…g, and spec validation

Completes the admission-webhook PR by making the generated webhook
configuration explicit and safe for production, verifying the
cert-manager caBundle injection chain renders end to end, and closing
remaining gaps in synchronous spec validation.

Webhook policy (generated via pinned controller-gen markers):
- failurePolicy=fail is now an explicit, documented decision. These
  webhooks are correctness-critical for a stateful quorum store, so they
  fail closed. The rule scope is exactly {operator.etcd.io/v1alpha1
  etcdclusters}, so a webhook outage never blocks core cluster objects;
  a documented break-glass objectSelector (label
  etcd.operator.etcd.io/skip-webhooks=true) lets an admin bypass
  admission for a single CR while the operator is down.
- timeoutSeconds=10 and matchPolicy=Equivalent added with rationale.

cert-manager caBundle injection:
- Added test/config render assertions that run `kustomize build
  config/default` and verify the inject-ca-from annotation points at the
  serving Certificate, the Certificate's dnsNames resolve to the webhook
  Service FQDN (no surviving placeholders), the issuerRef and mounted
  secret name line up, and both webhooks carry the hardened policy +
  break-glass selector.

Validation/defaulting completeness:
- validateStorageSpec mirrors the controller's reconcile-time storage
  invariants (volumeSizeRequest >= 1Mi and required, volumeSizeLimit >=
  request, supported accessModes, pvcName required for ReadWriteMany) so
  they are caught synchronously at apply time with actionable messages;
  also validated when storage is newly added on update.
- commonName is rejected when it exceeds the documented 64-char X.509 CN
  ceiling for both auto and cert-manager providers.
- New unit tests assert the exact rejection-message text; new envtest +
  compile-only e2e cases cover undersized storage.

Deferred (intentionally not built): a conversion webhook. It is premature
while only v1alpha1 exists; matchPolicy=Equivalent already guards against
a future equivalent group/version slipping past the validator.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Xavier Lange <xrlange@gmail.com>

…me up

The admission-webhook feature wires config/default to ../certmanager: a
cert-manager Certificate/Issuer issues the webhook-server-cert secret and
manager_webhook_patch.yaml mounts it into the manager pod. The e2e suite's
TestMain installed cert-manager only lazily inside an individual feature test
that runs AFTER setup, so 'make deploy DEPLOY_MODE=e2e' ran with no
cert-manager present: the Certificate/Issuer had no CRDs to apply against, the
secret never materialized, the manager pod hung in ContainerCreating, and the
DeploymentAvailable wait timed out before any webhook assertion could run.

Install cert-manager (InstallCertManager blocks until cert-manager-webhook is
Available) as a setup step BEFORE the deploy step. Verified live: without this
the manager never becomes Available; with it the controller-manager is Available
~14s after deploy and all webhook assertions pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Xavier Lange <xrlange@gmail.com>

The webhook e2e fed the suite-wide etcdVersion ("v3.6.12", v-prefixed) into
every case. semver.NewVersion("v3.6.12") errors, so the new version webhook
rejects it: the happy-path 'admits valid cluster' assertion failed outright,
and the size/tls/storage reject cases passed for the WRONG reason (the
aggregated NewInvalid also carried a version error, so a substring match no
longer isolated the invariant under test).

Improvements:
- Use a hardcoded valid semver (3.6.1) for every non-version case, matching the
  envtest twin, so each assertion proves exactly its one invariant.
- requireWebhookRejection helper: assert apierrors.IsInvalid (a real 422 from
  the validating webhook, not a CRD/schema rejection), assert the exact
  spec.<field> path, and assert that unrelated invariants are NOT present
  (isolation) -- this is the check that kills the 'passes for the wrong reason'
  failure mode.
- Tighten message asserts to the envtest twin's exact text: 'Use 1 or 3
  instead' for even size, supported values: "auto", "cert-manager" for the
  bad provider (catches a garbled NotSupported list a loose Contains pair would
  miss).
- Add the break-glass objectSelector proof: a skip-webhooks-labeled even-sized
  cluster is admitted (bypass) while the same spec unlabeled is still rejected.
  This is the one behavior only a live API server can prove (render test is
  static, envtest has no objectSelector) and the most dangerous new knob.
- Prove the positive upgrade path (3.5.1 -> 3.6.1 admitted) after the skip-minor
  rejection, so a reject-all-updates regression cannot hide behind the negative
  case.
- Use size 1 for the two clusters that are actually created (still odd/valid) to
  cut reconcile load on the kind node.

No sleeps/polling added: admission is synchronous, so a Create/Update return IS
the decision. Live: all 7 sub-asserts green; suite wall-clock ~127-231s, the
8 assertions themselves run in ~0.3s.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Xavier Lange <xrlange@gmail.com>

…-tagged images

The admission webhook validated spec.version with coreos/go-semver, which
rejects a leading "v". But the default registry (gcr.io/etcd-development/etcd)
publishes ONLY v-prefixed tags, and the controller built the image as
"<registry>:<version>". So with the webhook on:

  - "v3.6.1" (the form config/samples actually ships -> v3.5.21, matching
    origin/main) was REJECTED by the validator, and
  - a bare "3.6.1" that the validator did accept rendered
    "gcr.io/etcd-development/etcd:3.6.1", a tag the registry does not publish
    -> NotFound / ImagePullBackOff.

The default image was therefore unpullable whenever the webhook was enabled.

Fix, end to end:

  - Webhook NORMALIZES spec.version: a leading "v" is stripped before
    go-semver parses it, so BOTH "v3.6.1" and "3.6.1" validate, including the
    upgrade-path comparison (validateUpgradePath/checkUpgradePath) and the
    no-op short-circuit. This keeps the operator's own v-prefixed samples
    appliable rather than self-rejecting.
  - Controller NORMALIZES the rendered tag to the registry convention
    (internal/controller/utils.go: etcdImageTag) by prepending "v" when the
    user supplied a bare semver, so a bare spec.version still pulls. An
    already-v-prefixed value and an explicit non-semver custom tag are passed
    through untouched so non-default registries are not disturbed.
  - Controller's reconcile-time upgrade check now compares and parses on the
    normalized form, so the v-prefixed live image tag and a bare spec.version
    for the same release are not mistaken for a version change (and parse
    cleanly through validateEtcdUpgradePath).

Tests: webhook accepts "v3.6.1" and "3.6.1" and a v-prefixed single-minor
upgrade path (skip-minor still rejected); etcdImageTag and an end-to-end
StatefulSet render assert the tag is v-prefixed for the default registry.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Xavier Lange <xrlange@gmail.com>