AlinsRan opened a new pull request, #2835: URL: https://github.com/apache/apisix-ingress-controller/pull/2835
### Description `kustomize build config/default` currently produces a deployment that cannot work. This PR fixes the manifests and brings them in line with what the Helm chart deploys. Broken today: - **The admission webhook is never deployed.** `../webhook` and `../certmanager` are commented out in `config/default`, so `make deploy` ships no `ValidatingWebhookConfiguration`, while the Helm chart enables the webhook by default (`webhook.enabled: true`). - **`manager_webhook_patch.yaml` is wrong.** It passes `--webhook-cert-path`, a flag the controller does not have, and mounts the serving certificate at `/tmp/k8s-webhook-server/serving-certs` instead of `/certs`, which is what `webhook.tls_cert_dir` in `config.yaml` points at. - **The webhook Service selects a label that does not exist.** Its selector requires `app.kubernetes.io/name: apisix-ingress-controller`, but the pod template only carries `control-plane: controller-manager`, so the Service matches no endpoints. The webhook `NetworkPolicy` has the same mismatch. - **The metrics Service points at a port nothing listens on.** It exposes `8443/https`, while the controller serves plain HTTP metrics on `8080` (`metrics_addr: ":8080"`, `secure_metrics: false`). The `ServiceMonitor` scrapes that same missing port. - **`ADC_SERVER_URL` is missing** from the manager container; the Helm chart sets it. - **`certificate-metrics.yaml` issues a certificate the controller cannot load** — metrics TLS has no cert-directory option, so the `Certificate` is dead weight. Removed. Layout and samples: - Moved the controller ConfigMap source from `config/samples/config.yaml` to `config/manager/config.yaml`. It is part of the deployment, not a sample, and `config/default` no longer pulls `../samples` in as a resource. - `config/samples` now covers all twelve CRDs (added `BackendTrafficPolicy`, `L4RoutePolicy`, `PluginConfig`) and the six `# TODO(user): Add fields here` stubs are filled in. Three samples were invalid against their own CRD schema: `GatewayProxy` was missing the required `provider`, and `ApisixGlobalRule` / `ApisixPluginConfig` were missing the required `plugins`. - Added the `apiVersion`/`kind` header to every `kustomization.yaml`, dropped leftover kubebuilder scaffolding comments, and made `app.kubernetes.io/name` consistently `apisix-ingress-controller`. ### Note on cert-manager Enabling the webhook makes `make deploy` depend on cert-manager being installed — kustomize has no equivalent of the chart's `genSignedCert`. `config/default/kustomization.yaml` documents how to opt out. CI is unaffected: it only runs `make install` / `make install-crds`, which build `config/crd`. ### Verification - `kustomize build config/default`, `config/crd` and `config/samples` all succeed, and `make build-installer` regenerates `dist/install.yaml`. - Verified in the rendered output: the cert-manager CA annotation and the certificate `dnsNames` resolve to the prefixed webhook Service, the webhook secret mounts at `/certs`, the metrics Service targets the named `metrics` port, and the webhook Service selector now matches the pod labels. - Validated every sample in `config/samples` against the CRD OpenAPI schema and its CEL `x-kubernetes-validations` rules (via a throwaway test built on the existing `crdSchemaValidator` harness in `api/v2`); all twelve pass. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
