[ahmedgabers]

The ValidatingWebhookConfiguration renders with no annotations, so external CA managers cannot attach to it. With webhook.certificate.provided, operators supply a serving certificate (commonly a cert-manager Certificate) but must hand-copy the CA into webhook.certificate.caBundle and re-copy it whenever it rotates.

An webhook.annotations knob lets cert-manager's cainjector own the caBundle instead (cert-manager.io/inject-ca-from: <namespace>/<certificate>) — the standard pattern for webhook trust management.

Verified with helm template: the annotation renders onto the webhook configuration when set; unset output is byte-identical to today. Chart version bumped 1.3.0 -> 1.3.1; values doc comment and README row updated.

[ahmedgabers]

Fixes #1006.

[AlinsRan]

Thanks @ahmedgabers. I pushed two commits to this branch to get it mergeable:

1. Merged master to resolve the Chart.yaml conflict. 1.3.1 was already released by fix(apisix-ingress-controller): pdb.yaml references undefined helpers, release 1.3.1 #1009, and master is now at 1.4.0, so the chart is bumped to 1.4.1.
2. Regenerated the README with helm-docs. CI runs helm-docs with alphanum sorting, so the webhook.annotations row has to sit above webhook.certificate.provided.
3. Scoped the CA injection in the values docs. With webhook.certificate.provided: false, the chart generates its own CA and serving cert. If an inject-ca-from annotation is also set, cainjector replaces caBundle with a different CA, and the TLS handshake to the webhook fails. That failure is silent under the default failurePolicy: Ignore, and blocks all CREATE/UPDATE under Fail. The comment now reads:

  # -- Annotations for the ValidatingWebhookConfiguration, e.g.
  # `cert-manager.io/inject-ca-from: <namespace>/<certificate>` so
  # cert-manager's cainjector maintains the webhook caBundle.
  # Only use CA injection with `certificate.provided: true` and `certificate.caBundle` unset;
  # otherwise the injected CA replaces the chart-generated one and the webhook TLS handshake fails.
  annotations: {}

Verified locally: helm lint passes, and with default values the rendered manifests match master (apart from the chart label and the generated certificates).