Fix: Preserve webhook caBundle during failed Helm upgrades

[roguepikachu]

Description of your changes

Prevent vela-workflow Helm installs and upgrades from leaving ValidatingWebhookConfiguration / MutatingWebhookConfiguration in a broken state with a placeholder caBundle: Cg==.

Problem

The Helm chart deploys webhook configurations with a hardcoded placeholder caBundle: Cg== and relies on a post-install/post-upgrade Job to patch the real CA bundle. If Helm fails before the patch Job completes (timeout, image pull error, controller CrashLoopBackOff with --wait, etc.), the webhooks persist with an invalid caBundle — silently bypassing admission validation.

Fix (mirrors kubevela/kubevela#6919)

1. Preserve existing caBundle with Helm lookup — on upgrade, the webhook templates read the existing resource from the cluster and reuse its caBundle instead of overwriting with Cg==. Falls back to Cg== only on fresh install (expected; the patch Job handles it).

2. Add post-rollback hook — the patch Job and its RBAC resources now also run after Helm rollbacks to restore the caBundle.

---

Checklist

• Read and followed KubeVela's contribution process
• Related Docs updated properly (for new features or configuration options)
• Run make reviewable to ensure this PR is ready for review
• Added backport release-x.y labels to auto-backport this PR if necessary

---

How has this code been tested

Reproduced on a k3d cluster (K3s v1.31.5, arm64):

Step	Action	Result
1	Installed baseline with kubevela/vela-workflow:0.6.0	Confirmed real caBundle (LS0tLS1..., 756 bytes) and failurePolicy: Fail
2	Simulated failing upgrade by breaking the patch Job's --secret-name	Post-upgrade hook times out
3	Before fix	Both webhook configs reverted to caBundle: Cg== (4 bytes) ❌
4	After fix	Both webhook configs preserved the real caBundle (756 bytes) ✅

Reference: kubevela/kubevela#6919 (same fix applied to the vela-core chart)

---

Special notes for your reviewer

Consideration	Details
Helm version	Requires Helm 3.2+ for lookup function support
Dry-run compatibility	helm template / --dry-run still works — lookup returns nothing without cluster access, templates fall back to Cg==, and the patch Job handles it at runtime
Cert-manager path	Unaffected — when admissionWebhooks.certManager.enabled=true, patch jobs are disabled and cert-manager injects the caBundle via annotations

---

Summary by cubic

Preserves the admission webhooks’ caBundle on Helm installs, upgrades, and rollbacks to avoid broken webhooks when hooks fail. Requires Helm 3.2+.

• Bug Fixes
  • Use Helm lookup to reuse the existing caBundle on upgrade; default to Cg== on fresh installs.
  • Add post-rollback hook for the patch job and its RBAC to restore caBundle after rollbacks.
  • Add a CI workflow that simulates a failed upgrade and verifies the caBundle is preserved.

^{Written for commit 53d7669. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 9 files

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.19%. Comparing base (d7db9c4) to head (53d7669).
⚠️ Report is 9 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #224      +/-   ##
==========================================
+ Coverage   62.49%   70.19%   +7.70%     
==========================================
  Files          62       62              
  Lines        4415     5009     +594     
==========================================
+ Hits         2759     3516     +757     
+ Misses       1324     1142     -182     
- Partials      332      351      +19     

Flag	Coverage Δ
e2etests	21.39% <ø> (?)
unit-test	64.22% <ø> (+1.73%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[vishal210893]

https://github.com/kubevela/kubevela/blob/master/.github/workflows/webhook-upgrade-validation.yml

Similar to the above action, create a verification GitHub action for this fix

[roguepikachu]

https://github.com/kubevela/kubevela/blob/master/.github/workflows/webhook-upgrade-validation.yml

Similar to the above action, create a verification GitHub action for this fix

@vishal210893 added the GHA, here is a sample run from my fork