fix: revert env var flag defaults, use Kubernetes var substitution

The previous commit incorrectly added os.Getenv(...) defaults to flag
declarations in cmd/main.go. Go flag defaults are for documentation and
local use; env var wiring belongs in the deployment layer.

Revert cmd/main.go to plain hard-coded defaults and remove the
envOrDefault helper. In manager.yaml, introduce an env: section with the
default values and reference them from args via Kubernetes $(VAR_NAME)
substitution. Overlays can now override a single env entry by name
without touching the args list.

Author: scotwells

cmd/main.go

@@ -87,29 +87,27 @@ func main() {
 	var enableManagementControllers bool
 	var enableCellControllers bool
 
-	flag.StringVar(&probeAddr, "health-probe-bind-address", envOrDefault("HEALTH_PROBE_BIND_ADDRESS", ":8081"), "The address the probe endpoint binds to.")
-	flag.BoolVar(&enableLeaderElection, "leader-elect", os.Getenv("LEADER_ELECT") == "true",
+	flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
+	flag.BoolVar(&enableLeaderElection, "leader-elect", false,
 		"Enable leader election for controller manager. "+
 			"Enabling this will ensure there is only one active controller manager.")
-	flag.StringVar(&leaderElectionNamespace, "leader-elect-namespace", os.Getenv("LEADER_ELECT_NAMESPACE"), "The namespace to use for leader election.")
-	flag.StringVar(&karmadaKubeconfig, "karmada-kubeconfig", os.Getenv("KARMADA_KUBECONFIG"),
+	flag.StringVar(&leaderElectionNamespace, "leader-elect-namespace", "", "The namespace to use for leader election.")
+	flag.StringVar(&karmadaKubeconfig, "karmada-kubeconfig", "",
 		"Path to the kubeconfig file for the Karmada control plane. When omitted, Karmada federation features are disabled.")
-	flag.StringVar(&karmadaContext, "karmada-context", os.Getenv("KARMADA_CONTEXT"),
+	flag.StringVar(&karmadaContext, "karmada-context", "",
 		"Context to use from the Karmada kubeconfig. When omitted, the current context is used.")
-	flag.BoolVar(&enableManagementControllers, "enable-management-controllers",
-		os.Getenv("ENABLE_MANAGEMENT_CONTROLLERS") != "false",
+	flag.BoolVar(&enableManagementControllers, "enable-management-controllers", true,
 		"Enable management-plane controllers (WorkloadDeploymentFederator, InstanceProjector). "+
 			"Disable when running a cell-only operator instance.")
-	flag.BoolVar(&enableCellControllers, "enable-cell-controllers",
-		os.Getenv("ENABLE_CELL_CONTROLLERS") != "false",
+	flag.BoolVar(&enableCellControllers, "enable-cell-controllers", true,
 		"Enable cell controllers (WorkloadDeploymentReconciler, InstanceReconciler). "+
 			"Disable when running a management-only operator instance.")
 
 	opts := zap.Options{
 		Development: true,
 	}
 
-	flag.StringVar(&serverConfigFile, "server-config", os.Getenv("SERVER_CONFIG"), "path to the server config file")
+	flag.StringVar(&serverConfigFile, "server-config", "", "path to the server config file")
 
 	opts.BindFlags(flag.CommandLine)
 	flag.Parse()
@@ -422,9 +420,3 @@ func ignoreCanceled(err error) error {
 	return err
 }
 
-func envOrDefault(key, def string) string {
-	if v := os.Getenv(key); v != "" {
-		return v
-	}
-	return def
-}

config/base/manager/manager.yaml

@@ -26,14 +26,24 @@ spec:
         seccompProfile:
           type: RuntimeDefault
       containers:
-      - command:
+      - name: manager
+        command:
         - /manager
         args:
-          - --leader-elect
-          - --health-probe-bind-address=:8081
-          - --server-config=/config/config.yaml
+          - --leader-elect=$(LEADER_ELECT)
+          - --health-probe-bind-address=$(HEALTH_PROBE_BIND_ADDRESS)
+          - --server-config=$(SERVER_CONFIG)
+          - --karmada-kubeconfig=$(KARMADA_KUBECONFIG)
+        env:
+          - name: LEADER_ELECT
+            value: "true"
+          - name: HEALTH_PROBE_BIND_ADDRESS
+            value: ":8081"
+          - name: SERVER_CONFIG
+            value: /config/config.yaml
+          - name: KARMADA_KUBECONFIG
+            value: ""
         image: ghcr.io/datum-cloud/compute:latest
-        name: manager
         ports:
         - containerPort: 9443
           name: webhook-server