fix: make the kustomize manifests deployable and consistent

.github/workflows/kustomize-checker.yml

@@ -0,0 +1,117 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Kustomize Checker
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      manifests: ${{ steps.filter.outputs.manifests }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - uses: ./.github/actions/paths-filter
+        id: filter
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          filters: |
+            manifests:
+              - 'config/**'
+              - 'api/**'
+              - 'Makefile'
+              - '.github/workflows/kustomize-checker.yml'
+
+  kustomize-checker:
+    needs: changes
+    if: |
+      (needs.changes.outputs.manifests == 'true')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Go Env
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.26"
+
+      - name: Install kind
+        run: |
+          go install sigs.k8s.io/kind@v0.27.0
+
+      - name: Build the installer
+        run: |
+          make build-installer
+          test -s dist/install.yaml
+
+      # The CRDs and the webhook configuration are generated from the Go types.
+      # config/rbac/role.yaml is excluded: it carries a pre-existing rule
+      # ordering difference against the pinned controller-gen.
+      - name: Check generated manifests are up to date
+        run: |
+          if ! git diff --exit-code -- config/crd/bases config/webhook/manifests.yaml; then
+            echo "::error::config/crd/bases or config/webhook/manifests.yaml is out of date, run 'make manifests' and commit the result"
+            exit 1
+          fi
+
+      - name: Build every kustomization
+        run: |
+          ./bin/kustomize build config/crd > /dev/null
+          ./bin/kustomize build config/samples > dist/samples.yaml
+          test -s dist/samples.yaml
+
+      - name: Launch Kind Cluster
+        run: |
+          make kind-up
+
+      # A server-side apply validates every rendered object against the API
+      # server, including the CRD schemas themselves.
+      - name: Apply the installer
+        run: |
+          set -o pipefail
+          kubectl apply --server-side -f dist/install.yaml
+          crds=$(kubectl get crd -o name | grep 'apisix\.apache\.org$')
+          test -n "$crds"
+          echo "$crds" | xargs kubectl wait --for=condition=Established --timeout=60s
+
+      # The samples are validated against the CRDs installed above, so a sample
+      # that misses a required field or violates a CEL rule fails here.
+      - name: Validate the samples against the installed CRDs
+        run: |
+          kubectl apply --server-side --dry-run=server -f dist/samples.yaml
+
+      - name: Tear down Kind Cluster
+        if: always()
+        run: |
+          make kind-down

config/certmanager/kustomization.yaml

@@ -1,7 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
 resources:
 - issuer.yaml
 - certificate-webhook.yaml
-- certificate-metrics.yaml
 
 configurations:
 - kustomizeconfig.yaml

config/crd/kustomization.yaml

@@ -1,21 +1,25 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
 # This kustomization.yaml is not intended to be run by itself,
 # since it depends on service name and namespace that are out of this kustomize package.
 # It should be run by config/default
 resources:
-- bases/apisix.apache.org_pluginconfigs.yaml
-- bases/apisix.apache.org_gatewayproxies.yaml
-- bases/apisix.apache.org_consumers.yaml
-- bases/apisix.apache.org_backendtrafficpolicies.yaml
-- bases/apisix.apache.org_httproutepolicies.yaml
-- bases/apisix.apache.org_l4routepolicies.yaml
-- bases/apisix.apache.org_apisixroutes.yaml
 - bases/apisix.apache.org_apisixconsumers.yaml
 - bases/apisix.apache.org_apisixglobalrules.yaml
+- bases/apisix.apache.org_apisixpluginconfigs.yaml
+- bases/apisix.apache.org_apisixroutes.yaml
 - bases/apisix.apache.org_apisixtlses.yaml
 - bases/apisix.apache.org_apisixupstreams.yaml
-- bases/apisix.apache.org_apisixpluginconfigs.yaml
+- bases/apisix.apache.org_backendtrafficpolicies.yaml
+- bases/apisix.apache.org_consumers.yaml
+- bases/apisix.apache.org_gatewayproxies.yaml
+- bases/apisix.apache.org_httproutepolicies.yaml
+- bases/apisix.apache.org_l4routepolicies.yaml
+- bases/apisix.apache.org_pluginconfigs.yaml
 # +kubebuilder:scaffold:crdkustomizeresource
 
+# Schema validations that controller-gen cannot express through markers.
 patches:
 - path: patches/consumer_credential_oneof.yaml
   target:
@@ -29,19 +33,9 @@ patches:
     name: apisixconsumers.apisix.apache.org
     group: apiextensions.k8s.io
     version: v1
-# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
-# patches here are for enabling the conversion webhook for each CRD
-#- path: patches/webhook_in_gatewayproxies.yaml
 # +kubebuilder:scaffold:crdkustomizewebhookpatch
-
-# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix.
-# patches here are for enabling the CA injection for each CRD
-#- path: patches/cainjection_in_guestbooks.yaml
-#- path: patches/cainjection_in_gatewayproxies.yaml
 # +kubebuilder:scaffold:crdkustomizecainjectionpatch
 
-# [WEBHOOK] To enable webhook, uncomment the following section
-# the following config is for teaching kustomize how to do kustomization for CRDs.
-
+# Teaches kustomize how to substitute name references inside CRDs.
 configurations:
 - kustomizeconfig.yaml