refactor: Drop config/ folder, save templates to charts, and move to examples/

[viccuad]

Description

Fix #1704
Recommend review per commit.

• Consume always CRD templates from Helm chart templates.
• Generate webhook manifest directly into
  charts/kubewarden-controller/templates/webhooks.yaml instead of
  config/webhook/manifest.yml, overwriting it. Given that we overwrite the Helm templated file, added a helm unittest to ensure that we never merge a broken webhooks.yaml manifest.
• Remove uneeded files.
• Move config/samples/ to examples/ and add 2 more.

Test

Tested locally with CI. Add a Helm unittest.

Additional Information

Tradeoff

Potential improvement

Checklist

• I have read and understood the Kubewarden AI Policy

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Refactors the project layout to drop most of the legacy config/ kustomize scaffolding, and makes Helm charts the single source of truth for generated CRDs/webhook manifests while adding example policy group manifests.

Changes:

• Point controller envtest to CRDs emitted into the kubewarden-crds Helm chart.
• Generate CRDs/webhooks into Helm chart template locations and add Helm-unittest coverage for webhooks.yaml.
• Remove kustomize-based manifests under config/ and add new examples/ manifests.

Reviewed changes

Copilot reviewed 52 out of 64 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
internal/controller/suite_test.go	Load envtest CRDs from the Helm chart generated CRD templates path.
examples/policies_v1_clusteradmissionpolicygroup.yaml	Add ClusterAdmissionPolicyGroup example manifest.
examples/policies_v1_admissionpolicygroup.yaml	Add AdmissionPolicyGroup example manifest.
config/webhook/service.yaml	Remove kustomize webhook Service manifest.
config/webhook/manifests.yaml	Remove kustomize webhook configuration manifests.
config/webhook/kustomizeconfig.yaml	Remove kustomize name/namespace reference config for webhooks.
config/webhook/kustomization.yaml	Remove webhook kustomization entrypoint.
config/samples/policies_v1_admissionpolicy.yaml	Change sample policy namespace to default.
config/rbac/service_account.yaml	Remove kustomize RBAC scaffold (service account).
config/rbac/role_binding.yaml	Remove kustomize RBAC scaffold (cluster role binding).
config/rbac/role.yaml	Remove kustomize RBAC scaffold (roles).
config/rbac/policyserver_viewer_role.yaml	Remove kustomize RBAC scaffold (viewer role).
config/rbac/policyserver_editor_role.yaml	Remove kustomize RBAC scaffold (editor role).
config/rbac/leader_election_role_binding.yaml	Remove leader-election role binding scaffold.
config/rbac/leader_election_role.yaml	Remove leader-election role scaffold.
config/rbac/kustomization.yaml	Remove RBAC kustomization entrypoint.
config/rbac/clusteradmissionpolicy_viewer_role.yaml	Remove cluster admission policy viewer role scaffold.
config/rbac/clusteradmissionpolicy_editor_role.yaml	Remove cluster admission policy editor role scaffold.
config/rbac/auth_proxy_service.yaml	Remove kube-rbac-proxy service scaffold.
config/rbac/auth_proxy_role_binding.yaml	Remove kube-rbac-proxy role binding scaffold.
config/rbac/auth_proxy_role.yaml	Remove kube-rbac-proxy role scaffold.
config/rbac/auth_proxy_client_clusterrole.yaml	Remove metrics-reader cluster role scaffold.
config/rbac/admissionpolicy_viewer_role.yaml	Remove admission policy viewer role scaffold.
config/rbac/admissionpolicy_editor_role.yaml	Remove admission policy editor role scaffold.
config/prometheus/monitor.yaml	Remove ServiceMonitor scaffold.
config/prometheus/kustomization.yaml	Remove prometheus kustomization entrypoint.
config/manager/manager.yaml	Remove manager deployment scaffold.
config/manager/kustomization.yaml	Remove manager kustomization entrypoint.
config/manager/controller_manager_config.yaml	Remove controller-runtime component config scaffold.
config/default/webhookcainjection_patch.yaml	Remove webhook CA injection patch scaffold.
config/default/manager_webhook_patch.yaml	Remove manager webhook patch scaffold.
config/default/manager_config_patch.yaml	Remove manager config patch scaffold.
config/default/manager_auth_proxy_patch.yaml	Remove auth-proxy sidecar patch scaffold.
config/default/kustomization.yaml	Remove default aggregate kustomization scaffold.
config/crd/patches/webhook_in_policyservers.yaml	Remove CRD conversion webhook patch scaffold.
config/crd/patches/webhook_in_clusteradmissionpolicies.yaml	Remove CRD conversion webhook patch scaffold.
config/crd/patches/webhook_in_admissionpolicies.yaml	Remove CRD conversion webhook patch scaffold.
config/crd/patches/cainjection_in_policyservers.yaml	Remove CRD CA injection patch scaffold.
config/crd/patches/cainjection_in_clusteradmissionpolicies.yaml	Remove CRD CA injection patch scaffold.
config/crd/patches/cainjection_in_admissionpolicies.yaml	Remove CRD CA injection patch scaffold.
config/crd/kustomizeconfig.yaml	Remove CRD kustomize substitution config.
config/crd/kustomization.yaml	Remove CRD kustomization entrypoint.
config/crd/bases/policies.kubewarden.io_policyservers.yaml	Remove generated CRD YAML from config/ (moved to charts as source of truth).
config/crd/bases/policies.kubewarden.io_clusteradmissionpolicygroups.yaml	Remove generated CRD YAML from config/ (moved to charts as source of truth).
config/crd/bases/policies.kubewarden.io_clusteradmissionpolicies.yaml	Remove generated CRD YAML from config/ (moved to charts as source of truth).
config/crd/bases/policies.kubewarden.io_admissionpolicygroups.yaml	Remove generated CRD YAML from config/ (moved to charts as source of truth).
config/crd/bases/policies.kubewarden.io_admissionpolicies.yaml	Remove generated CRD YAML from config/ (moved to charts as source of truth).
config/certmanager/kustomizeconfig.yaml	Remove cert-manager kustomize substitution config.
config/certmanager/kustomization.yaml	Remove cert-manager kustomization entrypoint.
config/certmanager/certificate.yaml	Remove cert-manager self-signed issuer/cert scaffold.
charts/kubewarden-crds/tests/crds_test.yaml	Update Helm-unittest references to CRDs now under templates/crds/.
charts/kubewarden-controller/tests/webhooks_coverage_test.yaml	Add Helm-unittest suite to validate/guard webhooks.yaml rendering.
Makefile	Emit CRDs into templates/crds, emit webhook artifacts, and rename generated webhook manifest to webhooks.yaml.

Comments suppressed due to low confidence (3)

internal/controller/suite_test.go:1

• Loading envtest CRDs directly from a Helm chart templates/ path tightly couples controller tests to the chart layout and also risks parse failures if Helm templating is introduced in that directory (envtest expects plain YAML CRDs). Consider pointing envtest at a non-templated CRD output location (for example a dedicated raw CRD directory committed for tests, or a charts/.../crds-style directory containing only plain YAML) so tests remain stable even if Helm templating is later added under templates/.
  examples/policies_v1_admissionpolicygroup.yaml:1
• The example mixes module references with and without the registry:// scheme. Even if the scheme is optional at runtime, examples are typically clearer/less ambiguous when they use a consistent, explicit scheme. Consider updating verify-image-signatures to use registry://... as well (or consistently omit it everywhere if that’s the preferred convention).
  examples/policies_v1_admissionpolicygroup.yaml:1
• The example mixes module references with and without the registry:// scheme. Even if the scheme is optional at runtime, examples are typically clearer/less ambiguous when they use a consistent, explicit scheme. Consider updating verify-image-signatures to use registry://... as well (or consistently omit it everywhere if that’s the preferred convention).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.