[arosh]

Summary

• Keep ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding cluster-scoped in Kustomize output.
• Remove the unused MySQLCluster CRD conversion webhook configuration from the Helm chart.
• Require Kubernetes 1.30 or later for the admissionregistration.k8s.io/v1 policy API.

Context

Kustomize previously added a namespace to cluster-scoped admission policies. The Helm generation step removed it as a workaround, so raw Kustomize output and Helm output did not match. Kustomize 5.8.3 includes a fix for these resource types, which makes the workaround unnecessary.

The MySQLCluster CRD declared a conversion webhook only in the Helm chart, even though MOCO serves only v1beta2 and does not register a conversion handler for a single API version. Keeping this declaration could make the chart depend on a conversion endpoint that it does not use.

The chart also allowed Kubernetes versions earlier than the release's ValidatingAdmissionPolicy API requirement.

Implementation

• Upgrade Kustomize to 5.8.3 and regenerate the Helm templates without the namespace-removal filter.
• Remove the Helm-only CRD conversion configuration while keeping the cert-manager CA injection annotation.
• Set the Helm chart's minimum Kubernetes version to 1.30 and document the requirement.