gardener · vpnachev · Sep 20, 2024 · Jan 15, 2025 · Jan 15, 2025 · Jan 15, 2025
diff --git a/docs/api-reference/security.md b/docs/api-reference/security.md
@@ -606,6 +606,18 @@ string
 <p>Sub contains the computed value of the subject that is going to be set in JWTs &lsquo;sub&rsquo; claim.</p>
 </td>
 </tr>
+<tr>
+<td>
+<code>issuer</code></br>
+<em>
+string
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>Issuer is the issuer URL of the ID token.</p>
+</td>
+</tr>
 </tbody>
 </table>
 <hr/>

diff --git a/pkg/apis/security/types_workloadidentity.go b/pkg/apis/security/types_workloadidentity.go
@@ -48,6 +48,8 @@ type TargetSystem struct {
 type WorkloadIdentityStatus struct {
 	// Sub contains the computed value of the subject that is going to be set in JWTs 'sub' claim.
 	Sub string
+	// Issuer is the issuer URL of the ID token.
+	Issuer *string
 }
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

diff --git a/pkg/apis/security/v1alpha1/generated.pb.go b/pkg/apis/security/v1alpha1/generated.pb.go
diff --git a/pkg/apis/security/v1alpha1/generated.proto b/pkg/apis/security/v1alpha1/generated.proto
diff --git a/pkg/apis/security/v1alpha1/types_workloadidentity.go b/pkg/apis/security/v1alpha1/types_workloadidentity.go
@@ -51,6 +51,9 @@ type TargetSystem struct {
 type WorkloadIdentityStatus struct {
 	// Sub contains the computed value of the subject that is going to be set in JWTs 'sub' claim.
 	Sub string `json:"sub" protobuf:"bytes,1,opt,name=sub"`
+	// Issuer is the issuer URL of the ID token.
+	// +optional
+	Issuer *string `json:"issuer" protobuf:"bytes,2,opt,name=issuer"`
 }
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

diff --git a/pkg/apis/security/v1alpha1/zz_generated.conversion.go b/pkg/apis/security/v1alpha1/zz_generated.conversion.go
diff --git a/pkg/apis/security/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/security/v1alpha1/zz_generated.deepcopy.go
diff --git a/pkg/apis/security/zz_generated.deepcopy.go b/pkg/apis/security/zz_generated.deepcopy.go
diff --git a/pkg/apiserver/openapi/openapi_generated.go b/pkg/apiserver/openapi/openapi_generated.go
diff --git a/pkg/apiserver/registry/security/workloadidentity/storage/storage.go b/pkg/apiserver/registry/security/workloadidentity/storage/storage.go
@@ -33,7 +33,12 @@ func NewStorage(
 	tokenIssuer workloadidentityutils.TokenIssuer,
 	coreInformerFactory gardencoreinformers.SharedInformerFactory,
 ) WorkloadIdentityStorage {
-	workloadIdentityRest := NewREST(optsGetter)
+	var issuerURL *string
+	if tokenIssuer != nil {
+		issuerURL = new(string)
+		*issuerURL = tokenIssuer.Issuer()
+	}
+	workloadIdentityRest := NewREST(optsGetter, issuerURL)
 
 	return WorkloadIdentityStorage{
 		WorkloadIdentity: workloadIdentityRest,
@@ -42,7 +47,9 @@ func NewStorage(
 }
 
 // NewREST returns a RESTStorage object that will work against WorkloadIdentity.
-func NewREST(optsGetter generic.RESTOptionsGetter) *REST {
+func NewREST(optsGetter generic.RESTOptionsGetter, issuerURL *string) *REST {
+	strategy := workloadidentity.NewStrategy(issuerURL)
+
 	store := &genericregistry.Store{
 		NewFunc:     func() runtime.Object { return &security.WorkloadIdentity{} },
 		NewListFunc: func() runtime.Object { return &security.WorkloadIdentityList{} },
@@ -51,9 +58,9 @@ func NewREST(optsGetter generic.RESTOptionsGetter) *REST {
 		SingularQualifiedResource: security.Resource("workloadidentity"),
 		EnableGarbageCollection:   true,
 
-		CreateStrategy: workloadidentity.Strategy,
-		UpdateStrategy: workloadidentity.Strategy,
-		DeleteStrategy: workloadidentity.Strategy,
+		CreateStrategy: strategy,
+		UpdateStrategy: strategy,
+		DeleteStrategy: strategy,
 
 		TableConvertor: newTableConvertor(),
 	}