feat: refactor authentication flows inside of the webhook

[ondbeh]

This pull request significantly improves the documentation and configuration for STACKIT Cert Manager Webhook authentication methods, making it much clearer how to set up and use dynamic, static, and Workload Identity Federation (WIF) authentication.

[Copilot]

Pull request overview

This PR refactors how the webhook authenticates against the STACKIT DNS API by moving authentication selection into a clearer, SDK-driven flow (dynamic SA secret, static SA key path, or Workload Identity Federation), and updates documentation plus E2E/conformance test assets to reflect the new configuration surface.

Changes:

• Introduces explicit auth-mode selection (dynamic secret, static mounted key, WIF) and constructs a preconfigured STACKIT DNS SDK client accordingly.
• Refactors repository layer to consume a pre-initialized SDK API client via repository.Config instead of constructing clients internally.
• Expands E2E coverage (multi-tenant dynamic SA flow) and updates docs/testdata manifests for the new auth configuration fields.

Reviewed changes

Copilot reviewed 23 out of 24 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
internal/resolver/resolver.go	Builds STACKIT SDK client based on auth mode and passes it via repository config.
internal/resolver/config.go	Updates solver config schema (new SA/WIF fields) and auth-mode determination logic.
internal/resolver/resolver_test.go	Restructures resolver test suites and adds auth-mode selection coverage.
internal/resolver/config_test.go	Updates config-provider tests for new fields and namespace-file handling.
internal/repository/config.go	Simplifies repository config to ProjectId + prebuilt ApiClient.
internal/repository/zone_repository.go	Uses Config.ApiClient directly and errors if missing.
internal/repository/zone_repository_test.go	Updates tests to build a test API client via SDK config options.
internal/repository/rrset_repository.go	Uses Config.ApiClient and adjusts DeleteRRSet error handling/return.
internal/repository/rrset_repositry_test.go	Updates RRSet tests to use a prebuilt SDK client.
internal/repository/dns_client.go	Removes internal DNS client-construction helpers (now done in resolver).
README.md	Rewrites authentication documentation into Dynamic / Static / WIF options and updates test procedure docs.
deploy/stackit/values.yaml	Clarifies Helm values for static SA mount and WIF annotations.
deploy/stackit/README.md	Regenerates chart README/values table and bumps chart/app version badge.
testdata/stackit/config.json	Updates example solver config to dynamic secret fields.
testdata/stackit/secret.yaml.example	Updates example secret structure to SA JSON key field.
testdata/stackit/README.md	Updates instructions for generating/applying the example secret.
e2e_test/README.md	Updates conformance test docs to use secret-based SA key setup.
Makefile	Adjusts conformance target env usage and adds namespace/secret creation for multi-tenant E2E.
cmd/webhook/main.go	Minor formatting-only change in transport settings.
tests/e2e/test-suite/wildcard-certificate/00-issuer-cert.yaml	Switches wildcard test Issuer to ClusterIssuer and updates references.
tests/e2e/test-suite/dynamic-sa-auth/00-issuer-cert.yaml	Adds multi-tenant dynamic-SA Issuer+Certificate resources for E2E.
tests/e2e/test-suite/dynamic-sa-auth/00-assert.yaml	Adds assertions that dynamic-SA certificates become Ready.
tests/e2e/test-suite/dynamic-sa-auth/01-delete.yaml	Adds delete step for dynamic-SA certificates.
tests/e2e/test-suite/dynamic-sa-auth/01-assert.yaml	Adds DNS TXT record deletion assertions after cleanup.

Suppressed comments (1)

README.md:90

• This YAML example uses a Markdown link for server: which is not valid YAML and can't be copy/pasted into a ClusterIssuer. Use the raw URL string instead.

     acme:
       server: [https://acme-v02.api.letsencrypt.org/directory](https://acme-v02.api.letsencrypt.org/directory)
       email: example@example.com

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.