Enable conversion webhook plumbing for openstack-operator CRDs

Add conversion webhook and cert-manager CA-injection kustomize patches
for all openstack-operator CRDs (OpenStackControlPlane, Dataplane*,
OpenStackVersion, OpenStackClient, OpenStackBackupConfig,
OpenStackAssistant).

The infrastructure stays dormant while each CRD has a single served
version; it activates automatically once a second version is added.

config/crd/patches/:
- webhook_in_<crd>.yaml: sets spec.conversion.strategy: Webhook on
  each CRD, pointing clientConfig at openstack-operator-webhook-service.
  Namespace is {{ .OperatorNamespace }}, resolved at deploy time.
- cainjection_in_<crd>.yaml: stamps cert-manager.io/inject-ca-from
  with the openstack-operator serving cert so caBundle is populated.

config/crd/kustomization.yaml: enable all webhook + CA-injection patches
and kustomizeconfig.yaml (needed for the CA-injection substitution to
work correctly across kustomize bases).

bindata/crds/crds.yaml: rebuilt from config/crd with the new patches.

openstack_controller.go applyCRDs: pass OperatorNamespace in the render
data so the {{ .OperatorNamespace }} template variable in crds.yaml is
resolved to the actual operator namespace at runtime.

Jira: OSPRH-30210

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Signed-off-by: Martin Schuppert <mschuppert@redhat.com>

Add GitHub workflow to check CRD webhook coverage

Validates that any new CRD in config/crd/bases/ has matching webhook
and CA-injection patches referenced in kustomization.yaml.

Runs on PRs that touch CRD files or patches.

Author: stuggi

.github/workflows/check-crd-webhook-coverage.yaml

@@ -0,0 +1,74 @@
+name: Check CRD Webhook Coverage
+
+on:
+  pull_request:
+    paths:
+      - 'config/crd/bases/**'
+      - 'config/crd/patches/**'
+      - 'config/crd/kustomization.yaml'
+
+jobs:
+  check-webhook-patches:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check all CRDs have conversion webhook patches
+        run: |
+          set -e
+
+          echo "Checking that all openstack-operator CRDs have webhook + CA-injection patches..."
+
+          MISSING_PATCHES=0
+
+          # Check each CRD in config/crd/bases/
+          for crd_file in config/crd/bases/*.yaml; do
+            # Skip if not a file or if it's the commented-out openstacks.yaml
+            [[ ! -f "$crd_file" ]] && continue
+            basename=$(basename "$crd_file")
+            [[ "$basename" == "operator.openstack.org_openstacks.yaml" ]] && continue
+
+            # Extract CRD name (e.g., "core.openstack.org_openstackcontrolplanes")
+            crd_name="${basename%.yaml}"
+
+            # Check for webhook patch
+            webhook_patch="config/crd/patches/webhook_in_${crd_name}.yaml"
+            if [[ ! -f "$webhook_patch" ]]; then
+              echo "ERROR: Missing webhook patch for $basename"
+              echo "       Expected: $webhook_patch"
+              MISSING_PATCHES=1
+            fi
+
+            # Check for CA injection patch
+            cainjection_patch="config/crd/patches/cainjection_in_${crd_name}.yaml"
+            if [[ ! -f "$cainjection_patch" ]]; then
+              echo "ERROR: Missing CA injection patch for $basename"
+              echo "       Expected: $cainjection_patch"
+              MISSING_PATCHES=1
+            fi
+
+            # Check that patches are referenced in kustomization.yaml
+            if ! grep -q "path: patches/webhook_in_${crd_name}.yaml" config/crd/kustomization.yaml; then
+              echo "ERROR: Webhook patch for $basename not referenced in kustomization.yaml"
+              MISSING_PATCHES=1
+            fi
+
+            if ! grep -q "path: patches/cainjection_in_${crd_name}.yaml" config/crd/kustomization.yaml; then
+              echo "ERROR: CA injection patch for $basename not referenced in kustomization.yaml"
+              MISSING_PATCHES=1
+            fi
+          done
+
+          if [[ $MISSING_PATCHES -eq 1 ]]; then
+            echo ""
+            echo "One or more CRDs are missing conversion webhook patches."
+            echo "For each CRD in config/crd/bases/, you must create:"
+            echo "  1. config/crd/patches/webhook_in_<crd>.yaml"
+            echo "  2. config/crd/patches/cainjection_in_<crd>.yaml"
+            echo "  3. Reference both in config/crd/kustomization.yaml"
+            echo ""
+            echo "See existing patches for examples."
+            exit 1
+          fi
+
+          echo "✓ All CRDs have conversion webhook patches"

bindata/crds/crds.yaml

@@ -2,9 +2,20 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'
     controller-gen.kubebuilder.io/version: v0.18.0
   name: openstackassistants.assistant.openstack.org
 spec:
+  conversion:
+    strategy: Webhook
+    webhook:
+      clientConfig:
+        service:
+          name: openstack-operator-webhook-service
+          namespace: '{{ .OperatorNamespace }}'
+          path: /convert
+      conversionReviewVersions:
+      - v1
   group: assistant.openstack.org
   names:
     kind: OpenStackAssistant
@@ -471,13 +482,24 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'
     controller-gen.kubebuilder.io/version: v0.18.0
   labels:
     backup.openstack.org/category: controlplane
     backup.openstack.org/restore: "true"
     backup.openstack.org/restore-order: "20"
   name: openstackbackupconfigs.backup.openstack.org
 spec:
+  conversion:
+    strategy: Webhook
+    webhook:
+      clientConfig:
+        service:
+          name: openstack-operator-webhook-service
+          namespace: '{{ .OperatorNamespace }}'
+          path: /convert
+      conversionReviewVersions:
+      - v1
   group: backup.openstack.org
   names:
     kind: OpenStackBackupConfig
@@ -740,9 +762,20 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'
     controller-gen.kubebuilder.io/version: v0.18.0
   name: openstackclients.client.openstack.org
 spec:
+  conversion:
+    strategy: Webhook
+    webhook:
+      clientConfig:
+        service:
+          name: openstack-operator-webhook-service
+          namespace: '{{ .OperatorNamespace }}'
+          path: /convert
+      conversionReviewVersions:
+      - v1
   group: client.openstack.org
   names:
     kind: OpenStackClient
@@ -1032,13 +1065,24 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'
     controller-gen.kubebuilder.io/version: v0.18.0
   labels:
     backup.openstack.org/category: controlplane
     backup.openstack.org/restore: "true"
     backup.openstack.org/restore-order: "30"
   name: openstackcontrolplanes.core.openstack.org
 spec:
+  conversion:
+    strategy: Webhook
+    webhook:
+      clientConfig:
+        service:
+          name: openstack-operator-webhook-service
+          namespace: '{{ .OperatorNamespace }}'
+          path: /convert
+      conversionReviewVersions:
+      - v1
   group: core.openstack.org
   names:
     kind: OpenStackControlPlane
@@ -20630,9 +20674,20 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'
     controller-gen.kubebuilder.io/version: v0.18.0
   name: openstackdataplanedeployments.dataplane.openstack.org
 spec:
+  conversion:
+    strategy: Webhook
+    webhook:
+      clientConfig:
+        service:
+          name: openstack-operator-webhook-service
+          namespace: '{{ .OperatorNamespace }}'
+          path: /convert
+      conversionReviewVersions:
+      - v1
   group: dataplane.openstack.org
   names:
     kind: OpenStackDataPlaneDeployment
@@ -20938,13 +20993,24 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'
     controller-gen.kubebuilder.io/version: v0.18.0
   labels:
     backup.openstack.org/category: dataplane
     backup.openstack.org/restore: "true"
     backup.openstack.org/restore-order: "60"
   name: openstackdataplanenodesets.dataplane.openstack.org
 spec:
+  conversion:
+    strategy: Webhook
+    webhook:
+      clientConfig:
+        service:
+          name: openstack-operator-webhook-service
+          namespace: '{{ .OperatorNamespace }}'
+          path: /convert
+      conversionReviewVersions:
+      - v1
   group: dataplane.openstack.org
   names:
     kind: OpenStackDataPlaneNodeSet
@@ -22585,13 +22651,24 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'
     controller-gen.kubebuilder.io/version: v0.18.0
   labels:
     backup.openstack.org/category: dataplane
     backup.openstack.org/restore: "true"
     backup.openstack.org/restore-order: "40"
   name: openstackdataplaneservices.dataplane.openstack.org
 spec:
+  conversion:
+    strategy: Webhook
+    webhook:
+      clientConfig:
+        service:
+          name: openstack-operator-webhook-service
+          namespace: '{{ .OperatorNamespace }}'
+          path: /convert
+      conversionReviewVersions:
+      - v1
   group: dataplane.openstack.org
   names:
     kind: OpenStackDataPlaneService
@@ -22897,13 +22974,24 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'
     controller-gen.kubebuilder.io/version: v0.18.0
   labels:
     backup.openstack.org/category: controlplane
     backup.openstack.org/restore: "true"
     backup.openstack.org/restore-order: "20"
   name: openstackversions.core.openstack.org
 spec:
+  conversion:
+    strategy: Webhook
+    webhook:
+      clientConfig:
+        service:
+          name: openstack-operator-webhook-service
+          namespace: '{{ .OperatorNamespace }}'
+          path: /convert
+      conversionReviewVersions:
+      - v1
   group: core.openstack.org
   names:
     kind: OpenStackVersion

config/crd/kustomization.yaml

@@ -14,11 +14,27 @@ resources:
 # +kubebuilder:scaffold:crdkustomizeresource
 
 patches:
-# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
-# patches here are for enabling the conversion webhook for each CRD
+# [WEBHOOK] patches for enabling the conversion webhook for each CRD
+- path: patches/webhook_in_core.openstack.org_openstackcontrolplanes.yaml
+- path: patches/webhook_in_dataplane.openstack.org_openstackdataplanenodesets.yaml
+- path: patches/webhook_in_dataplane.openstack.org_openstackdataplaneservices.yaml
+- path: patches/webhook_in_dataplane.openstack.org_openstackdataplanedeployments.yaml
+- path: patches/webhook_in_core.openstack.org_openstackversions.yaml
+- path: patches/webhook_in_client.openstack.org_openstackclients.yaml
+- path: patches/webhook_in_backup.openstack.org_openstackbackupconfigs.yaml
+- path: patches/webhook_in_assistant.openstack.org_openstackassistants.yaml
 # +kubebuilder:scaffold:crdkustomizewebhookpatch
 
-# [WEBHOOK] To enable webhook, uncomment the following section
-# the following config is for teaching kustomize how to do kustomization for CRDs.
-#configurations:
-#- kustomizeconfig.yaml
+# [CERTMANAGER] patches for enabling the CA injection for each CRD
+- path: patches/cainjection_in_core.openstack.org_openstackcontrolplanes.yaml
+- path: patches/cainjection_in_dataplane.openstack.org_openstackdataplanenodesets.yaml
+- path: patches/cainjection_in_dataplane.openstack.org_openstackdataplaneservices.yaml
+- path: patches/cainjection_in_dataplane.openstack.org_openstackdataplanedeployments.yaml
+- path: patches/cainjection_in_core.openstack.org_openstackversions.yaml
+- path: patches/cainjection_in_client.openstack.org_openstackclients.yaml
+- path: patches/cainjection_in_backup.openstack.org_openstackbackupconfigs.yaml
+- path: patches/cainjection_in_assistant.openstack.org_openstackassistants.yaml
+# +kubebuilder:scaffold:crdkustomizecainjectionpatch
+
+configurations:
+- kustomizeconfig.yaml

config/crd/patches/cainjection_in_assistant.openstack.org_openstackassistants.yaml

@@ -0,0 +1,8 @@
+# Adds the cert-manager CA-injection annotation to the openstackassistants.assistant.openstack.org CRD so
+# the conversion webhook's clientConfig.caBundle is populated at deploy time.
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: openstackassistants.assistant.openstack.org
+  annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'

config/crd/patches/cainjection_in_backup.openstack.org_openstackbackupconfigs.yaml

@@ -0,0 +1,8 @@
+# Adds the cert-manager CA-injection annotation to the openstackbackupconfigs.backup.openstack.org CRD so
+# the conversion webhook's clientConfig.caBundle is populated at deploy time.
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: openstackbackupconfigs.backup.openstack.org
+  annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'

config/crd/patches/cainjection_in_client.openstack.org_openstackclients.yaml

@@ -0,0 +1,8 @@
+# Adds the cert-manager CA-injection annotation to the openstackclients.client.openstack.org CRD so
+# the conversion webhook's clientConfig.caBundle is populated at deploy time.
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: openstackclients.client.openstack.org
+  annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'

config/crd/patches/cainjection_in_core.openstack.org_openstackcontrolplanes.yaml

@@ -0,0 +1,8 @@
+# Adds the cert-manager CA-injection annotation to the openstackcontrolplanes.core.openstack.org CRD so
+# the conversion webhook's clientConfig.caBundle is populated at deploy time.
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: openstackcontrolplanes.core.openstack.org
+  annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'

config/crd/patches/cainjection_in_core.openstack.org_openstackversions.yaml

@@ -0,0 +1,8 @@
+# Adds the cert-manager CA-injection annotation to the openstackversions.core.openstack.org CRD so
+# the conversion webhook's clientConfig.caBundle is populated at deploy time.
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: openstackversions.core.openstack.org
+  annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'

config/crd/patches/cainjection_in_dataplane.openstack.org_openstackdataplanedeployments.yaml

@@ -0,0 +1,8 @@
+# Adds the cert-manager CA-injection annotation to the openstackdataplanedeployments.dataplane.openstack.org CRD so
+# the conversion webhook's clientConfig.caBundle is populated at deploy time.
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: openstackdataplanedeployments.dataplane.openstack.org
+  annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'

config/crd/patches/cainjection_in_dataplane.openstack.org_openstackdataplanenodesets.yaml

@@ -0,0 +1,8 @@
+# Adds the cert-manager CA-injection annotation to the openstackdataplanenodesets.dataplane.openstack.org CRD so
+# the conversion webhook's clientConfig.caBundle is populated at deploy time.
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: openstackdataplanenodesets.dataplane.openstack.org
+  annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'