boxcutter webhook support

Signed-off-by: Joe Lanford <[email protected]>

Author: joelanford

cmd/operator-controller/main.go

@@ -443,7 +443,7 @@ func run() error {
 	// create applier
 	var ctrlBuilderOpts []controllers.ControllerBuilderOption
 	var extApplier controllers.Applier
-
+	certProvider := getCertificateProvider()
 	if features.OperatorControllerFeatureGate.Enabled(features.BoxcutterRuntime) {
 		// TODO: add support for preflight checks
 		// TODO: better scheme handling - which types do we want to support?
@@ -454,14 +454,14 @@ func run() error {
 			RevisionGenerator: &applier.SimpleRevisionGenerator{
 				Scheme: mgr.GetScheme(),
 				BundleRenderer: &applier.RegistryV1BundleRenderer{
-					BundleRenderer: registryv1.Renderer,
+					BundleRenderer:      registryv1.Renderer,
+					CertificateProvider: certProvider,
 				},
 			},
 		}
 		ctrlBuilderOpts = append(ctrlBuilderOpts, controllers.WithOwns(&ocv1.ClusterExtensionRevision{}))
 	} else {
 		// now initialize the helmApplier, assigning the potentially nil preAuth
-		certProvider := getCertificateProvider()
 		extApplier = &applier.Helm{
 			ActionClientGetter: acg,
 			Preflights:         preflights,

internal/operator-controller/applier/boxcutter.go

@@ -223,17 +223,23 @@ type BundleRenderer interface {
 }
 
 type RegistryV1BundleRenderer struct {
-	BundleRenderer render.BundleRenderer
+	BundleRenderer      render.BundleRenderer
+	CertificateProvider render.CertificateProvider
 }
 
 func (r *RegistryV1BundleRenderer) Render(bundleFS fs.FS, ext *ocv1.ClusterExtension) ([]client.Object, error) {
 	reg, err := source.FromFS(bundleFS).GetBundle()
 	if err != nil {
 		return nil, err
 	}
+
+	if len(reg.CSV.Spec.WebhookDefinitions) > 0 && r.CertificateProvider == nil {
+		return nil, fmt.Errorf("unsupported bundle: webhookDefinitions are not supported")
+	}
+
 	watchNamespace, err := GetWatchNamespace(ext)
 	if err != nil {
 		return nil, err
 	}
-	return r.BundleRenderer.Render(reg, ext.Spec.Namespace, render.WithTargetNamespaces(watchNamespace))
+	return r.BundleRenderer.Render(reg, ext.Spec.Namespace, render.WithTargetNamespaces(watchNamespace), render.WithCertificateProvider(r.CertificateProvider))
 }