feat(pm): pin kcp front-proxy via hostAliases, IP set through kustomize

The wildwest-controller's endpoint watcher dials the APIExport virtual-workspace
URL (https://root.kcp.localhost:8443/...) directly. Inside the pod that hostname
resolves to 127.0.0.1, so the watch fails with connection refused.

Enable common.hostAliases on the controller to pin *.kcp.localhost to the
in-cluster front-proxy service. The ClusterIP is environment-specific, so it is
exposed as the single editable field via a kustomize JSON patch in
kustomization.yaml rather than hardcoded in the manifest.

Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt>

Author: mjudeikis

config/kcp/cachedresourceendpointslice-armaments.yaml

@@ -0,0 +1,9 @@
+apiVersion: cache.kcp.io/v1alpha1
+kind: CachedResourceEndpointSlice
+metadata:
+  name: armaments
+spec:
+  cachedResource:
+    name: armaments
+  export:
+    name: wildwest.platform-mesh.io

config/pm/README.md

@@ -20,7 +20,7 @@ subroutines:
 | 2 | `ProviderResource`| Creates a kcp `Provider` (default path `root:providers:system`). The Provider controller provisions a dedicated provider **workspace** + a scoped admin kubeconfig `Secret`. |
 | 3 | `WaitProvider`    | Waits for the `Provider` to reach `phase=Ready`. |
 | 4 | `KubeconfigCopy`  | Copies that kubeconfig into the runtime namespace as `Secret/wildwest-provider-kubeconfig` (key `kubeconfig`). |
-| 5 | `Deploy`          | For each `runtimeDeployments[].ocm` entry, creates a Flux `OCIRepository` (`oci://<registry>/<componentName>:<version>`, helm-chart layer) + a `HelmRelease` that installs the chart into the runtime namespace. |
+| 5 | `Deploy`          | For each `runtimeDeployments[].flux` entry, creates a Flux `OCIRepository` (`oci://<registry>/<chart>:<version>`, helm-chart layer) + a `HelmRelease` that installs the chart into the runtime namespace. |
 
 The provider workspace created in step 2 is **empty**. The `wildwest-controller`
 chart's **init container** (`init.enabled: true`) bootstraps the workspace content —
@@ -58,7 +58,7 @@ Published artifacts the manifest references:
 > on every `v*` tag (via `make helm-push`). CI versions all release artifacts from the git
 > tag (`VERSION = ${tag#v}`), so the chart version equals the release tag — latest is
 > `v0.0.7`. (The internal `deploy/helm/*/Chart.yaml` version is overridden at publish
-> time.) If you publish elsewhere, update `registry` / `componentName` / `version` in
+> time.) If you publish elsewhere, update `registry` / `chart` / `version` in
 > [`managedprovider.yaml`](./managedprovider.yaml) accordingly.
 
 ## Configure the front-proxy IP (required)

config/pm/kustomization.yaml

@@ -26,8 +26,8 @@ patches:
       name: wildwest
     patch: |
       - op: replace
-        path: /spec/runtimeDeployments/0/ocm/values/hostAliases/entries/0/ip
+        path: /spec/runtimeDeployments/0/flux/values/hostAliases/entries/0/ip
         value: "10.96.188.4"
       - op: replace
-        path: /spec/runtimeDeployments/2/ocm/values/hostAliases/entries/0/ip
+        path: /spec/runtimeDeployments/2/flux/values/hostAliases/entries/0/ip
         value: "10.96.188.4"

config/pm/managedprovider.yaml

@@ -8,8 +8,8 @@
 #   3. WaitProvider       - waits for the Provider to reach phase=Ready.
 #   4. KubeconfigCopy     - copies that kubeconfig into this runtime namespace as
 #                           Secret "<name>-provider-kubeconfig" (key: kubeconfig).
-#   5. Deploy             - for every runtimeDeployments[].ocm entry it creates a Flux
-#                           OCIRepository (oci://<registry>/<componentName>:<version>,
+#   5. Deploy             - for every runtimeDeployments[].flux entry it creates a Flux
+#                           OCIRepository (oci://<registry>/<chart>:<version>,
 #                           helm-chart layer) + a HelmRelease that installs the chart
 #                           into this namespace.
 #
@@ -31,13 +31,13 @@ spec:
   cleanupOnDelete: false
 
   # Components installed into the runtime cluster. Each entry points Flux at an
-  # OCI Helm chart artifact: oci://<registry>/<componentName>:<version>.
+  # OCI Helm chart artifact: oci://<registry>/<chart>:<version>.
   runtimeDeployments:
     # ---- Wild West controller -------------------------------------------------
-    - ocm:
-        componentName: wildwest-controller
+    - flux:
+        chart: wildwest-controller
         registry: ghcr.io/platform-mesh/provider-quickstart/charts
-        version: "0.0.7"
+        version: "0.0.8"
         values:
           # Provider-workspace kubeconfig copied in by the operator
           # (defaults to <ManagedProvider.name>-provider-kubeconfig / key "kubeconfig").
@@ -75,10 +75,10 @@ spec:
                   - localhost
 
     # ---- Wild West portal (Angular UI) ---------------------------------------
-    - ocm:
-        componentName: wildwest-portal
+    - flux:
+        chart: wildwest-portal
         registry: ghcr.io/platform-mesh/provider-quickstart/charts
-        version: "0.0.7"
+        version: "0.0.8"
         # Portal needs no kubeconfig. Expose it through the platform Gateway.
         # These values are passed verbatim into the HelmRelease; the chart defaults
         # already match the platform-mesh-system Gateway / CORS setup, so enabling the
@@ -102,10 +102,10 @@ spec:
     # Armament CRs. Connects to kcp via the provider workspace kubeconfig
     # (KUBECONFIG=/etc/kcp/kubeconfig), so it needs the same kubeconfig + hostAliases
     # wiring as the controller.
-    - ocm:
-        componentName: wildwest-armament-sync
+    - flux:
+        chart: wildwest-armament-sync
         registry: ghcr.io/platform-mesh/provider-quickstart/charts
-        version: "0.0.7"
+        version: "0.0.8"
         values:
           # Chart default is wildwest-controller-kubeconfig; under ManagedProvider the
           # operator copies the provider kubeconfig as wildwest-provider-kubeconfig.