Propagate content_path_prefix overrides to pulp-web ConfigMap

[mouchar]

Summary

When CONTENT_PATH_PREFIX is overridden via the custom_pulp_settings ConfigMap, the pulp-server Secret (settings.py) and Ingress/Route paths reconcile correctly, but the pulp-web <pulp>-configmap (nginx.conf) was created once and then never updated. The result: nginx kept proxying the old prefix even after the user updated the override, and the in-tree // TODO: check pulp-web configmap change confirmed this was unfinished work.

This branch:

1. Reconciles the pulp-web ConfigMap on every loop using the existing controllers.ReconcileObject(..., PulpConfigMap{}) pattern already used for telemetry and worker-probe ConfigMaps.
2. Rolls the pulp-web pods when nginx.conf changes by adding a repo-manager.pulpproject.org/web-config-hash annotation on the pod template. The nginx.conf key is mounted via subPath, and kubelet does not auto-propagate updates to subPath ConfigMap mounts, so a rollout has to be triggered explicitly. The annotation shifts the Deployment spec hash, and the existing CheckDeploymentSpec path takes care of the rollout.
3. Modernizes envtest setup. make testbin had been broken because the old go.kubebuilder.io/test-tools tarballs were retired upstream. Switched to the kubebuilder-recommended flow driven entirely through setup-envtest:
   • ENVTEST_K8S_VERSION is derived from k8s.io/api in go.mod (v0.35.x → 1.35).
   • ENVTEST_VERSION is derived from controller-runtime in go.mod, and setup-envtest is pinned to that release branch (release-0.23) instead of @latest.
   • testbin now runs setup-envtest use --bin-dir $(LOCALBIN); no sudo, no /usr/local/kubebuilder.
   • New envtest-path helper prints the KUBEBUILDER_ASSETS export for raw go test / IDE users.
   • suite_test.go auto-discovers bin/k8s/<ver>-<os>-<arch> via BinaryAssetsDirectory, matching current kubebuilder scaffolding.
4. Adds a focused unit test that asserts both halves of the fix: rendering with one content_path_prefix value produces a different nginx.conf and a different pod-template hash than rendering with another. Runs in ~2s without envtest.

Other ingress modes are already covered by their existing ReconcileObject calls (controllers/repo_manager/ingress.go for nginx and others, controllers/ocp/ingress.go for OCP Ingress, controllers/ocp/route.go for OCP Route). The pulp-web ConfigMap was the only path that wasn't reconciling on drift.

Test plan

• go build ./... and go vet ./...
• go test ./controllers/repo_manager/ -run TestPulpWebContentPathPrefixPropagation passes in ~2s without envtest
• make testbin installs envtest binaries from a clean state (no bin/k8s, no setup-envtest)
• make test — full envtest suite passes (12 passed, 0 failed, 1 skipped)
• Raw go test ./controllers/repo_manager/ -run TestAPIs (no KUBEBUILDER_ASSETS) also passes thanks to the BinaryAssetsDirectory fallback
• Manual verification on a live cluster: change content_path_prefix in a custom_pulp_settings ConfigMap, confirm the <pulp>-configmap ConfigMap and pulp-web pods are rolled, and that nginx serves the new path

🤖 Generated with Claude Code

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: mouchar
Once this PR has been reviewed and has the lgtm label, please assign git-hyagi for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @mouchar. Thanks for your PR.

I'm waiting for a pulp member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.