Repo webhook move

.vscode/launch.json

@@ -32,8 +32,6 @@
             ],
             "cwd": "${workspaceFolder}",
             "env": {
-                "CERT_STORAGE_DIR": "${workspaceFolder}/.build/pki/tmp",
-                "WEBHOOK_HOST": "localhost",
                 "GOOGLE_API_GO_EXPERIMENTAL_DISABLE_NEW_AUTH_LIB": "true",
                 "OTEL_TRACES_EXPORTER": "none",
                 "OTEL_METRICS_EXPORTER": "none"
@@ -56,8 +54,6 @@
             ],
             "cwd": "${workspaceFolder}",
             "env": {
-                "CERT_STORAGE_DIR": "${workspaceFolder}/.build/pki/tmp",
-                "WEBHOOK_HOST": "localhost",
                 "GOOGLE_API_GO_EXPERIMENTAL_DISABLE_NEW_AUTH_LIB": "true",
                 "DB_DRIVER": "pgx",
                 "DB_HOST": "${env:DB_HOST}",

controllers/packagerevisions/config/webhook/manifests.yaml

@@ -15,7 +15,7 @@
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
-  name: validating-webhook-configuration
+  name: packagerevision-validating-webhook-configuration
 webhooks:
 - admissionReviewVersions:
   - v1

controllers/packagerevisions/pkg/controllers/packagerevision/packagerevision_controller.go

@@ -33,8 +33,8 @@ import (
 
 //go:generate go run sigs.k8s.io/controller-tools/cmd/controller-gen@v0.21.0 rbac:headerFile=../../../../../scripts/boilerplate.yaml.txt,roleName=porch-controllers-packagerevisions,year=$YEAR_GEN webhook:headerFile=../../../../../scripts/boilerplate.yaml.txt,year=$YEAR_GEN paths="." output:rbac:artifacts:config=../../../config/rbac output:webhook:artifacts:config=../../../config/webhook
 
+//+kubebuilder:webhookconfiguration:mutating=false,name=packagerevision-validating-webhook-configuration
 //+kubebuilder:webhook:path=/validate-porch-kpt-dev-v1alpha2-packagerevision,mutating=false,failurePolicy=fail,groups=porch.kpt.dev,resources=packagerevisions,verbs=create;update;delete,versions=v1alpha2,name=packagerevision-validator.porch.kpt.dev,admissionReviewVersions=v1,sideEffects=None,serviceName=porch-controllers,serviceNamespace=porch-system,servicePort=9443,timeoutSeconds=30
-
 //+kubebuilder:rbac:groups=porch.kpt.dev,resources=packagerevisions,verbs=get;list;watch;update;patch
 //+kubebuilder:rbac:groups=porch.kpt.dev,resources=packagerevisions/status,verbs=get;update;patch
 //+kubebuilder:rbac:groups=porch.kpt.dev,resources=packagerevisions/finalizers,verbs=update

controllers/repositories/config/webhook/manifests.yaml

@@ -0,0 +1,42 @@
+# Copyright 2026 The kpt Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: repository-validating-webhook-configuration
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: porch-controllers
+      namespace: porch-system
+      path: /validate-repository
+      port: 9443
+  failurePolicy: Fail
+  name: repository-validator.porch.kpt.dev
+  rules:
+  - apiGroups:
+    - config.porch.kpt.dev
+    apiVersions:
+    - v1alpha1
+    operations:
+    - CREATE
+    - UPDATE
+    - DELETE
+    resources:
+    - repositories
+  sideEffects: None
+  timeoutSeconds: 30

controllers/repositories/pkg/controllers/repository/config.go

@@ -18,7 +18,10 @@ import (
 	"flag"
 	"time"
 
+	"github.com/kptdev/porch/controllers/repositories/pkg/webhooks"
 	cachetypes "github.com/kptdev/porch/pkg/cache/types"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 )
 
 const (
@@ -87,6 +90,27 @@ func (r *RepositoryReconciler) validateConfig() {
 	}
 }
 
+// Init wires runtime dependencies that require the manager.
+// It registers the Repository validating webhook on the shared webhook server.
+func (r *RepositoryReconciler) Init(mgr ctrl.Manager) error {
+	log := ctrl.Log.WithName(r.Name())
+
+	// Register Repository validating webhook.
+	// The validator implements admission.Handler interface via its Handle method.
+	// Use GetAPIReader() for strong consistency during admission validation.
+	// See: deployments/porch/3-porch-controllers.yaml
+	validator := webhooks.NewRepositoryValidator(mgr.GetAPIReader())
+
+	mgr.GetWebhookServer().Register(
+		"/validate-repository",
+		&admission.Webhook{
+			Handler: validator,
+		})
+	log.Info("Repository validating webhook registered")
+
+	return nil
+}
+
 // LogConfig logs the controller configuration
 func (r *RepositoryReconciler) LogConfig(log interface {
 	Info(msg string, keysAndValues ...any)

controllers/repositories/pkg/controllers/repository/config_test.go

@@ -15,12 +15,19 @@
 package repository
 
 import (
+	"context"
 	"flag"
+	"net/http"
 	"testing"
 	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+	"sigs.k8s.io/controller-runtime/pkg/healthz"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
 )
 
 func TestInitDefaults(t *testing.T) {
@@ -127,3 +134,246 @@ func TestLogConfig(t *testing.T) {
 		})
 	}
 }
+
+func TestValidateConfig(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    *RepositoryReconciler
+		expected *RepositoryReconciler
+	}{
+		{
+			name: "all valid values - no changes",
+			input: &RepositoryReconciler{
+				HealthCheckFrequency:       5 * time.Minute,
+				FullSyncFrequency:          1 * time.Hour,
+				MaxConcurrentReconciles:    100,
+				MaxConcurrentSyncs:         50,
+				SyncStaleTimeout:           20 * time.Minute,
+				RepoOperationRetryAttempts: 3,
+			},
+			expected: &RepositoryReconciler{
+				HealthCheckFrequency:       5 * time.Minute,
+				FullSyncFrequency:          1 * time.Hour,
+				MaxConcurrentReconciles:    100,
+				MaxConcurrentSyncs:         50,
+				SyncStaleTimeout:           20 * time.Minute,
+				RepoOperationRetryAttempts: 3,
+			},
+		},
+		{
+			name: "zero health check - uses default",
+			input: &RepositoryReconciler{
+				HealthCheckFrequency:       0,
+				FullSyncFrequency:          1 * time.Hour,
+				MaxConcurrentReconciles:    100,
+				MaxConcurrentSyncs:         50,
+				SyncStaleTimeout:           20 * time.Minute,
+				RepoOperationRetryAttempts: 3,
+			},
+			expected: &RepositoryReconciler{
+				HealthCheckFrequency:       5 * time.Minute,
+				FullSyncFrequency:          1 * time.Hour,
+				MaxConcurrentReconciles:    100,
+				MaxConcurrentSyncs:         50,
+				SyncStaleTimeout:           20 * time.Minute,
+				RepoOperationRetryAttempts: 3,
+			},
+		},
+		{
+			name: "negative full sync - uses default",
+			input: &RepositoryReconciler{
+				HealthCheckFrequency:       5 * time.Minute,
+				FullSyncFrequency:          -1 * time.Hour,
+				MaxConcurrentReconciles:    100,
+				MaxConcurrentSyncs:         50,
+				SyncStaleTimeout:           20 * time.Minute,
+				RepoOperationRetryAttempts: 3,
+			},
+			expected: &RepositoryReconciler{
+				HealthCheckFrequency:       5 * time.Minute,
+				FullSyncFrequency:          1 * time.Hour,
+				MaxConcurrentReconciles:    100,
+				MaxConcurrentSyncs:         50,
+				SyncStaleTimeout:           20 * time.Minute,
+				RepoOperationRetryAttempts: 3,
+			},
+		},
+		{
+			name: "zero stale timeout - uses default",
+			input: &RepositoryReconciler{
+				HealthCheckFrequency:       5 * time.Minute,
+				FullSyncFrequency:          1 * time.Hour,
+				MaxConcurrentReconciles:    100,
+				MaxConcurrentSyncs:         50,
+				SyncStaleTimeout:           0,
+				RepoOperationRetryAttempts: 3,
+			},
+			expected: &RepositoryReconciler{
+				HealthCheckFrequency:       5 * time.Minute,
+				FullSyncFrequency:          1 * time.Hour,
+				MaxConcurrentReconciles:    100,
+				MaxConcurrentSyncs:         50,
+				SyncStaleTimeout:           20 * time.Minute,
+				RepoOperationRetryAttempts: 3,
+			},
+		},
+		{
+			name: "zero max concurrent reconciles - uses default",
+			input: &RepositoryReconciler{
+				HealthCheckFrequency:       5 * time.Minute,
+				FullSyncFrequency:          1 * time.Hour,
+				MaxConcurrentReconciles:    0,
+				MaxConcurrentSyncs:         50,
+				SyncStaleTimeout:           20 * time.Minute,
+				RepoOperationRetryAttempts: 3,
+			},
+			expected: &RepositoryReconciler{
+				HealthCheckFrequency:       5 * time.Minute,
+				FullSyncFrequency:          1 * time.Hour,
+				MaxConcurrentReconciles:    100,
+				MaxConcurrentSyncs:         50,
+				SyncStaleTimeout:           20 * time.Minute,
+				RepoOperationRetryAttempts: 3,
+			},
+		},
+		{
+			name: "negative max concurrent syncs - uses default",
+			input: &RepositoryReconciler{
+				HealthCheckFrequency:       5 * time.Minute,
+				FullSyncFrequency:          1 * time.Hour,
+				MaxConcurrentReconciles:    100,
+				MaxConcurrentSyncs:         -10,
+				SyncStaleTimeout:           20 * time.Minute,
+				RepoOperationRetryAttempts: 3,
+			},
+			expected: &RepositoryReconciler{
+				HealthCheckFrequency:       5 * time.Minute,
+				FullSyncFrequency:          1 * time.Hour,
+				MaxConcurrentReconciles:    100,
+				MaxConcurrentSyncs:         50,
+				SyncStaleTimeout:           20 * time.Minute,
+				RepoOperationRetryAttempts: 3,
+			},
+		},
+		{
+			name: "zero retry attempts - uses default",
+			input: &RepositoryReconciler{
+				HealthCheckFrequency:       5 * time.Minute,
+				FullSyncFrequency:          1 * time.Hour,
+				MaxConcurrentReconciles:    100,
+				MaxConcurrentSyncs:         50,
+				SyncStaleTimeout:           20 * time.Minute,
+				RepoOperationRetryAttempts: 0,
+			},
+			expected: &RepositoryReconciler{
+				HealthCheckFrequency:       5 * time.Minute,
+				FullSyncFrequency:          1 * time.Hour,
+				MaxConcurrentReconciles:    100,
+				MaxConcurrentSyncs:         50,
+				SyncStaleTimeout:           20 * time.Minute,
+				RepoOperationRetryAttempts: 3,
+			},
+		},
+		{
+			name: "all invalid - all use defaults",
+			input: &RepositoryReconciler{
+				HealthCheckFrequency:       0,
+				FullSyncFrequency:          -1,
+				MaxConcurrentReconciles:    -1,
+				MaxConcurrentSyncs:         0,
+				SyncStaleTimeout:           0,
+				RepoOperationRetryAttempts: -10,
+			},
+			expected: &RepositoryReconciler{
+				HealthCheckFrequency:       5 * time.Minute,
+				FullSyncFrequency:          1 * time.Hour,
+				MaxConcurrentReconciles:    100,
+				MaxConcurrentSyncs:         50,
+				SyncStaleTimeout:           20 * time.Minute,
+				RepoOperationRetryAttempts: 3,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			tt.input.validateConfig()
+			assert.Equal(t, tt.expected.HealthCheckFrequency, tt.input.HealthCheckFrequency)
+			assert.Equal(t, tt.expected.FullSyncFrequency, tt.input.FullSyncFrequency)
+			assert.Equal(t, tt.expected.MaxConcurrentReconciles, tt.input.MaxConcurrentReconciles)
+			assert.Equal(t, tt.expected.MaxConcurrentSyncs, tt.input.MaxConcurrentSyncs)
+			assert.Equal(t, tt.expected.SyncStaleTimeout, tt.input.SyncStaleTimeout)
+			assert.Equal(t, tt.expected.RepoOperationRetryAttempts, tt.input.RepoOperationRetryAttempts)
+		})
+	}
+}
+
+// fakeManager is a minimal manager.Manager for unit testing Init().
+// Only GetClient(), GetAPIReader(), and GetWebhookServer() are implemented; all other methods will panic if called.
+type fakeManager struct {
+	manager.Manager
+	client client.Client
+}
+
+func (f *fakeManager) GetClient() client.Client {
+	return f.client
+}
+
+func (f *fakeManager) GetAPIReader() client.Reader {
+	return f.client
+}
+
+func (f *fakeManager) GetWebhookServer() webhook.Server {
+	return &fakeWebhookServer{}
+}
+
+// fakeWebhookServer is a minimal webhook.Server for testing.
+type fakeWebhookServer struct{}
+
+func (f *fakeWebhookServer) Register(path string, handler http.Handler) {
+	// No-op for testing
+}
+
+func (f *fakeWebhookServer) Start(ctx context.Context) error {
+	return nil
+}
+
+func (f *fakeWebhookServer) NeedLeaderElection() bool {
+	return false
+}
+
+func (f *fakeWebhookServer) StartedChecker() healthz.Checker {
+	// Return a no-op checker for testing
+	return healthz.Ping
+}
+
+func (f *fakeWebhookServer) WebhookMux() *http.ServeMux {
+	return nil
+}
+
+func TestInit(t *testing.T) {
+	tests := []struct {
+		name    string
+		wantErr bool
+	}{
+		{
+			name:    "successfully registers repository webhook",
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reconciler := &RepositoryReconciler{}
+			mgr := &fakeManager{client: fake.NewClientBuilder().Build()}
+
+			err := reconciler.Init(mgr)
+
+			if tt.wantErr {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}

controllers/repositories/pkg/controllers/repository/repository_controller.go

@@ -74,7 +74,10 @@ type RepositoryReconciler struct {
 	coldStartRepos sync.Map      // Tracks repos that have synced since startup
 }
 
-//go:generate go run sigs.k8s.io/controller-tools/cmd/controller-gen@v0.21.0 rbac:headerFile=../../../../../scripts/boilerplate.yaml.txt,roleName=porch-controllers-repositories,year=$YEAR_GEN webhook paths="." output:rbac:artifacts:config=../../../config/rbac
+//go:generate go run sigs.k8s.io/controller-tools/cmd/controller-gen@v0.21.0 rbac:headerFile=../../../../../scripts/boilerplate.yaml.txt,roleName=porch-controllers-repositories,year=$YEAR_GEN webhook:headerFile=../../../../../scripts/boilerplate.yaml.txt,year=$YEAR_GEN paths="." output:rbac:artifacts:config=../../../config/rbac output:webhook:artifacts:config=../../../config/webhook
+
+//+kubebuilder:webhookconfiguration:mutating=false,name=repository-validating-webhook-configuration
+//+kubebuilder:webhook:path=/validate-repository,mutating=false,failurePolicy=fail,groups=config.porch.kpt.dev,resources=repositories,verbs=create;update;delete,versions=v1alpha1,name=repository-validator.porch.kpt.dev,admissionReviewVersions=v1,sideEffects=None,serviceName=porch-controllers,serviceNamespace=porch-system,servicePort=9443,timeoutSeconds=30
 
 //+kubebuilder:rbac:groups=config.porch.kpt.dev,resources=repositories,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups=config.porch.kpt.dev,resources=repositories/status,verbs=get;update;patch