refactor: Drop config/ folder, save templates to charts, and move to examples/

Makefile

@@ -159,8 +159,10 @@ manifests: ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefin
 	$(GO_BUILD_ENV) $(CONTROLLER_GEN) rbac:roleName=kubewarden-controller-manager,fileName=controller-rbac-roles.yaml crd webhook \
 			paths="./api/policies/v1" paths="./api/policies/v1alpha2" \
 			paths="./internal/controller" paths="./cmd/controller" \
-			output:crd:artifacts:config=charts/kubewarden-crds/templates \
-			output:rbac:artifacts:config=charts/kubewarden-controller/templates
+			output:crd:artifacts:config=charts/kubewarden-crds/templates/crds \
+			output:rbac:artifacts:config=charts/kubewarden-controller/templates \
+			output:webhook:artifacts:config=charts/kubewarden-controller/templates
+	mv charts/kubewarden-controller/templates/manifests.yaml charts/kubewarden-controller/templates/webhooks.yaml
 	sed -i '/^metadata:/a\  labels:\n    {{- include "kubewarden-controller.labels" . | nindent 4 }}\n  annotations:\n    {{- include "kubewarden-controller.annotations" . | nindent 4 }}' charts/kubewarden-controller/templates/controller-rbac-roles.yaml
 	sed -i 's/  namespace: kubewarden/  namespace: {{ .Release.Namespace }}/' charts/kubewarden-controller/templates/controller-rbac-roles.yaml
 

charts/kubewarden-controller/tests/webhooks_coverage_test.yaml

@@ -0,0 +1,299 @@
+suite: webhooks Helm templating coverage
+templates:
+  - webhooks.yaml
+release:
+  namespace: "kubewarden"
+
+tests:
+  # ── Group 1: Resource names must be kubewarden-controller-prefixed, not plain controller-gen names ──
+
+  - it: "MutatingWebhookConfiguration should have the kubewarden-controller-prefixed name"
+    documentSelector:
+      path: kind
+      value: MutatingWebhookConfiguration
+    asserts:
+      - equal:
+          path: metadata.name
+          value: kubewarden-controller-mutating-webhook-configuration
+
+  - it: "ValidatingWebhookConfiguration should have the kubewarden-controller-prefixed name"
+    documentSelector:
+      path: kind
+      value: ValidatingWebhookConfiguration
+    asserts:
+      - equal:
+          path: metadata.name
+          value: kubewarden-controller-validating-webhook-configuration
+
+  # ── Group 2: Helm labels and annotations must be present on webhook configs ──
+
+  - it: "MutatingWebhookConfiguration should have Helm labels"
+    documentSelector:
+      path: kind
+      value: MutatingWebhookConfiguration
+    asserts:
+      - isNotNullOrEmpty:
+          path: metadata.labels
+      - equal:
+          path: metadata.labels["app.kubernetes.io/managed-by"]
+          value: Helm
+
+  - it: "ValidatingWebhookConfiguration should have Helm labels"
+    documentSelector:
+      path: kind
+      value: ValidatingWebhookConfiguration
+    asserts:
+      - isNotNullOrEmpty:
+          path: metadata.labels
+      - equal:
+          path: metadata.labels["app.kubernetes.io/managed-by"]
+          value: Helm
+
+  # ── Group 3: caBundle must be present on all webhooks ──
+
+  - it: "all mutating webhooks should have caBundle injected"
+    documentSelector:
+      path: kind
+      value: MutatingWebhookConfiguration
+    asserts:
+      - isNotNullOrEmpty:
+          path: webhooks[0].clientConfig.caBundle
+      - isNotNullOrEmpty:
+          path: webhooks[1].clientConfig.caBundle
+      - isNotNullOrEmpty:
+          path: webhooks[2].clientConfig.caBundle
+      - isNotNullOrEmpty:
+          path: webhooks[3].clientConfig.caBundle
+      - isNotNullOrEmpty:
+          path: webhooks[4].clientConfig.caBundle
+
+  - it: "all validating webhooks should have caBundle injected"
+    documentSelector:
+      path: kind
+      value: ValidatingWebhookConfiguration
+    asserts:
+      - isNotNullOrEmpty:
+          path: webhooks[0].clientConfig.caBundle
+      - isNotNullOrEmpty:
+          path: webhooks[1].clientConfig.caBundle
+      - isNotNullOrEmpty:
+          path: webhooks[2].clientConfig.caBundle
+      - isNotNullOrEmpty:
+          path: webhooks[3].clientConfig.caBundle
+      - isNotNullOrEmpty:
+          path: webhooks[4].clientConfig.caBundle
+
+  # ── Group 4: service.name must use the release name prefix, not plain 'webhook-service' ──
+
+  - it: "mutating webhooks should use release-prefixed service name, not plain 'webhook-service'"
+    documentSelector:
+      path: kind
+      value: MutatingWebhookConfiguration
+    asserts:
+      - matchRegex:
+          path: webhooks[0].clientConfig.service.name
+          pattern: "^.+-webhook-service$"
+      - notEqual:
+          path: webhooks[0].clientConfig.service.name
+          value: webhook-service
+
+  - it: "validating webhooks should use release-prefixed service name, not plain 'webhook-service'"
+    documentSelector:
+      path: kind
+      value: ValidatingWebhookConfiguration
+    asserts:
+      - matchRegex:
+          path: webhooks[0].clientConfig.service.name
+          pattern: "^.+-webhook-service$"
+      - notEqual:
+          path: webhooks[0].clientConfig.service.name
+          value: webhook-service
+
+  # ── Group 5: service.namespace must use the release namespace, not controller-gen's 'system' ──
+
+  - it: "mutating webhooks should use the release namespace, not 'system'"
+    documentSelector:
+      path: kind
+      value: MutatingWebhookConfiguration
+    asserts:
+      - equal:
+          path: webhooks[0].clientConfig.service.namespace
+          value: kubewarden
+      - notEqual:
+          path: webhooks[0].clientConfig.service.namespace
+          value: system
+
+  - it: "validating webhooks should use the release namespace, not 'system'"
+    documentSelector:
+      path: kind
+      value: ValidatingWebhookConfiguration
+    asserts:
+      - equal:
+          path: webhooks[0].clientConfig.service.namespace
+          value: kubewarden
+      - notEqual:
+          path: webhooks[0].clientConfig.service.namespace
+          value: system
+
+  # ── Group 6: the 3 TLS/CA Secret documents must be present ──
+
+  - it: "kubewarden-ca Secret should be present"
+    documentSelector:
+      path: metadata.name
+      value: kubewarden-ca
+    asserts:
+      - equal:
+          path: kind
+          value: Secret
+
+  - it: "kubewarden-webhook-server-cert Secret should be present"
+    documentSelector:
+      path: metadata.name
+      value: kubewarden-webhook-server-cert
+    asserts:
+      - equal:
+          path: kind
+          value: Secret
+
+  - it: "kubewarden-audit-scanner-client-cert Secret should be present"
+    documentSelector:
+      path: metadata.name
+      value: kubewarden-audit-scanner-client-cert
+    asserts:
+      - equal:
+          path: kind
+          value: Secret
+
+  # ── Group 7: webhook count must match what controller-gen produces ──
+
+  - it: "MutatingWebhookConfiguration should have exactly 5 webhooks"
+    documentSelector:
+      path: kind
+      value: MutatingWebhookConfiguration
+    asserts:
+      - lengthEqual:
+          path: webhooks
+          count: 5
+
+  - it: "ValidatingWebhookConfiguration should have exactly 5 webhooks"
+    documentSelector:
+      path: kind
+      value: ValidatingWebhookConfiguration
+    asserts:
+      - lengthEqual:
+          path: webhooks
+          count: 5
+
+  # ── Group 8: each mutating webhook must be present with correct name and service path ──
+  # Note: helm-unittest `contains` does not support deep partial matching on nested fields,
+  # so we check `name` presence separately from the service `path` per index.
+
+  - it: "MutatingWebhookConfiguration should have all expected webhook names"
+    documentSelector:
+      path: kind
+      value: MutatingWebhookConfiguration
+    asserts:
+      - contains:
+          path: webhooks
+          any: true
+          content:
+            name: madmissionpolicy.kb.io
+      - contains:
+          path: webhooks
+          any: true
+          content:
+            name: madmissionpolicygroup.kb.io
+      - contains:
+          path: webhooks
+          any: true
+          content:
+            name: mclusteradmissionpolicy.kb.io
+      - contains:
+          path: webhooks
+          any: true
+          content:
+            name: mclusteradmissionpolicygroup.kb.io
+      - contains:
+          path: webhooks
+          any: true
+          content:
+            name: mpolicyserver.kb.io
+
+  - it: "MutatingWebhookConfiguration should have correct service paths for all webhooks"
+    documentSelector:
+      path: kind
+      value: MutatingWebhookConfiguration
+    asserts:
+      # Order matches webhooks.yaml: clusteradmissionpolicy, clusteradmissionpolicygroup,
+      # policyserver, admissionpolicy, admissionpolicygroup
+      - equal:
+          path: webhooks[0].clientConfig.service.path
+          value: /mutate-policies-kubewarden-io-v1-clusteradmissionpolicy
+      - equal:
+          path: webhooks[1].clientConfig.service.path
+          value: /mutate-policies-kubewarden-io-v1-clusteradmissionpolicygroup
+      - equal:
+          path: webhooks[2].clientConfig.service.path
+          value: /mutate-policies-kubewarden-io-v1-policyserver
+      - equal:
+          path: webhooks[3].clientConfig.service.path
+          value: /mutate-policies-kubewarden-io-v1-admissionpolicy
+      - equal:
+          path: webhooks[4].clientConfig.service.path
+          value: /mutate-policies-kubewarden-io-v1-admissionpolicygroup
+
+  # ── Group 8 (cont.): each validating webhook must be present with correct name and service path ──
+
+  - it: "ValidatingWebhookConfiguration should have all expected webhook names"
+    documentSelector:
+      path: kind
+      value: ValidatingWebhookConfiguration
+    asserts:
+      - contains:
+          path: webhooks
+          any: true
+          content:
+            name: vadmissionpolicy.kb.io
+      - contains:
+          path: webhooks
+          any: true
+          content:
+            name: vadmissionpolicygroup.kb.io
+      - contains:
+          path: webhooks
+          any: true
+          content:
+            name: vclusteradmissionpolicy.kb.io
+      - contains:
+          path: webhooks
+          any: true
+          content:
+            name: vclusteradmissionpolicygroup.kb.io
+      - contains:
+          path: webhooks
+          any: true
+          content:
+            name: vpolicyserver.kb.io
+
+  - it: "ValidatingWebhookConfiguration should have correct service paths for all webhooks"
+    documentSelector:
+      path: kind
+      value: ValidatingWebhookConfiguration
+    asserts:
+      # Order matches webhooks.yaml: clusteradmissionpolicy, clusteradmissionpolicygroup,
+      # admissionpolicy, admissionpolicygroup, policyserver
+      - equal:
+          path: webhooks[0].clientConfig.service.path
+          value: /validate-policies-kubewarden-io-v1-clusteradmissionpolicy
+      - equal:
+          path: webhooks[1].clientConfig.service.path
+          value: /validate-policies-kubewarden-io-v1-clusteradmissionpolicygroup
+      - equal:
+          path: webhooks[2].clientConfig.service.path
+          value: /validate-policies-kubewarden-io-v1-admissionpolicy
+      - equal:
+          path: webhooks[3].clientConfig.service.path
+          value: /validate-policies-kubewarden-io-v1-admissionpolicygroup
+      - equal:
+          path: webhooks[4].clientConfig.service.path
+          value: /validate-policies-kubewarden-io-v1-policyserver

charts/kubewarden-crds/tests/crds_test.yaml

@@ -1,7 +1,7 @@
 suite: Kubewarden CRDs
 tests:
   - it: "admissionpolicies CRD should be a CustomResourceDefinition"
-    template: policies.kubewarden.io_admissionpolicies.yaml
+    template: crds/policies.kubewarden.io_admissionpolicies.yaml
     asserts:
       - equal:
           path: kind
@@ -14,7 +14,7 @@ tests:
           value: policies.kubewarden.io
 
   - it: "admissionpolicygroups CRD should be a CustomResourceDefinition"
-    template: policies.kubewarden.io_admissionpolicygroups.yaml
+    template: crds/policies.kubewarden.io_admissionpolicygroups.yaml
     asserts:
       - equal:
           path: kind
@@ -27,7 +27,7 @@ tests:
           value: policies.kubewarden.io
 
   - it: "clusteradmissionpolicies CRD should be a CustomResourceDefinition"
-    template: policies.kubewarden.io_clusteradmissionpolicies.yaml
+    template: crds/policies.kubewarden.io_clusteradmissionpolicies.yaml
     asserts:
       - equal:
           path: kind
@@ -40,7 +40,7 @@ tests:
           value: policies.kubewarden.io
 
   - it: "clusteradmissionpolicygroups CRD should be a CustomResourceDefinition"
-    template: policies.kubewarden.io_clusteradmissionpolicygroups.yaml
+    template: crds/policies.kubewarden.io_clusteradmissionpolicygroups.yaml
     asserts:
       - equal:
           path: kind
@@ -53,7 +53,7 @@ tests:
           value: policies.kubewarden.io
 
   - it: "policyservers CRD should be a CustomResourceDefinition"
-    template: policies.kubewarden.io_policyservers.yaml
+    template: crds/policies.kubewarden.io_policyservers.yaml
     asserts:
       - equal:
           path: kind