fix: make webhook certificate Secret file mode configurable

[freeznet]

Summary

The operator chart hardcodes the webhook certificate Secret volume's file mode to 0644, preventing users from configuring stricter permissions.

• Add admissionWebhook.certSecretDefaultMode, retaining 420 (0644) by default for backward compatibility.
• Apply the value only to the webhook certificate Secret volume; leave other volumes unchanged.
• Document opt-in 288 (0440) with an appropriate Pod fsGroup so non-root controllers can still read their certificate and private key. Explain why runAsGroup or 0400 alone is insufficient.

Validation

• helm lint charts/function-mesh-operator
• helm lint charts/function-mesh-operator --set admissionWebhook.certSecretDefaultMode=288 --set controllerManager.podSecurityContext.fsGroup=10001
• Default chart rendering is byte-for-byte identical before and after the change.
• Helm rendering assertions passed for modes 0, 256, 288, and 511, non-root UID/GID plus fsGroup via a values file, cert-manager/custom providers, and disabled webhooks. Confirmed other Deployment fields remain unchanged when only the mode is overridden.
• git diff --check

Cluster runtime and customer admission policy validation have not been performed for this change.

Review follow-up

• Added values.schema.json: when present, certSecretDefaultMode must be an integer in [0, 511]. No required properties: older releases using --reuse-values may lack this key.
• The template uses hasKey to fall back to 420 only when the key is missing, preserving explicit 0. With current defaults, a null override is removed by Helm coalescing and falls back to 420; null retained after coalescing (as observed with old defaults lacking this key) is rejected by the schema.
• Clarified the two image build paths (Dockerfile: 65532:65532; operator.Dockerfile: 10000:10001). The fsGroup example is a supplemental GID and need not match the primary GID.
• Latest validation: 32 cases passed through helm lint, helm template, and helm install --dry-run=client across current defaults and a chart copy using the 0.2.44 values.yaml to simulate the missing-key state from --reuse-values. Covered absent key, null via CLI/values file, explicit 0, integer bounds, invalid types/ranges, and disabled webhooks. Default and old-values rendering are byte-for-byte unchanged. This is a rendering simulation, not a live Helm upgrade.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

@freeznet:Thanks for your contribution. For this PR, do we need to update docs?
(The PR template contains info about doc, which helps others know more about the changes. Can you provide doc-related info in this and future PR descriptions? Thanks)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-24T07:46:45.446841Z	39681d6	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.