Add validating admission webhook for better UX

[birdmanmandbir]

Summary

Currently, validation errors are only surfaced during controller reconciliation. Users get kubectl apply success but then find errors in controller logs. Adding a validating admission webhook would provide immediate feedback.

Current Behavior

$ kubectl apply -f my-project.yaml
supabaseproject.supabase.guion.dev/my-project created  # Accepted

# Errors only visible in controller logs later

Desired Behavior

$ kubectl apply -f my-project.yaml
Error from server: admission webhook denied the request: 
  spec.auth.siteURL is required

Implementation

1. Generate webhook scaffolding:

   kubebuilder create webhook --group supabase --version v1alpha1 --kind SupabaseProject --defaulting --programmatic-validation

2. Implement validation rules in api/v1alpha1/supabaseproject_webhook.go:

   • Required fields: spec.auth.siteURL, spec.auth.externalURL, spec.database.storage.size
   • Conditional: if spec.auth.providers.google.enabled, then spec.auth.providers.secretRef required
   • Conditional: if spec.database.backup.enabled, then spec.database.backup.destinationPath and s3CredentialsSecret required

3. Add cert-manager for TLS certificates

4. Update deployment manifests with webhook configuration

Prerequisites

• cert-manager installed in cluster
• Webhook service accessible from API server

Priority

Low - nice-to-have for UX, not blocking functionality. Basic +kubebuilder:validation markers already provide some validation at the API level.