fix: restore USE_OLM_TLS vendor patches dropped by vuln-0512

[chengjingtao]

Summary

Re-applies PR #25 (fix: using olm cert) on top of PR #28 (fix: vuln 0512, commit c861803). PR #28 ran go mod tidy + go mod vendor and the vendor regeneration silently reverted PR #25's manual patches to:

• vendor/knative.dev/pkg/webhook/webhook.go
• vendor/knative.dev/pkg/webhook/resourcesemantics/conversion/reconciler.go

Why

Tested on an ACP cluster with the knative-operator.v3.20.9-hotfix.129.4.gd71ba5e5-fix-vuln-0512 CSV (webhook:v1.10.1-c861803b). operator-webhook Pod is 0/1 Running, log loops:

operator-webhook   webhook/webhook.go:194   "server key missing"
operator-webhook   webhook/webhook.go:245   http: TLS handshake error from ...: tls: no certificates configured
operator-webhook.WebhookCertificates  certificates/certificates.go:78  Certificate secret "operator-webhook-service-cert" is missing key "server-key.pem"
operator-webhook.WebhookCertificates  controller/controller.go:566  Reconcile error  Secret "operator-webhook-service-cert" is invalid: [data[tls.crt]: Required value, data[tls.key]: Required value]
operator-webhook.ConversionWebhook    controller/controller.go:566  Reconcile error  secret "operator-webhook-service-cert" is missing "ca-cert.pem" key

OLM is populating operator-webhook-service-cert (type kubernetes.io/tls) with tls.crt / tls.key / olmCAKey, and the deployment sets USE_OLM_TLS=true + WEBHOOK_SECRET_NAME=operator-webhook-service-cert. But the binary in c861803 has no USE_OLM_TLS code path — the vendor patches that introduced it were gone.

I verified the regression by fetching vendor/knative.dev/pkg/webhook/webhook.go at c861803 via gh api: no USE_OLM_TLS, no tls.key/tls.crt branch. The diff in this PR is byte-for-byte the same as PR #25's diff.

Follow-up (not in this PR)

Manual vendor patches will keep getting dropped by future go mod vendor runs (e.g. the next vuln-fix sweep). Recommend moving the OLM TLS support into a fork of knative.dev/pkg (e.g. AlaudaDevops/knative.dev.pkg or katanomi/knative-pkg) and pinning via replace in go.mod, so the patches survive vendor regeneration.

Test plan

• Build a hotfix image from this branch
• Reinstall the operator on the test cluster
• Confirm operator-webhook Pod is 1/1 Running, no server key missing / tls: no certificates configured in logs
• Confirm ConversionWebhook reconciles cleanly (no operator-webhook-service-cert is missing "ca-cert.pem" key errors)

🤖 Generated with Claude Code