(go/v4): replace ENABLE_WEBHOOKS with --webhook-port=-1 to run the manager without webhooks

What

The go/v4 scaffold wraps every webhook setup in cmd/main.go in an environment variable guard:

// nolint:goconst
if os.Getenv("ENABLE_WEBHOOKS") != "false" {
    if err := webhookv1.SetupCronJobWebhookWithManager(mgr); err != nil {
        setupLog.Error(err, "Failed to create webhook", "webhook", "CronJob")
        os.Exit(1)
    }
}

The book tells users to run export ENABLE_WEBHOOKS=false and make run to test a controller locally without webhook certificates.

Since #6031 and #6034, the project has a second switch for the same thing. With controller-runtime v0.25.0 or later, a negative --webhook-port turns the webhook server off. The scaffolded flag help says "Set -1 to disable the webhook server", and the Helm chart passes --webhook-port=-1 when webhook.enabled=false.

Two switches for one job is confusing, and the env var only works while a project keeps the scaffolded guard. The flag works in controller-runtime itself, whatever the project does in cmd/main.go.

Proof of concept

A project scaffolded from master with an API and defaulting and validation webhooks, run against an envtest API server (Kubernetes 1.37) with no webhook certificates:

So --webhook-port=-1 fully replaces the guard at runtime: the webhooks register as disabled, the server never starts, and the controllers and readiness work.

The one gap is make run. Its recipe is go run ./cmd/main.go with no way to pass arguments, so dropping the guard alone leaves no make command that runs a project with webhooks locally without certificates.

Proposal

1. Let make run pass arguments. In the go/v4 Makefile template:

   复制

   run: manifests generate fmt vet ## Run a controller from your host.
          go run ./cmd/main.go $(RUN_ARGS)

   Users then run:

   复制

   make run RUN_ARGS=--webhook-port=-1
   

2. Drop the ENABLE_WEBHOOKS guard from the webhook setup code the go/v4 plugin writes into cmd/main.go, along with its // nolint:goconst line. The setup is always called; --webhook-port=-1 keeps the server off.

3. Update the docs:

   • docs/book/src/cronjob-tutorial/running.md: replace export ENABLE_WEBHOOKS=false / make run with make run RUN_ARGS=--webhook-port=-1.
   • hack/docs/internal/cronjob-tutorial/main_revisited.go: rewrite the comment above the webhook setup to point at the flag instead of the env var.
   • hack/docs/internal/multiversion-tutorial/generate_multiversion.go: update the text it finds and replaces, or the book generation fails.
   • docs/book/src/reference/webhook-overview.md: replace the ENABLE_WEBHOOKS=false line under "Disabling the webhook server".