🌱 Let disable webhooks

[enxebre]

What this PR does / why we need it:
This change made webhooks to always run as part of the manager.

I'd like to keep the ability to disable running webhooks. Motivation is as adopting and building atop CAPI I’d like to do so gradually, going all in once with webhooks increase complexisty and resistance.

Also this is necessary to support other type than single controller deployments and should be part of this contract https://master.cluster-api.sigs.k8s.io/developer/architecture/controllers/support-multiple-instances.html#contract

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign fabriziopandini after the PR has been reviewed.
You can assign the PR to them by writing /assign @fabriziopandini in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[enxebre]

@fabriziopandini @vincepri @CecileRobertMichon @JoelSpeed @sbueringer would you have any objection to get this into v1alpha4?

[vincepri]

If we do go forward with this change, I'd like to propose that we add a new flag like --disable-webhook or similar. Also the flags need to be propagate on all managers within this repository.

Thinking about it a bit more, even if the webhooks are registered and the server is running, if the service isn't registered within the CRDs or yaml definition truthfully the code won't run.

Motivation is as adopting and building atop CAPI I’d like to do so gradually, going all in once with webhooks increase complexisty and resistance

Webhooks code is treated as part of the codebase, and it's important that it runs on the same version as the manager.

[enxebre]

Thinking about it a bit more, even if the webhooks are registered and the server is running, if the service isn't registered within the CRDs or yaml definition truthfully the code won't run.

@vincepri I also thought about this, the only drawback I can think of is you still need to provide a tls cert for the webhook server to not break the manager. Is there anything else you can think of? otherwise I think that's ok to satisfy https://master.cluster-api.sigs.k8s.io/developer/architecture/controllers/support-multiple-instances.html#contract

[vincepri]

Wouldn't cert-manager generate the certs for you?

[enxebre]

As discussed, there's no strict requirement to expose the webhooks CRs which would satisfy the contract above
/close

[k8s-ci-robot]

@enxebre: Closed this PR.

In response to this:

As discussed, there's no strict requirement to expose the webhooks CRs which would satisfy the contract above
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.