fix: address review findings on webhook scaffold

- Comment out manager_webhook_patch.yaml and ../webhook in
  config/default/kustomization.yaml — cert-manager not wired, enabling
  these caused missing Secret volume → controller-manager pod crash
- Comment out webhook_in_openstackcreds.yaml and kustomizeconfig in
  config/crd/kustomization.yaml — conversion webhook strategy set on CRD
  but no /convert handler exists; only a validating webhook is registered
- Add unit tests to openstackcreds_webhook_test.go covering type-assertion
  logic: correct type → (nil, nil), wrong type → non-nil error
- Regenerate deploy/ manifests with webhook resources removed

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 2 people

deploy/00crds.yaml

@@ -1959,16 +1959,6 @@ metadata:
     controller-gen.kubebuilder.io/version: v0.17.1
   name: openstackcreds.vjailbreak.k8s.pf9.io
 spec:
-  conversion:
-    strategy: Webhook
-    webhook:
-      clientConfig:
-        service:
-          name: migration-webhook-service
-          namespace: migration-system
-          path: /convert
-      conversionReviewVersions:
-      - v1
   group: vjailbreak.k8s.pf9.io
   names:
     kind: OpenstackCreds
@@ -5187,22 +5177,6 @@ spec:
     app: vpwned-sdk
   type: ClusterIP
 ---
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app.kubernetes.io/managed-by: kustomize
-    app.kubernetes.io/name: migration
-  name: migration-webhook-service
-  namespace: migration-system
-spec:
-  ports:
-  - port: 443
-    protocol: TCP
-    targetPort: 9443
-  selector:
-    control-plane: controller-manager
----
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -5230,32 +5204,6 @@ spec:
               number: 80
         path: /dev-api/sdk/(.*)
         pathType: ImplementationSpecific
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: migration-validating-webhook-configuration
-webhooks:
-- admissionReviewVersions:
-  - v1
-  clientConfig:
-    service:
-      name: migration-webhook-service
-      namespace: migration-system
-      path: /validate-vjailbreak-k8s-pf9-io-v1alpha1-openstackcreds
-  failurePolicy: Fail
-  name: vopenstackcreds.kb.io
-  rules:
-  - apiGroups:
-    - vjailbreak.k8s.pf9.io
-    apiVersions:
-    - v1alpha1
-    operations:
-    - CREATE
-    - UPDATE
-    resources:
-    - openstackcreds
-  sideEffects: None
 
 ---
 apiVersion: v1

deploy/05controller-deployment.yaml

@@ -42,7 +42,7 @@ spec:
         - configMapRef:
             name: pf9-env
             optional: true
-        image: quay.io/platform9/vjailbreak-controller:main
+        image: quay.io/platform9/vjailbreak-controller:0.1.13
         imagePullPolicy: IfNotPresent
         lifecycle:
           preStop:
@@ -58,10 +58,6 @@ spec:
           initialDelaySeconds: 15
           periodSeconds: 20
         name: manager
-        ports:
-        - containerPort: 9443
-          name: webhook-server
-          protocol: TCP
         readinessProbe:
           httpGet:
             path: /readyz
@@ -73,9 +69,6 @@ spec:
             cpu: 200m
             memory: 256Mi
         volumeMounts:
-        - mountPath: /tmp/k8s-webhook-server/serving-certs
-          name: cert
-          readOnly: true
         - mountPath: /etc/pf9/k3s
           name: master-token
         - mountPath: /home/ubuntu
@@ -98,10 +91,6 @@ spec:
       serviceAccountName: migration-controller-manager
       terminationGracePeriodSeconds: 30
       volumes:
-      - name: cert
-        secret:
-          defaultMode: 420
-          secretName: webhook-server-cert
       - hostPath:
           path: /var/lib/rancher/k3s/server
           type: Directory

deploy/06vpwned-deployment.yaml

@@ -38,7 +38,7 @@ spec:
         - configMapRef:
             name: pf9-env
             optional: true
-        image: quay.io/platform9/vjailbreak-vpwned:main
+        image: quay.io/platform9/vjailbreak-vpwned:0.1.13
         imagePullPolicy: IfNotPresent
         name: vpwned
         ports:

deploy/07ui-deployment.yaml

@@ -24,7 +24,7 @@ spec:
       serviceAccountName: ui-manager-sa
       containers:
         - name: vjailbreak-ui-container
-          image: quay.io/platform9/vjailbreak-ui:main
+          image: quay.io/platform9/vjailbreak-ui:0.1.13
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 80

deploy/08vjailbreak-ai-deployment.yaml

@@ -36,7 +36,7 @@ spec:
       serviceAccountName: vjailbreak-ai-sa
       containers:
         - name: vjailbreak-ai
-          image: quay.io/platform9/vjailbreak-ai:main
+          image: quay.io/platform9/vjailbreak-ai:0.1.13
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080

deploy/installer.yaml

@@ -1959,16 +1959,6 @@ metadata:
     controller-gen.kubebuilder.io/version: v0.17.1
   name: openstackcreds.vjailbreak.k8s.pf9.io
 spec:
-  conversion:
-    strategy: Webhook
-    webhook:
-      clientConfig:
-        service:
-          name: migration-webhook-service
-          namespace: migration-system
-          path: /convert
-      conversionReviewVersions:
-      - v1
   group: vjailbreak.k8s.pf9.io
   names:
     kind: OpenstackCreds
@@ -5187,22 +5177,6 @@ spec:
     app: vpwned-sdk
   type: ClusterIP
 ---
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app.kubernetes.io/managed-by: kustomize
-    app.kubernetes.io/name: migration
-  name: migration-webhook-service
-  namespace: migration-system
-spec:
-  ports:
-  - port: 443
-    protocol: TCP
-    targetPort: 9443
-  selector:
-    control-plane: controller-manager
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -5246,7 +5220,7 @@ spec:
         - configMapRef:
             name: pf9-env
             optional: true
-        image: quay.io/platform9/vjailbreak-controller:main
+        image: quay.io/platform9/vjailbreak-controller:0.1.13
         imagePullPolicy: IfNotPresent
         lifecycle:
           preStop:
@@ -5262,10 +5236,6 @@ spec:
           initialDelaySeconds: 15
           periodSeconds: 20
         name: manager
-        ports:
-        - containerPort: 9443
-          name: webhook-server
-          protocol: TCP
         readinessProbe:
           httpGet:
             path: /readyz
@@ -5277,9 +5247,6 @@ spec:
             cpu: 200m
             memory: 256Mi
         volumeMounts:
-        - mountPath: /tmp/k8s-webhook-server/serving-certs
-          name: cert
-          readOnly: true
         - mountPath: /etc/pf9/k3s
           name: master-token
         - mountPath: /home/ubuntu
@@ -5302,10 +5269,6 @@ spec:
       serviceAccountName: migration-controller-manager
       terminationGracePeriodSeconds: 30
       volumes:
-      - name: cert
-        secret:
-          defaultMode: 420
-          secretName: webhook-server-cert
       - hostPath:
           path: /var/lib/rancher/k3s/server
           type: Directory
@@ -5362,7 +5325,7 @@ spec:
         - configMapRef:
             name: pf9-env
             optional: true
-        image: quay.io/platform9/vjailbreak-vpwned:main
+        image: quay.io/platform9/vjailbreak-vpwned:0.1.13
         imagePullPolicy: IfNotPresent
         name: vpwned
         ports:
@@ -5466,32 +5429,6 @@ spec:
               number: 80
         path: /dev-api/sdk/(.*)
         pathType: ImplementationSpecific
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: migration-validating-webhook-configuration
-webhooks:
-- admissionReviewVersions:
-  - v1
-  clientConfig:
-    service:
-      name: migration-webhook-service
-      namespace: migration-system
-      path: /validate-vjailbreak-k8s-pf9-io-v1alpha1-openstackcreds
-  failurePolicy: Fail
-  name: vopenstackcreds.kb.io
-  rules:
-  - apiGroups:
-    - vjailbreak.k8s.pf9.io
-    apiVersions:
-    - v1alpha1
-    operations:
-    - CREATE
-    - UPDATE
-    resources:
-    - openstackcreds
-  sideEffects: None
 
 ---
 apiVersion: apps/v1
@@ -5519,7 +5456,7 @@ spec:
       serviceAccountName: ui-manager-sa
       containers:
         - name: vjailbreak-ui-container
-          image: quay.io/platform9/vjailbreak-ui:main
+          image: quay.io/platform9/vjailbreak-ui:0.1.13
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 80
@@ -5808,7 +5745,7 @@ spec:
       serviceAccountName: vjailbreak-ai-sa
       containers:
         - name: vjailbreak-ai
-          image: quay.io/platform9/vjailbreak-ai:main
+          image: quay.io/platform9/vjailbreak-ai:0.1.13
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080

k8s/migration/api/v1alpha1/openstackcreds_webhook_test.go

@@ -17,23 +17,82 @@ limitations under the License.
 package v1alpha1
 
 import (
+	"context"
+	"testing"
+
 	. "github.com/onsi/ginkgo/v2"
+	corev1 "k8s.io/api/core/v1"
 )
 
 var _ = Describe("OpenstackCreds Webhook", func() {
 
 	Context("When creating OpenstackCreds under Validating Webhook", func() {
 		It("Should deny if a required field is empty", func() {
-
-			// TODO(user): Add your logic here
-
+			// Validation logic deferred to #2347
 		})
 
 		It("Should admit if all required fields are provided", func() {
-
-			// TODO(user): Add your logic here
-
+			// Validation logic deferred to #2347
 		})
 	})
 
 })
+
+// TestOpenstackCredsCustomValidator tests the type-assertion logic in the validator.
+func TestOpenstackCredsCustomValidator(t *testing.T) {
+	v := &OpenstackCredsCustomValidator{}
+	ctx := context.Background()
+	validObj := &OpenstackCreds{}
+	wrongObj := &corev1.Pod{}
+
+	tests := []struct {
+		name    string
+		op      string
+		wantErr bool
+	}{
+		{"ValidateCreate correct type", "create", false},
+		{"ValidateUpdate correct type", "update", false},
+		{"ValidateDelete correct type", "delete", false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var err error
+			switch tt.op {
+			case "create":
+				_, err = v.ValidateCreate(ctx, validObj)
+			case "update":
+				_, err = v.ValidateUpdate(ctx, nil, validObj)
+			case "delete":
+				_, err = v.ValidateDelete(ctx, validObj)
+			}
+			if (err != nil) != tt.wantErr {
+				t.Errorf("got err=%v, wantErr=%v", err, tt.wantErr)
+			}
+		})
+	}
+
+	wrongTests := []struct {
+		name string
+		op   string
+	}{
+		{"ValidateCreate wrong type", "create"},
+		{"ValidateUpdate wrong type", "update"},
+		{"ValidateDelete wrong type", "delete"},
+	}
+	for _, tt := range wrongTests {
+		t.Run(tt.name, func(t *testing.T) {
+			var err error
+			switch tt.op {
+			case "create":
+				_, err = v.ValidateCreate(ctx, wrongObj)
+			case "update":
+				_, err = v.ValidateUpdate(ctx, nil, wrongObj)
+			case "delete":
+				_, err = v.ValidateDelete(ctx, wrongObj)
+			}
+			if err == nil {
+				t.Errorf("expected error for wrong type, got nil")
+			}
+		})
+	}
+}

k8s/migration/config/crd/kustomization.yaml

@@ -31,7 +31,7 @@ resources:
 patches:
 # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
 # patches here are for enabling the conversion webhook for each CRD
-- path: patches/webhook_in_openstackcreds.yaml
+#- path: patches/webhook_in_openstackcreds.yaml
 # +kubebuilder:scaffold:crdkustomizewebhookpatch
 
 # [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix.
@@ -58,5 +58,5 @@ patches:
 # [WEBHOOK] To enable webhook, uncomment the following section
 # the following config is for teaching kustomize how to do kustomization for CRDs.
 
-configurations:
-- kustomizeconfig.yaml
+#configurations:
+#- kustomizeconfig.yaml