feat: implement and register EtcdCluster admission webhooks

[xrl]

Summary

The manager already constructs a webhook server (webhook.NewServer(...) in cmd/main.go) and the kustomize scaffolding carries [WEBHOOK]/[CERTMANAGER] markers, but no admission webhook was ever implemented or registered for EtcdCluster. The server started and served nothing, so malformed specs were only (partially) caught later during reconciliation, with no synchronous, actionable feedback at kubectl apply time.

This PR implements and registers a validating + defaulting admission webhook for EtcdCluster.

Refs #380

What it does

SetupWebhookWithManager is called from cmd/main.go (a minimal, localized edit, skippable with ENABLE_WEBHOOKS=false for local make run without serving certs).

Validating (ValidateCreate / ValidateUpdate)

Every rejection returns a crisp, actionable message telling the user exactly what is wrong and how to fix it:

• spec.size — must be >= 1 and odd. An even-sized etcd cluster tolerates no more failures than the next-smaller odd size while being more likely to lose quorum; the message names the two nearest valid sizes.
• spec.version — must be valid semver. On update, the current→target transition must be a supported single-minor, non-downgrade path, reusing the same ordered version table (etcd/api/v3/version.AllVersions) the controller uses at reconcile time.
• spec.tls — provider must be one of {auto, cert-manager}; the provider-specific config block must be present/complete (cert-manager requires issuerName, and issuerKind if set must be Issuer/ClusterIssuer); the auto provider must not carry cert-manager config.
• spec.storageSpec — immutable once set (changing/removing the PVC template after the StatefulSet exists cannot be reconciled in place).

Defaulting (Default)

• spec.tls.provider defaults to auto when a TLS block is present without an explicit provider (matches the documented behaviour of TLSCertificate.Provider).

Sample rejection messages

spec.size: Invalid value: 4: size must be an odd number so the cluster can form a
  majority quorum; got 4. An even-sized etcd cluster tolerates no more failures than
  the next-smaller odd size while being more likely to lose quorum. Use 3 or 5 instead.

spec.version: Invalid value: "latest": version "latest" is not a valid semantic version
  (expected MAJOR.MINOR.PATCH, e.g. "3.6.1"): latest is not in dotted-tri format.

spec.version: Invalid value: "3.7.1": upgrading from version 3.5.1 to version 3.7.1 is
  not allowed (skips a minor version). etcd only supports sequential single-minor
  upgrades and forbids downgrades; upgrade one minor version at a time
  (current "3.5.1" -> target "3.7.1").

spec.tls.provider: Unsupported value: "vault": supported values: "auto", "cert-manager"

Logging

The webhook logs every admission decision (admit / default / reject) with structured context — object name/namespace, operation, and per-field reason/remediation — so an operator reading the webhook-server logs can reconstruct exactly why any request was accepted or rejected.

Manifests

make manifests generates config/webhook/manifests.yaml; this PR adds the standard config/webhook (service + kustomizeconfig) and config/certmanager (self-signed Issuer + serving Certificate) scaffolds, the manager_webhook_patch.yaml, and enables the [WEBHOOK]/[CERTMANAGER] sections in config/default/kustomization.yaml including cert-manager CA injection. kustomize build config/default resolves the service name/namespace and cert-manager.io/inject-ca-from annotations correctly.

Testing

• Unit (api/v1alpha1/etcdcluster_webhook_test.go): asserts the exact rejection-message text for size/version/TLS/upgrade/immutability and the defaulting behaviour.
• Envtest (api/v1alpha1/webhook_envtest_test.go): installs the generated webhook config, runs a manager serving the webhook over the envtest-provisioned cert, applies invalid EtcdClusters against a real API server and asserts rejection + message; confirms defaulting and a valid single-minor upgrade are admitted.
• E2E (test/e2e/webhook_test.go, new file): live apply-invalid assertions via the e2e-framework feature harness.

go build ./..., go vet ./..., golangci-lint, the unit tests, and the envtest webhook tests all pass; the e2e file compiles (go test -c ./test/e2e/). The e2e file is self-contained (its own helper) to avoid conflicts with other in-flight e2e PRs.

🤖 Generated with Claude Code

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: xrl
Once this PR has been reviewed and has the lgtm label, please assign hakman for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-ci-robot]

Hi @xrl. Thanks for your PR.

I'm waiting for a etcd-io member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.