fix(olm): declare webhookDefinitions so OLM provisions the webhook cert

[stubbi]

Problem (kiwi crash root cause)

The hermes manager registers admission webhooks and serves TLS on the webhook server, but the bundle CSV declared no spec.webhookDefinitions:

• RegisterHermesInstanceWebhook (mutating defaulter + validating)
• RegisterHermesClusterDefaultsWebhook (validating)
• RegisterHermesSelfConfigWebhook (validating)

Under OLM there is no cert-manager. OLM only provisions the webhook serving cert and creates the ValidatingWebhookConfiguration/MutatingWebhookConfiguration when the CSV declares the webhooks in spec.webhookDefinitions. Without it the manager starts, tries to load its serving cert, and crashes:

open /tmp/k8s-webhook-server/serving-certs/tls.crt: no such file or directory

This produces a CrashLoopBackOff, and the OperatorHub "Full operator test" (kiwi) install fails. This is the real blocker keeping hermes off OperatorHub. (paperclip has no webhook; openclaw does not register/serve one, so only hermes hits this.)

Fix

Added a spec.webhookDefinitions list to the CSV with one entry per registered webhook, derived from config/webhook/manifests.yaml and the api/v1 +kubebuilder:webhook markers:

type	generateName	webhookPath	resource
MutatingAdmissionWebhook	mhermesinstance.hermes.agent	/mutate-hermes-agent-v1-hermesinstance	hermesinstances
ValidatingAdmissionWebhook	vhermesinstance.hermes.agent	/validate-hermes-agent-v1-hermesinstance	hermesinstances
ValidatingAdmissionWebhook	vhermesclusterdefaults.hermes.agent	/validate-hermes-agent-v1-hermesclusterdefaults	hermesclusterdefaults
ValidatingAdmissionWebhook	vhermesselfconfig.hermes.agent	/validate-hermes-agent-v1-hermesselfconfig	hermesselfconfigs

All entries use admissionReviewVersions: [v1], containerPort: 443 / targetPort: 9443 (OLM convention to the controller-runtime default webhook port), deploymentName: hermes-operator-controller-manager, sideEffects: None, failurePolicy: Fail, and rules for CREATE/UPDATE on apiGroups: [hermes.agent], apiVersions: [v1].

Also exposed containerPort: 9443 (webhook-server) on the manager container so OLM can wire the generated webhook Service to the server.

The CSV's hand-maintained metadata (rich description, icon, keywords, links, alm-examples, specDescriptors) is preserved unchanged. The bundle make bundle target is a custom sync (it does not run operator-sdk generate bundle), so the webhookDefinitions block was hand-added per the OLM WebhookDescription schema rather than regenerated. The webhook details were taken directly from the kubebuilder-generated config/webhook/manifests.yaml; no markers or config/webhook were changed, so no make manifests/make generate regeneration was required.

Validation

• operator-sdk bundle validate ./bundle --select-optional suite=operatorframework: All validation tests have completed successfully (the 2 pre-existing cronjobs v1.25 deprecation warnings are unchanged and unrelated).
• CSV YAML parses cleanly.
• go build ./...: clean.
• ASCII-only dash scan on the changed file: clean.

Note on final validation

This cannot be fully validated via kiwi from a branch: kiwi needs a published release plus ~20min. Final validation happens via the next release's OperatorHub re-submission. This PR gets the CSV structurally correct per the OLM spec and operator-sdk bundle validate.

🤖 Generated with Claude Code