[diw-zw]

Ⅰ. Motivation

Ⅱ. Modifications

Ⅲ. Does this pull request fix one issue?

fixes #XXXX

Ⅳ. List the added test cases (unit test/integration test) if any, please explain if no tests are needed.

Ⅴ. Describe how to verify it

VI. Special notes for reviews

Checklist

• Format your code make fmt.
• Add unit tests or integration tests.
• Update the documentation related to the change.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[Copilot]

Pull request overview

This PR introduces a v1alpha2 conversion webhook (with self-signed TLS bootstrap) to enable v1alpha1 ⇄ v1alpha2 conversions for core Workloads APIs, and adds migration glue to preserve/translate fields that don’t have direct schema equivalents.

Changes:

• Add self-signed webhook certificate generation/storage and CRD caBundle patching (startup + controller).
• Enable conversion webhook wiring in Kustomize/Helm (Service, CRD conversion patches, manager args, RBAC, CRD upgrade hook patching).
• Implement v1alpha1 conversion logic (RoleBasedGroup/RoleBasedGroupSet) with extensive unit tests; adjust e2e/envtest utilities for new labels/scheme.

Reviewed changes

Copilot reviewed 44 out of 44 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
tools/crd-upgrade/ensure-crds-up-to-date.sh	Adds CRD conversion webhook patching after CRD create/replace.
tools/crd-upgrade/Dockerfile	Keeps kubectl installation with checksum; updates comments.
test/utils/utils.go	Switches pod label selectors to shared constants keys.
test/envtest/testutil/setup.go	Registers v1alpha2 types in envtest scheme.
test/e2e/testcase/v1alpha1/scaling_adapter.go	Adjusts scaling adapter test role set (InstanceSet roles commented).
test/e2e/testcase/v1alpha1/roletemplate.go	Uses constants label keys; fetches live RBG before listing revisions.
test/e2e/testcase/v1alpha1/revision.go	Uses constants for role revision label format.
test/e2e/testcase/v1alpha1/rbg.go	Marks volcano gang scheduling case as pending.
test/e2e/testcase/v1alpha1/debug.go	Uses constants label keys when listing RBGs/pods.
test/e2e/framework/workloads/workload_expect.go	Uses constants for group-unique-hash label comparisons.
test/e2e/framework/revision_expect.go	Uses constants label keys and fetches live objects for UID-sensitive checks.
test/e2e/framework/rbgs_expect.go	Uses constants for GroupSet label keys when listing children.
test/e2e/framework/rbg_expect.go	Uses constants role revision label fmt and group-name label.
test/e2e/e2e_test.go	Enables v1alpha1 e2e suite by removing suite-level pending.
pkg/webhook/certmanager.go	New cert manager to ensure certs exist and patch CRD caBundle.
pkg/webhook/cert/writer/certwriter.go	New Secret-backed cert writer and filesystem cert materializer.
pkg/webhook/cert/writer/certwriter_test.go	Unit tests for Secret creation/renewal and file permissions.
pkg/webhook/cert/generator/selfsigned.go	Self-signed CA/server cert generator + validation helpers.
pkg/webhook/cert/generator/selfsigned_test.go	Unit tests for cert generation/verification behavior.
internal/controller/workloads/webhook_cert_controller.go	Controller to keep conversion CRDs’ caBundle in sync.
internal/controller/workloads/rolebasedgroup_controller.go	Adds v1alpha1 coordination migration step during reconcile.
internal/controller/workloads/coordinatedpolicy_migration_controller.go	Compatibility logic: apply CoordinatedPolicy from conversion annotation.
internal/controller/workloads/coordinatedpolicy_migration_controller_test.go	Unit tests for coordinated policy migration behavior.
deploy/helm/rbgs/templates/webhook-service.yaml	Adds Helm Service for webhook endpoint.
deploy/helm/rbgs/templates/upgrade/crd-upgrade.yaml	Sets webhook env vars for CRD conversion patching in upgrade job.
deploy/helm/rbgs/templates/manager.yaml	Adds webhook/cert args and POD_NAMESPACE env; adds imagePullSecrets blocks.
deploy/helm/rbgs/templates/clusterrole.yaml	Grants CRD patch + Secret permissions needed for webhook cert management.
config/webhook/service.yaml	Adds Kustomize webhook Service manifest.
config/webhook/kustomization.yaml	Adds Kustomize webhook component kustomization.
config/rbac/role.yaml	Extends RBAC for CRD patching and Secret management (webhook certs).
config/manager/manager.yaml	Adds manager args/env for webhook cert bootstrap and service targeting.
config/default/kustomization.yaml	Enables webhook component and adds replacements for service name/namespace into args.
config/crd/patches/webhook_in_rolebasedgroups.yaml	Adds conversion webhook patch for RoleBasedGroup CRD.
config/crd/patches/webhook_in_rolebasedgroupsets.yaml	Adds conversion webhook patch for RoleBasedGroupSet CRD.
config/crd/kustomization.yaml	Includes additional CRDs and enables webhook CRD patch/config sections.
cmd/rbgs/main.go	Adds webhook cert bootstrap, CRD caBundle patching, and webhook registration.
api/workloads/v1alpha2/rolebasedgroup_webhook.go	Adds webhook setup for RoleBasedGroup + RoleBasedGroupSet.
api/workloads/v1alpha2/rolebasedgroup_conversion.go	Marks RoleBasedGroup and RoleBasedGroupSet as conversion hubs.
api/workloads/v1alpha1/rolebasedgroup_conversion.go	Implements v1alpha1⇄v1alpha2 conversions + annotation-based lossy-field preservation.
api/workloads/v1alpha1/rolebasedgroup_conversion_test.go	Extensive conversion round-trip/unit tests for RoleBasedGroup.
api/workloads/v1alpha1/rolebasedgroupset_conversion.go	Implements v1alpha1⇄v1alpha2 conversions for RoleBasedGroupSet.
api/workloads/v1alpha1/rolebasedgroupset_conversion_test.go	Unit tests for RoleBasedGroupSet conversion behavior.
Makefile	Expands go test scope to include ./api/...; adds multi-arch build args; uses server-side apply for deploy.
Dockerfile	Normalizes stage keyword casing (AS builder).

Comments suppressed due to low confidence (1)

tools/crd-upgrade/Dockerfile:26

• The comment says kubectl is installed using an Aliyun mirror, but the Dockerfile still downloads from https://dl.k8s.io/.... Either update the comment to match the actual install source, or switch the download URL/repo to the mirror being documented.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Syspretor]

/lgtm

[Copilot]

Pull request overview

Adds v1alpha2 conversion webhook support (including self-signed TLS bootstrap + CRD caBundle management) and introduces a v1alpha1→v1alpha2 coordination migration path via a CoordinatedPolicy compatibility controller, along with accompanying manifest/RBAC/test updates.

Changes:

• Bootstrap and manage self-signed webhook certificates; patch CRD conversion caBundle and ensure CRDs have conversion webhook clientConfig.
• Add v1alpha1↔v1alpha2 conversion implementations (RoleBasedGroup/RoleBasedGroupSet) and a migration controller to materialize CoordinatedPolicy from preserved v1alpha1 coordination annotations.
• Update kustomize/helm manifests and tests (envtest/e2e) to enable the webhook and align label/annotation keys with shared constants.

Reviewed changes

Copilot reviewed 53 out of 53 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
tools/crd-upgrade/ensure-crds-up-to-date.sh	Installs/replaces CRDs and patches conversion webhook clientConfig during upgrade.
tools/crd-upgrade/Dockerfile	Builds CRD-upgrade image; retains kubectl checksum verification and adds CN-mirror notes.
test/utils/utils.go	Updates pod selection label key to shared constants.
test/envtest/testutil/setup.go	Registers v1alpha2 types into envtest scheme.
test/e2e/testcase/v1alpha1/scaling_adapter.go	Adjusts v1alpha1 scaling-adapter test coverage (removes InstanceSet cases).
test/e2e/testcase/v1alpha1/roletemplate.go	Uses constants-based labels and fetches live RBG before listing revisions.
test/e2e/testcase/v1alpha1/revision.go	Updates revision label keys and relaxes a generation assertion.
test/e2e/testcase/v1alpha1/rbg.go	Marks volcano gang scheduling case as pending.
test/e2e/testcase/v1alpha1/debug.go	Uses constants-based labels for debug listing/selectors.
test/e2e/framework/workloads/workload_expect.go	Switches affinity label checks to constants key.
test/e2e/framework/revision_expect.go	Uses live UID for revision filtering; switches revision label keys to constants.
test/e2e/framework/rbgs_expect.go	Switches set label selector to constants key.
test/e2e/framework/rbg_expect.go	Switches role revision label key format and group name label key to constants.
test/e2e/e2e_test.go	Enables v1alpha1 e2e suite (removes ginkgo.Pending).
pkg/webhook/certmanager.go	Adds CertManager to generate/write certs and patch CRD caBundle with retries.
pkg/webhook/cert/writer/writer_suite_test.go	Adds Ginkgo suite setup for cert writer tests.
pkg/webhook/cert/writer/secret.go	Implements Secret-backed cert writer (read/write/overwrite).
pkg/webhook/cert/writer/secret_writer.go	Adds Secret CRUD helpers used by cert writer.
pkg/webhook/cert/writer/fs.go	Writes cert artifacts to filesystem for webhook server consumption.
pkg/webhook/cert/writer/certwriter.go	Adds cert validation/rotation logic and common writer flow.
pkg/webhook/cert/writer/certwriter_test.go	Adds unit tests for cert writer flow and cert validation behavior.
pkg/webhook/cert/generator/util.go	Adds helper for validating CA/cert/key material.
pkg/webhook/cert/generator/selfsigned.go	Implements self-signed CA + serving cert generation utilities.
pkg/webhook/cert/generator/certgenerator.go	Defines cert artifacts and generator interface.
Makefile	Expands test scope to ./api/..., adds e2e timeout, adds build args, and uses server-side apply for deploy.
internal/controller/workloads/webhook_cert_controller.go	Adds controller to keep conversion CRDs’ caBundle in sync.
internal/controller/workloads/rolebasedgroup_controller.go	Adds coordinatedpolicy migration step; preserves RestartInProgress condition by fetching latest RBG.
internal/controller/workloads/coordinatedpolicy_migration_controller.go	Creates/updates CoordinatedPolicy from v1alpha1 coordination annotation (compat layer).
internal/controller/workloads/coordinatedpolicy_migration_controller_test.go	Adds unit tests for the coordination→CoordinatedPolicy migration logic.
Dockerfile	Minor Dockerfile syntax/style update (AS builder).
deploy/helm/rbgs/templates/webhook-service.yaml	Adds webhook Service for Helm deployments.
deploy/helm/rbgs/templates/upgrade/crd-upgrade.yaml	Passes webhook namespace/service env vars into CRD upgrade job.
deploy/helm/rbgs/templates/secret-role.yaml	Adds namespaced Role/RoleBinding for webhook cert Secret access in Helm.
deploy/helm/rbgs/templates/manager.yaml	Injects POD_NAMESPACE env into controller Deployment (Helm).
deploy/helm/rbgs/templates/clusterrole.yaml	Adds patch verb (needed for CRD patching).
config/webhook/service.yaml	Adds webhook Service manifest for kustomize deployments.
config/webhook/kustomization.yaml	Includes webhook Service in kustomize resources.
config/rbac/secret_role.yaml	Adds namespaced Role for Secret create/get/update (kustomize).
config/rbac/secret_role_binding.yaml	Binds Secret Role to controller ServiceAccount (kustomize).
config/rbac/role.yaml	Adds patch verb for CRDs in controller ClusterRole.
config/rbac/kustomization.yaml	Includes secret Role/RoleBinding in RBAC kustomization.
config/manager/manager.yaml	Injects POD_NAMESPACE env into controller Deployment (kustomize).
config/default/kustomization.yaml	Enables webhook resources and adds replacements intended to propagate Service name/namespace.
config/crd/patches/webhook_in_rolebasedgroupsets.yaml	Adds conversion webhook patch for RoleBasedGroupSet CRD (kustomize).
config/crd/patches/webhook_in_rolebasedgroups.yaml	Adds conversion webhook patch for RoleBasedGroup CRD (kustomize).
config/crd/kustomization.yaml	Adds CRDs to resources list and enables conversion webhook patches/configuration.
cmd/rbgs/main.go	Bootstraps webhook certs, patches CRD caBundle, registers conversion webhooks, and starts cert sync controller.
api/workloads/v1alpha2/rolebasedgroup_webhook.go	Registers conversion webhooks for RoleBasedGroup and RoleBasedGroupSet.
api/workloads/v1alpha2/rolebasedgroup_conversion.go	Marks both RoleBasedGroup and RoleBasedGroupSet as conversion hubs.
api/workloads/v1alpha1/rolebasedgroupset_conversion.go	Adds RoleBasedGroupSet v1alpha1↔v1alpha2 conversion logic.
api/workloads/v1alpha1/rolebasedgroupset_conversion_test.go	Adds conversion unit tests for RoleBasedGroupSet.
api/workloads/v1alpha1/rolebasedgroup_conversion.go	Adds RoleBasedGroup v1alpha1↔v1alpha2 conversion logic, including lossy-field preservation.
api/workloads/v1alpha1/rolebasedgroup_conversion_test.go	Adds conversion unit tests for RoleBasedGroup, incl. lossy-field preservation and round-trips.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.