flag is false (the default), http/2 should be disabled
 		// due to its vulnerabilities.
@@ -270,6 +283,14 @@ func main() {
 		exitOnError(err, "unable to setup spire OIDC discovery provider controller manager")
 	}
 
+	spiffeHelperControllerManager, err := spiffeHelperController.New(mgr)
+	if err != nil {
+		exitOnError(err, "unable to set up spiffe helper controller manager")
+	}
+	if err = spiffeHelperControllerManager.SetupWithManager(mgr); err != nil {
+		exitOnError(err, "unable to setup spiffe helper controller manager")
+	}
+
 	if err = mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
 		exitOnError(err, "unable to set up health check")
 	}
@@ -290,3 +311,43 @@ func exitOnError(err error, logMessage string) {
 		os.Exit(1)
 	}
 }
+
+// runWebhookServer starts a minimal manager that only serves admission webhooks
+func runWebhookServer(certDir, probeAddr string, enableHTTP2 bool, logLevel int) {
+	setupLog.Info("starting in webhook server mode")
+
+	var webhookTLSOpts []func(*tls.Config)
+	if !enableHTTP2 {
+		webhookTLSOpts = append(webhookTLSOpts, func(c *tls.Config) {
+			c.NextProtos = []string{"http/1.1"}
+		})
+	}
+
+	webhookServer := webhook.NewServer(webhook.Options{
+		TLSOpts: webhookTLSOpts,
+		CertDir: certDir,
+	})
+
+	config := ctrl.GetConfigOrDie()
+	mgr, err := ctrl.NewManager(config, ctrl.Options{
+		Scheme:                 scheme,
+		WebhookServer:          webhookServer,
+		HealthProbeBindAddress: probeAddr,
+		Metrics:                metricsserver.Options{BindAddress: "0"},
+	})
+	exitOnError(err, "unable to start webhook manager")
+
+	spiffeHelperInjector := spiffeHelperController.NewSpiffeHelperInjector()
+	mgr.GetWebhookServer().Register("/mutate-pods-spiffe-helper", &webhook.Admission{Handler: spiffeHelperInjector})
+
+	if err = mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
+		exitOnError(err, "unable to set up health check")
+	}
+	if err = mgr.AddReadyzCheck("readyz", healthz.Ping); err != nil {
+		exitOnError(err, "unable to set up ready check")
+	}
+
+	setupLog.Info("starting webhook server")
+	err = mgr.Start(ctrl.SetupSignalHandler())
+	exitOnError(err, "problem running webhook server")
+}

config/manager/manager.yaml

@@ -92,6 +92,10 @@ spec:
           value: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.9.4
         - name: RELATED_IMAGE_SPIFFE_CSI_INIT_CONTAINER
           value: registry.access.redhat.com/ubi9:latest
+        - name: RELATED_IMAGE_SPIFFE_HELPER
+          value: ghcr.io/spiffe/spiffe-helper:0.11.0
+        - name: RELATED_IMAGE_SPIFFE_HELPER_WEBHOOK
+          value: controller:latest
         - name: OPERATOR_LOG_LEVEL
           value: "2"
         - name: METRICS_BIND_ADDRESS

config/rbac/role.yaml

@@ -67,6 +67,7 @@ rules:
 - apiGroups:
   - ""
   resourceNames:
+  - spiffe-helper-webhook
   - spire-agent
   - spire-controller-manager-webhook
   - spire-server
@@ -77,6 +78,25 @@ rules:
   - delete
   - get
   - update
+- apiGroups:
+  - admissionregistration.k8s.io
+  resources:
+  - mutatingwebhookconfigurations
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+- apiGroups:
+  - admissionregistration.k8s.io
+  resourceNames:
+  - spiffe-helper-sidecar-injector
+  resources:
+  - mutatingwebhookconfigurations
+  verbs:
+  - delete
+  - patch
+  - update
 - apiGroups:
   - admissionregistration.k8s.io
   resources:
@@ -120,6 +140,7 @@ rules:
 - apiGroups:
   - apps
   resourceNames:
+  - spiffe-helper-webhook
   - spire-spiffe-oidc-discovery-provider
   resources:
   - deployments