feat: implement WIF authentication flow and remove static token auth flow

[ondbeh]

This pull request introduces significant improvements to the authentication options and documentation for the STACKIT ExternalDNS webhook, with a focus on supporting Workload Identity Federation (WIF) and clarifying configuration. The changes enhance flexibility in authentication, improve error handling, and update the documentation to guide users through both Service Account Key and WIF authentication flows. It also removes the explicit usage of long lived auth tokens as those are no longer supported by STACKIT.

[Copilot]

Pull request overview

This PR updates the STACKIT ExternalDNS webhook authentication model to support Workload Identity Federation (WIF), removes the legacy static token auth flow, and refreshes documentation and CLI/config wiring accordingly.

Changes:

• Introduces an explicit auth configuration model (WebhookAuthConfig) with support for explicit Service Account Key auth, explicit WIF auth, and default SDK discovery.
• Updates the webhook CLI flags to remove --auth-token and add WIF-related flags; improves runtime error handling messaging.
• Refreshes README deployment/configuration guidance for Service Account Key vs WIF usage.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
README.md	Updates deployment/auth documentation for Service Account Key and WIF flows; refreshes examples and configuration section.
pkg/stackit/options.go	Reworks SDK configuration to use an auth config struct and support explicit WIF or default SDK auth discovery.
pkg/stackit/options_test.go	Updates and expands unit tests to match the new auth configuration behavior (default/explicit key/explicit WIF).
cmd/webhook/cmd/root.go	Replaces the old token/key CLI auth wiring with the new auth config (key/WIF flags) and updates error handling.

Suppressed comments (2)

cmd/webhook/cmd/root.go:80

• zap.Logger.Fatal calls os.Exit(1), which bypasses deferred functions. That means the deferred logger.Sync() above will not run, risking dropped/unsent log entries. Prefer logging the error and returning it (e.g., via RunE), or at least avoid Fatal so defers run.

			logger.Fatal("server error", zap.Error(err))

cmd/webhook/cmd/root.go:74

• zap.Logger.Fatal calls os.Exit(1), which bypasses deferred functions. That means the deferred logger.Sync() above will not run, risking dropped/unsent log entries. Prefer logging the error and returning it (e.g., via RunE), or at least avoid Fatal so defers run.

			logger.Fatal("failed to initialize STACKIT DNS provider", zap.Error(err))

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.