fix: short-circuit cert-rotation reconciler under USE_OLM_TLS

[chengjingtao]

Summary

Follow-up to #25 (using olm cert) and #29 (restore #25 after vuln-0512). Same pattern (early-return on USE_OLM_TLS), applied to the third knative.dev/pkg/webhook/ component that wasn't covered, with a companion hack/patches/ file so the next go mod vendor doesn't wipe it.

What

1. vendor/knative.dev/pkg/webhook/certificates/certificates.go — adds at the top of reconcileCertificate:

   if os.Getenv("USE_OLM_TLS") != "" { // olm manages cert rotation
       return nil
   }

   Mirrors PR fix: using olm cert #25's pattern in vendor/knative.dev/pkg/webhook/resourcesemantics/conversion/reconciler.go.

2. hack/patches/008-certificates-reconciler.patch — companion patch file, sibling of the existing 006-conversion-webhook.patch / 007-conversion-reconciler.patch from PR fix: using olm cert #25. Reapplied by make update-deps (= git apply hack/patches/*.patch) after any go mod vendor run, so this fix can't get silently dropped the way PR fix: using olm cert #25's vendor edits were dropped by PR fix: vuln 0512 #28's vuln-0512 sweep.

   Verified by round-trip: revert vendor file to 34c2b0fe, git apply hack/patches/008-certificates-reconciler.patch → guard restored.

Why

The WebhookCertificates reconciler is the third component in knative.dev/pkg/webhook/ that touches the webhook cert secret. PR #25 patched the other two (TLS-read in webhook.go, CRD caBundle sync in conversion/reconciler.go) but left the cert-rotation reconciler alone.

In OLM mode the reconciler:

1. Reads the OLM-provisioned secret (type kubernetes.io/tls, keys tls.crt / tls.key / olmCAKey).
2. Logs Certificate secret "operator-webhook-service-cert" is missing key "server-key.pem" at INFO (line 78) — its expected key names don't match what OLM populates.
3. Self-signs a new cert via certresources.MakeSecret, which only emits server-cert.pem / server-key.pem / ca-cert.pem.
4. Replaces secret.Data wholesale — would clobber OLM's tls.crt / tls.key.
5. Sends the Update — apiserver rejects on type validation: Reconcile error ... Secret ... is invalid: [data[tls.crt]: Required value, data[tls.key]: Required value].
6. Exponential-backoff retries forever; secret never converges.

Observed on the test cluster running #29's webhook image v1.10.1-34c2b0fe against the OLM-installed bundle knative-operator-bundle:v3.20.9-hotfix.129.6.gddf86032-fix-vuln-0512:

operator-webhook.WebhookCertificates  certificates/certificates.go:78
  "Certificate secret \"operator-webhook-service-cert\" is missing key \"server-key.pem\""
operator-webhook.WebhookCertificates  controller/controller.go:566
  Reconcile error ... Secret "operator-webhook-service-cert" is invalid:
  [data[tls.crt]: Required value, data[tls.key]: Required value]

Functionally harmless — apiserver's type validation is what prevents the reconciler from corrupting OLM's cert — but the log spam runs continuously (every few seconds to every minute) and hides real issues. The webhook itself reads certs via #25's patched GetCertificate and serves correctly.

Verify after merge

After rebuilding + rolling the bundle, the two log signatures above should both disappear, and operator-webhook.WebhookCertificates should fall silent in OLM-installed clusters. Standalone (non-OLM) installs are unaffected — USE_OLM_TLS is unset, so the reconciler runs as before.

Note on commit history

This PR's branch ended up with three commits because of an intermediate test workflow that staged an unintended revert. Net branch diff is +28 lines across two files (the 5-line vendor edit + the 23-line patch file). Recommend squash on merge.

🤖 Generated with Claude Code