Drop hardcoded namespaces, fix install via kubectl apply

Tested end-to-end against a local kind cluster and found several real
issues that this commit cleans up:

- Resources no longer hardcode "namespace: system"; the namespace is set
  in one place (the overlay) via kustomize's namespace transform.
  Consumers can override via Flux's targetNamespace or by editing the
  overlay.
- The webhook serving cert mount moves into base/manager/manager.yaml
  with the secret marked optional, so consumers composing base/manager
  directly (e.g. a future cross-cluster overlay) get the mount for free
  and don't crash if they're running webhook-less.
- A new base/webhook/kustomizeconfig.yaml teaches kustomize about the
  webhook clientConfig.service.{name,namespace} field paths, so the
  namespace transform handles them automatically rather than needing
  per-overlay replacements.
- The Certificate's dnsNames now use SERVICE_NAME / SERVICE_NAMESPACE
  placeholders (the kubebuilder pattern) and the overlay substitutes
  them via replacements pulling from the webhook Service.
- Drops a stale --metrics-bind-address arg patch that referenced a CLI
  flag the binary no longer accepts (metrics config moved into the
  WorkloadOperator config struct).
- Drops an orphaned metrics_service.yaml from the overlay that wasn't
  referenced from kustomization.yaml.
- The default config.yaml now includes a webhookServer block so the
  bundle deploys a working webhook out of the box. Consumers running
  hermetic without webhooks can omit it (the binary skips the webhook
  server entirely when the field is nil).

Verified end-to-end: manager pod 1/1 Running, Certificate ready,
admission webhook serving and being called by the apiserver.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: scotwells

config/base/certmanager/certificate.yaml

@@ -1,33 +1,26 @@
-# The following manifests contain a self-signed issuer CR and a certificate CR.
-# More document can be found at https://docs.cert-manager.io
-# WARNING: Targets CertManager v1.0. Check https://cert-manager.io/docs/installation/upgrading/ for breaking changes.
 apiVersion: cert-manager.io/v1
 kind: Issuer
 metadata:
   labels:
     app.kubernetes.io/name: compute
     app.kubernetes.io/managed-by: kustomize
   name: selfsigned-issuer
-  namespace: system
 spec:
   selfSigned: {}
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   labels:
-    app.kubernetes.io/name: certificate
-    app.kubernetes.io/instance: serving-cert
-    app.kubernetes.io/component: certificate
-    app.kubernetes.io/created-by: compute
-    app.kubernetes.io/part-of: compute
+    app.kubernetes.io/name: compute
     app.kubernetes.io/managed-by: kustomize
   name: compute-serving-cert
-  namespace: system
 spec:
+  # The Service name and namespace get substituted in by kustomize
+  # replacements in the consuming overlay.
   dnsNames:
-  - compute-webhook.system.svc
-  - compute-webhook.system.svc.cluster.local
+  - SERVICE_NAME.SERVICE_NAMESPACE.svc
+  - SERVICE_NAME.SERVICE_NAMESPACE.svc.cluster.local
   issuerRef:
     kind: Issuer
     name: selfsigned-issuer

config/base/manager/config.yaml

@@ -2,3 +2,4 @@ apiVersion: apiserver.config.datumapis.com/v1alpha1
 kind: WorkloadOperator
 metricsServer:
   bindAddress: "0"
+webhookServer: {}

config/base/manager/manager.yaml

@@ -30,6 +30,10 @@ spec:
           - --server-config=/config/config.yaml
         image: ghcr.io/datum-cloud/compute:latest
         name: manager
+        ports:
+        - containerPort: 9443
+          name: webhook-server
+          protocol: TCP
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
@@ -57,9 +61,20 @@ spec:
         volumeMounts:
         - name: config
           mountPath: /config
+        - name: webhook-cert
+          mountPath: /tmp/k8s-webhook-server/serving-certs
+          readOnly: true
       serviceAccountName: compute
       terminationGracePeriodSeconds: 10
       volumes:
       - name: config
         configMap:
           name: compute-config
+      # Optional so the manager can run without admission webhooks: when
+      # `webhookServer:` is omitted from the server config, the binary
+      # skips the webhook server entirely and the missing Secret is fine.
+      - name: webhook-cert
+        secret:
+          secretName: compute-webhook-cert
+          defaultMode: 420
+          optional: true

config/base/webhook/kustomization.yaml

@@ -7,6 +7,11 @@ resources:
 # can use static `compute-*` references.
 - manifests.yaml
 
+# Teach kustomize about the webhook clientConfig.service.{name,namespace}
+# field paths so the namespace transform handles them automatically.
+configurations:
+- kustomizeconfig.yaml
+
 patches:
 - patch: |-
     - op: replace

config/base/webhook/kustomizeconfig.yaml

@@ -0,0 +1,23 @@
+# Teach kustomize that webhook clientConfig.service.namespace and .name
+# point at a Service, so the namespace transform and name reference handling
+# rewrite them automatically when an overlay sets `namespace:`.
+namespace:
+- path: webhooks/clientConfig/service/namespace
+  kind: ValidatingWebhookConfiguration
+  group: admissionregistration.k8s.io
+  create: false
+- path: webhooks/clientConfig/service/namespace
+  kind: MutatingWebhookConfiguration
+  group: admissionregistration.k8s.io
+  create: false
+
+nameReference:
+- kind: Service
+  version: v1
+  fieldSpecs:
+  - kind: ValidatingWebhookConfiguration
+    group: admissionregistration.k8s.io
+    path: webhooks/clientConfig/service/name
+  - kind: MutatingWebhookConfiguration
+    group: admissionregistration.k8s.io
+    path: webhooks/clientConfig/service/name

config/components/controller_rbac/metrics_auth_role_binding.yaml

@@ -9,4 +9,3 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: compute
-  namespace: system

config/components/controller_rbac/role_binding.yaml

@@ -12,4 +12,3 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: compute
-  namespace: system

config/components/leader_election/leader_election_role_binding.yaml

@@ -12,4 +12,3 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: compute
-  namespace: system

config/components/network-policy/allow-metrics-traffic.yaml

@@ -8,7 +8,6 @@ metadata:
     app.kubernetes.io/name: compute
     app.kubernetes.io/managed-by: kustomize
   name: compute-allow-metrics-traffic
-  namespace: system
 spec:
   podSelector:
     matchLabels:

config/components/network-policy/allow-webhook-traffic.yaml

@@ -8,7 +8,6 @@ metadata:
     app.kubernetes.io/name: compute
     app.kubernetes.io/managed-by: kustomize
   name: compute-allow-webhook-traffic
-  namespace: system
 spec:
   podSelector:
     matchLabels: