feat: add validating webhook

[Tom Bojer (tombojer)]

To lower the size of the created crds we introduce
a validating webhook that is used to validate the
overwrites.

The validating webhook requires cert-manager installed in the cluster.
The size of the created crds will be shrinked from 2.5 to 0.5MB.

[Tom Bojer (tombojer)]

Tested with deployment from store resource via ArgoCD we get the following message when adding a unallowed field. e.g. foo: bar to the worker overwrite definition:

one or more synchronization tasks completed unsuccessfully, reason: error when patching "/dev/shm/4213435157": admission webhook "vstore.competent-boyd.shopware.com" denied the request: invalid container override: unknown field "spec.workerDeploymentContainer.foo". Retrying attempt #4 at 1:21PM.

[Copilot]

Pull request overview

This PR introduces a validating admission webhook for the Store CR to validate schemaless container override fields (while keeping CRD schemas compact), and wires the webhook into both Helm and Kustomize installations with cert-manager-provisioned TLS.

Changes:

• Added a Store validating webhook handler (plus unit tests) and a runtime flag (ENABLE_WEBHOOK) to enable/disable webhook registration.
• Shrunk the Store CRD schema by marking container override fields as schemaless/preserve-unknown, backed by webhook validation and a CRD size regression test.
• Added Helm/Kustomize webhook + cert-manager resources and updated CI and docs to reflect the new default behavior.

Reviewed changes

Copilot reviewed 28 out of 28 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
README.md	Documents default webhook enablement, cert-manager requirement, and no-webhook Kustomize path.
Makefile	Disables webhook for make run; updates release manifest generation to rely on config/default.
internal/webhook/store_validator.go	Implements strict Store decoding + explicit override rules for webhook validation.
internal/webhook/store_validator_test.go	Unit tests for webhook acceptance/rejection cases.
internal/config/config.go	Adds ENABLE_WEBHOOK configuration flag (default true).
internal/config/config_test.go	Verifies webhook flag defaults and disabling behavior.
helm/values.yaml	Introduces webhook.enabled value (default true) and documents cert-manager dependency.
helm/templates/webhook.yaml	Adds Service, Issuer, Certificate, and ValidatingWebhookConfiguration for Helm installs.
helm/templates/deployment.yaml	Plumbs ENABLE_WEBHOOK env var and conditionally mounts webhook certs / exposes port 9443.
helm/README.md	Documents cert-manager prerequisite and how to disable the webhook via Helm values.
go.mod	Promotes sigs.k8s.io/json to a direct dependency for strict JSON unmarshalling.
config/webhook/service.yaml	Adds the webhook Service for Kustomize installs.
config/webhook/manifests.yaml	Adds ValidatingWebhookConfiguration for Kustomize installs.
config/webhook/kustomizeconfig.yaml	Configures Kustomize name/namespace rewriting for webhook clientConfig service refs.
config/webhook/kustomization.yaml	Defines the webhook kustomization (resources + configurations).
config/no-webhook/kustomization.yaml	Adds a no-webhook Kustomize overlay for source-based installs.
config/no-webhook/disable_webhook_patch.yaml	Strategic-merge patch to set ENABLE_WEBHOOK=false for the manager deployment.
config/default/webhookcainjection_patch.yaml	Adds cert-manager CA injection annotation to the validating webhook configuration.
config/default/manager_webhook_patch.yaml	Patches manager deployment to mount serving certs and expose webhook port.
config/default/kustomization.yaml	Enables webhook + cert-manager components by default and sets namespace to default.
config/certmanager/kustomization.yaml	Adds cert-manager resources to Kustomize install.
config/certmanager/issuer.yaml	Defines a self-signed Issuer for webhook TLS.
config/certmanager/certificate.yaml	Defines the serving Certificate + secret for webhook TLS.
cmd/main.go	Registers the validating webhook handler when ENABLE_WEBHOOK is true.
api/v1/store.go	Marks override fields schemaless/preserve-unknown to reduce CRD schema size.
api/v1/crd_schema_test.go	Adds a regression test to enforce compact CRD size and preserve-unknown count.
.github/workflows/lint.yaml	Ensures manifests are generated before tests; adds cert-manager + webhook E2E validation checks.
.github/testdata/invalid_store_override.yaml	Adds E2E fixture to verify webhook rejection of unknown override fields.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.