Add conversion webhook infrastructure for openstack-operator CRDs

.github/workflows/check-crd-webhook-coverage.yaml

@@ -0,0 +1,78 @@
+name: Check CRD Webhook Coverage
+
+on:
+  pull_request:
+    paths:
+      - 'config/crd/bases/**'
+      - 'config/crd/patches/**'
+      - 'config/crd/kustomization.yaml'
+
+jobs:
+  check-webhook-patches:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Check all CRDs have conversion webhook patches
+        run: |
+          set -e
+
+          echo "Checking that all openstack-operator CRDs have webhook + CA-injection patches..."
+
+          MISSING_PATCHES=0
+
+          # Check each CRD in config/crd/bases/
+          for crd_file in config/crd/bases/*.yaml; do
+            # Skip if not a file or if it's the commented-out openstacks.yaml
+            [[ ! -f "$crd_file" ]] && continue
+            basename=$(basename "$crd_file")
+            [[ "$basename" == "operator.openstack.org_openstacks.yaml" ]] && continue
+
+            # Extract CRD name (e.g., "core.openstack.org_openstackcontrolplanes")
+            crd_name="${basename%.yaml}"
+
+            # Check for webhook patch
+            webhook_patch="config/crd/patches/webhook_in_${crd_name}.yaml"
+            if [[ ! -f "$webhook_patch" ]]; then
+              echo "ERROR: Missing webhook patch for $basename"
+              echo "       Expected: $webhook_patch"
+              MISSING_PATCHES=1
+            fi
+
+            # Check for CA injection patch
+            cainjection_patch="config/crd/patches/cainjection_in_${crd_name}.yaml"
+            if [[ ! -f "$cainjection_patch" ]]; then
+              echo "ERROR: Missing CA injection patch for $basename"
+              echo "       Expected: $cainjection_patch"
+              MISSING_PATCHES=1
+            fi
+
+            # Check that patches are referenced in kustomization.yaml (and not commented out)
+            if ! grep -q "^- path: patches/webhook_in_${crd_name}.yaml" config/crd/kustomization.yaml; then
+              echo "ERROR: Webhook patch for $basename not referenced (or commented out) in kustomization.yaml"
+              MISSING_PATCHES=1
+            fi
+
+            if ! grep -q "^- path: patches/cainjection_in_${crd_name}.yaml" config/crd/kustomization.yaml; then
+              echo "ERROR: CA injection patch for $basename not referenced (or commented out) in kustomization.yaml"
+              MISSING_PATCHES=1
+            fi
+          done
+
+          if [[ $MISSING_PATCHES -eq 1 ]]; then
+            echo ""
+            echo "One or more CRDs are missing conversion webhook patches."
+            echo "For each CRD in config/crd/bases/, you must create:"
+            echo "  1. config/crd/patches/webhook_in_<crd>.yaml"
+            echo "  2. config/crd/patches/cainjection_in_<crd>.yaml"
+            echo "  3. Reference both in config/crd/kustomization.yaml"
+            echo ""
+            echo "See existing patches for examples."
+            exit 1
+          fi
+
+          echo "✓ All CRDs have conversion webhook patches"

bindata/crds/crds.yaml

@@ -2,9 +2,20 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'
     controller-gen.kubebuilder.io/version: v0.18.0
   name: openstackassistants.assistant.openstack.org
 spec:
+  conversion:
+    strategy: Webhook
+    webhook:
+      clientConfig:
+        service:
+          name: openstack-operator-webhook-service
+          namespace: '{{ .OperatorNamespace }}'
+          path: /convert
+      conversionReviewVersions:
+      - v1
   group: assistant.openstack.org
   names:
     kind: OpenStackAssistant
@@ -471,13 +482,24 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'
     controller-gen.kubebuilder.io/version: v0.18.0
   labels:
     backup.openstack.org/category: controlplane
     backup.openstack.org/restore: "true"
     backup.openstack.org/restore-order: "20"
   name: openstackbackupconfigs.backup.openstack.org
 spec:
+  conversion:
+    strategy: Webhook
+    webhook:
+      clientConfig:
+        service:
+          name: openstack-operator-webhook-service
+          namespace: '{{ .OperatorNamespace }}'
+          path: /convert
+      conversionReviewVersions:
+      - v1
   group: backup.openstack.org
   names:
     kind: OpenStackBackupConfig
@@ -740,9 +762,20 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'
     controller-gen.kubebuilder.io/version: v0.18.0
   name: openstackclients.client.openstack.org
 spec:
+  conversion:
+    strategy: Webhook
+    webhook:
+      clientConfig:
+        service:
+          name: openstack-operator-webhook-service
+          namespace: '{{ .OperatorNamespace }}'
+          path: /convert
+      conversionReviewVersions:
+      - v1
   group: client.openstack.org
   names:
     kind: OpenStackClient
@@ -1032,13 +1065,24 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'
     controller-gen.kubebuilder.io/version: v0.18.0
   labels:
     backup.openstack.org/category: controlplane
     backup.openstack.org/restore: "true"
     backup.openstack.org/restore-order: "30"
   name: openstackcontrolplanes.core.openstack.org
 spec:
+  conversion:
+    strategy: Webhook
+    webhook:
+      clientConfig:
+        service:
+          name: openstack-operator-webhook-service
+          namespace: '{{ .OperatorNamespace }}'
+          path: /convert
+      conversionReviewVersions:
+      - v1
   group: core.openstack.org
   names:
     kind: OpenStackControlPlane
@@ -20630,9 +20674,20 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'
     controller-gen.kubebuilder.io/version: v0.18.0
   name: openstackdataplanedeployments.dataplane.openstack.org
 spec:
+  conversion:
+    strategy: Webhook
+    webhook:
+      clientConfig:
+        service:
+          name: openstack-operator-webhook-service
+          namespace: '{{ .OperatorNamespace }}'
+          path: /convert
+      conversionReviewVersions:
+      - v1
   group: dataplane.openstack.org
   names:
     kind: OpenStackDataPlaneDeployment
@@ -20938,13 +20993,24 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'
     controller-gen.kubebuilder.io/version: v0.18.0
   labels:
     backup.openstack.org/category: dataplane
     backup.openstack.org/restore: "true"
     backup.openstack.org/restore-order: "60"
   name: openstackdataplanenodesets.dataplane.openstack.org
 spec:
+  conversion:
+    strategy: Webhook
+    webhook:
+      clientConfig:
+        service:
+          name: openstack-operator-webhook-service
+          namespace: '{{ .OperatorNamespace }}'
+          path: /convert
+      conversionReviewVersions:
+      - v1
   group: dataplane.openstack.org
   names:
     kind: OpenStackDataPlaneNodeSet
@@ -22585,13 +22651,24 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'
     controller-gen.kubebuilder.io/version: v0.18.0
   labels:
     backup.openstack.org/category: dataplane
     backup.openstack.org/restore: "true"
     backup.openstack.org/restore-order: "40"
   name: openstackdataplaneservices.dataplane.openstack.org
 spec:
+  conversion:
+    strategy: Webhook
+    webhook:
+      clientConfig:
+        service:
+          name: openstack-operator-webhook-service
+          namespace: '{{ .OperatorNamespace }}'
+          path: /convert
+      conversionReviewVersions:
+      - v1
   group: dataplane.openstack.org
   names:
     kind: OpenStackDataPlaneService
@@ -22897,13 +22974,24 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'
     controller-gen.kubebuilder.io/version: v0.18.0
   labels:
     backup.openstack.org/category: controlplane
     backup.openstack.org/restore: "true"
     backup.openstack.org/restore-order: "20"
   name: openstackversions.core.openstack.org
 spec:
+  conversion:
+    strategy: Webhook
+    webhook:
+      clientConfig:
+        service:
+          name: openstack-operator-webhook-service
+          namespace: '{{ .OperatorNamespace }}'
+          path: /convert
+      conversionReviewVersions:
+      - v1
   group: core.openstack.org
   names:
     kind: OpenStackVersion

config/crd/kustomization.yaml

@@ -14,11 +14,27 @@ resources:
 # +kubebuilder:scaffold:crdkustomizeresource
 
 patches:
-# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
-# patches here are for enabling the conversion webhook for each CRD
+# [WEBHOOK] patches for enabling the conversion webhook for each CRD
+- path: patches/webhook_in_core.openstack.org_openstackcontrolplanes.yaml
+- path: patches/webhook_in_dataplane.openstack.org_openstackdataplanenodesets.yaml
+- path: patches/webhook_in_dataplane.openstack.org_openstackdataplaneservices.yaml
+- path: patches/webhook_in_dataplane.openstack.org_openstackdataplanedeployments.yaml
+- path: patches/webhook_in_core.openstack.org_openstackversions.yaml
+- path: patches/webhook_in_client.openstack.org_openstackclients.yaml
+- path: patches/webhook_in_backup.openstack.org_openstackbackupconfigs.yaml
+- path: patches/webhook_in_assistant.openstack.org_openstackassistants.yaml
 # +kubebuilder:scaffold:crdkustomizewebhookpatch
 
-# [WEBHOOK] To enable webhook, uncomment the following section
-# the following config is for teaching kustomize how to do kustomization for CRDs.
-#configurations:
-#- kustomizeconfig.yaml
+# [CERTMANAGER] patches for enabling the CA injection for each CRD
+- path: patches/cainjection_in_core.openstack.org_openstackcontrolplanes.yaml
+- path: patches/cainjection_in_dataplane.openstack.org_openstackdataplanenodesets.yaml
+- path: patches/cainjection_in_dataplane.openstack.org_openstackdataplaneservices.yaml
+- path: patches/cainjection_in_dataplane.openstack.org_openstackdataplanedeployments.yaml
+- path: patches/cainjection_in_core.openstack.org_openstackversions.yaml
+- path: patches/cainjection_in_client.openstack.org_openstackclients.yaml
+- path: patches/cainjection_in_backup.openstack.org_openstackbackupconfigs.yaml
+- path: patches/cainjection_in_assistant.openstack.org_openstackassistants.yaml
+# +kubebuilder:scaffold:crdkustomizecainjectionpatch
+
+configurations:
+- kustomizeconfig.yaml

config/crd/patches/cainjection_in_assistant.openstack.org_openstackassistants.yaml

@@ -0,0 +1,8 @@
+# Adds the cert-manager CA-injection annotation to the openstackassistants.assistant.openstack.org CRD so
+# the conversion webhook's clientConfig.caBundle is populated at deploy time.
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: openstackassistants.assistant.openstack.org
+  annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'

config/crd/patches/cainjection_in_backup.openstack.org_openstackbackupconfigs.yaml

@@ -0,0 +1,8 @@
+# Adds the cert-manager CA-injection annotation to the openstackbackupconfigs.backup.openstack.org CRD so
+# the conversion webhook's clientConfig.caBundle is populated at deploy time.
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: openstackbackupconfigs.backup.openstack.org
+  annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'

config/crd/patches/cainjection_in_client.openstack.org_openstackclients.yaml

@@ -0,0 +1,8 @@
+# Adds the cert-manager CA-injection annotation to the openstackclients.client.openstack.org CRD so
+# the conversion webhook's clientConfig.caBundle is populated at deploy time.
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: openstackclients.client.openstack.org
+  annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'

config/crd/patches/cainjection_in_core.openstack.org_openstackcontrolplanes.yaml

@@ -0,0 +1,8 @@
+# Adds the cert-manager CA-injection annotation to the openstackcontrolplanes.core.openstack.org CRD so
+# the conversion webhook's clientConfig.caBundle is populated at deploy time.
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: openstackcontrolplanes.core.openstack.org
+  annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'

config/crd/patches/cainjection_in_core.openstack.org_openstackversions.yaml

@@ -0,0 +1,8 @@
+# Adds the cert-manager CA-injection annotation to the openstackversions.core.openstack.org CRD so
+# the conversion webhook's clientConfig.caBundle is populated at deploy time.
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: openstackversions.core.openstack.org
+  annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'

config/crd/patches/cainjection_in_dataplane.openstack.org_openstackdataplanedeployments.yaml

@@ -0,0 +1,8 @@
+# Adds the cert-manager CA-injection annotation to the openstackdataplanedeployments.dataplane.openstack.org CRD so
+# the conversion webhook's clientConfig.caBundle is populated at deploy time.
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: openstackdataplanedeployments.dataplane.openstack.org
+  annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'

config/crd/patches/cainjection_in_dataplane.openstack.org_openstackdataplanenodesets.yaml

@@ -0,0 +1,8 @@
+# Adds the cert-manager CA-injection annotation to the openstackdataplanenodesets.dataplane.openstack.org CRD so
+# the conversion webhook's clientConfig.caBundle is populated at deploy time.
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: openstackdataplanenodesets.dataplane.openstack.org
+  annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'

config/crd/patches/cainjection_in_dataplane.openstack.org_openstackdataplaneservices.yaml

@@ -0,0 +1,8 @@
+# Adds the cert-manager CA-injection annotation to the openstackdataplaneservices.dataplane.openstack.org CRD so
+# the conversion webhook's clientConfig.caBundle is populated at deploy time.
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: openstackdataplaneservices.dataplane.openstack.org
+  annotations:
+    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/openstack-operator-serving-cert'

config/crd/patches/webhook_in_assistant.openstack.org_openstackassistants.yaml

@@ -0,0 +1,18 @@
+# Enables the conversion webhook for the openstackassistants.assistant.openstack.org CRD.
+# Stays dormant while the CRD has a single served version; activates automatically
+# once a second version is added. Namespace is resolved at deploy time.
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: openstackassistants.assistant.openstack.org
+spec:
+  conversion:
+    strategy: Webhook
+    webhook:
+      clientConfig:
+        service:
+          namespace: '{{ .OperatorNamespace }}'
+          name: openstack-operator-webhook-service
+          path: /convert
+      conversionReviewVersions:
+      - v1