feat: support webhook server for ingress

[ronething]

Since this version has not been officially released, I can only test it locally first.

NAMESPACE="webhook-test"
RELEASE_NAME="test-webhook"
CHART_PATH="."

helm upgrade --install $RELEASE_NAME $CHART_PATH \
  --namespace $NAMESPACE \
  --set webhook.enabled=true \
  --set deployment.image.tag="dev" \
  --wait --timeout=2m

• gp1.yaml

apiVersion: apisix.apache.org/v1alpha1
kind: GatewayProxy
metadata:
  name: gp1
spec:
  provider:
    type: ControlPlane
    controlPlane:
      endpoints: 
       - http://127.0.0.1:9180
      auth:
        type: AdminKey
        adminKey:
          value: admin

• gp2.yaml

apiVersion: apisix.apache.org/v1alpha1
kind: GatewayProxy
metadata:
  name: gp2
spec:
  provider:
    type: ControlPlane
    controlPlane:
      endpoints: 
       - http://127.0.0.1:9180
      auth:
        type: AdminKey
        adminKey:
          value: admin

• test

$ k apply -f gp1.yaml -n webhook-test                                                             
gatewayproxy.apisix.apache.org/gp1 created

$ k apply -f gp2.yaml                
Error from server (Forbidden): error when creating "gp2.yaml": admission webhook "vgatewayproxy-v1alpha1.kb.io" denied the request: gateway proxy configuration conflict: GatewayProxy default/gp2 and webhook-test/gp1 both target control plane endpoints [http://127.0.0.1:9180] while sharing the same inline AdminKey value

Specific generated ingress-related configurations:

helm template test-webhook ./charts/ingress-controller \
  --set webhook.enabled=true \
  --debug

• ValidatingWebhookConfiguration

# Source: api7-ingress-controller/templates/webhook.yaml
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: test-webhook-api7-ingress-controller-webhook
  labels:
    helm.sh/chart: api7-ingress-controller-0.1.13
    
    app.kubernetes.io/name: api7-ingress-controller
    app.kubernetes.io/instance: test-webhook
    app.kubernetes.io/version: "2.0.7"
    app.kubernetes.io/managed-by: Helm
webhooks:
- name: vapisixtls-v2.kb.io
  admissionReviewVersions: ["v1"]
  clientConfig:
    caBundle: xxx==
    service:
      name: test-webhook-api7-ingress-controller-webhook-service
      namespace: default
      path: /validate-apisix-apache-org-v2-apisixtls
  failurePolicy: Fail
  timeoutSeconds: 10
  sideEffects: None
  rules:
  - operations: ["CREATE", "UPDATE"]
    apiGroups: ["apisix.apache.org"]
    apiVersions: ["v2"]
    resources: ["apisixtlses"]
- name: vconsumer-v1alpha1.kb.io
  admissionReviewVersions: ["v1"]
  clientConfig:
    caBundle: xxx==
    service:
      name: test-webhook-api7-ingress-controller-webhook-service
      namespace: default
      path: /validate-apisix-apache-org-v1alpha1-consumer
  failurePolicy: Fail
  timeoutSeconds: 10
  sideEffects: None
  rules:
  - operations: ["CREATE", "UPDATE"]
    apiGroups: ["apisix.apache.org"]
    apiVersions: ["v1alpha1"]
    resources: ["consumers"]
- name: vgatewayproxy-v1alpha1.kb.io
  admissionReviewVersions: ["v1"]
  clientConfig:
    caBundle: xxx==
    service:
      name: test-webhook-api7-ingress-controller-webhook-service
      namespace: default
      path: /validate-apisix-apache-org-v1alpha1-gatewayproxy
  failurePolicy: Fail
  timeoutSeconds: 10
  sideEffects: None
  rules:
  - operations: ["CREATE", "UPDATE"]
    apiGroups: ["apisix.apache.org"]
    apiVersions: ["v1alpha1"]
    resources: ["gatewayproxies"]

...

• Deployment

# Source: api7-ingress-controller/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-webhook-api7-ingress-controller
  namespace: default
  annotations:
  labels:
    helm.sh/chart: api7-ingress-controller-0.1.13
    
    app.kubernetes.io/name: api7-ingress-controller
    app.kubernetes.io/instance: test-webhook
    app.kubernetes.io/version: "2.0.7"
    app.kubernetes.io/managed-by: Helm
spec:
  replicas: 1
  selector:
    matchLabels:
      
      app.kubernetes.io/name: api7-ingress-controller
      app.kubernetes.io/instance: test-webhook
  template:
    metadata:
      annotations:
        checksum/config: 6cfdb5604105d6abf6a14d38d265b8f19f66c97574e95d81b34ee7cfe34e0a84
      labels:
        
        app.kubernetes.io/name: api7-ingress-controller
        app.kubernetes.io/instance: test-webhook
    spec:
      containers:
      - env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        image: "api7/api7-ingress-controller:2.0.7"
        volumeMounts:
        - name: test-webhook-ingress-config
          mountPath: /app/conf/config.yaml
          subPath: config.yaml
        - name: webhook-certs
          mountPath: /certs
          readOnly: true
        ports:
        - name: webhook
          containerPort: 9443
          protocol: TCP
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8081
          initialDelaySeconds: 15
          periodSeconds: 20
        name: manager
        readinessProbe:
          httpGet:
            path: /readyz
            port: 8081
          initialDelaySeconds: 5
          periodSeconds: 10
        resources:
          {}
        securityContext:
          {}
      - name: adc-server
        image: "ghcr.io/api7/adc:0.21.1"
        args:
        - "server"
        - "--listen"
        - "http://127.0.0.1:3000"
        - "--listen-status"
        - "3001"
        env:
        - name: ADC_RUNNING_MODE
          value: "ingress"
        - name: ADC_EXPERIMENTAL_FEATURE_FLAGS
          value: "remote-state-file,parallel-backend-request"
        ports:
        - name: http-status
          containerPort: 3001
          protocol: TCP
        livenessProbe:
          httpGet:
            path: /healthz/ready
            port: 3001
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 10
        readinessProbe:
          httpGet:
            path: /healthz/ready
            port: 3001
          initialDelaySeconds: 5
          periodSeconds: 5
        resources:
          {}
        securityContext:
          {}
      volumes:
      - name: test-webhook-ingress-config
        configMap:
          name: test-webhook-ingress-config
      - name: webhook-certs
        secret:
          secretName: test-webhook-api7-ingress-controller-webhook-certs
      securityContext:
        runAsNonRoot: false
      serviceAccountName: test-webhook
      terminationGracePeriodSeconds: 10
---

[Copilot]

Pull Request Overview

This PR adds webhook server support for the ingress controller Helm chart, enabling admission webhook functionality to validate Kubernetes resources. The changes introduce comprehensive webhook configuration options, certificate management, and integration with the deployment.

• Adds webhook configuration section to values.yaml with options for enabling, port, failure policy, timeout, and certificate management
• Creates webhook template with ValidatingWebhookConfiguration for multiple resource types (routes, consumers, TLS, gateway proxies, ingresses, etc.)
• Updates deployment to mount webhook certificates and expose webhook port when enabled
• Modifies RBAC permissions to support webhook operations

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
charts/ingress-controller/values.yaml	Adds webhook configuration section with enable flag, port, policies, and certificate options
charts/ingress-controller/templates/webhook.yaml	Creates new webhook template with ValidatingWebhookConfiguration, Service, and Secret resources
charts/ingress-controller/templates/deployment.yaml	Updates deployment to mount webhook certificates and expose webhook port conditionally
charts/ingress-controller/templates/configmap.yaml	Adds webhook configuration to the config map when webhook is enabled
charts/ingress-controller/templates/cluster_role.yaml	Reorganizes RBAC permissions and adds new resource access patterns
charts/ingress-controller/README.md	Documents new webhook configuration parameters

Comments suppressed due to low confidence (1)

charts/ingress-controller/templates/webhook.yaml:1

• When webhook.certificate.provided is true, the code references a hardcoded secret name, but the values.yaml suggests users should provide their own secretName. The template should use .Values.webhook.certificate.secretName when provided is true.

{{- if .Values.webhook.enabled }}

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[AlinsRan]

I suggest moving the ports field outside the conditional block.
If ports is wrapped within the webhook.enabled condition, future contributors adding new container ports might overlook the conditional logic, which could lead to missing or inconsistent port configurations.

[ronething]

ok, i will update it later.