fix: gate readyz on webhook TLS server startup

Add webhookServer.StartedChecker() as a readyz check so the pod Ready
condition reflects actual webhook TLS availability on :9443, not just
the health endpoint being up. Replace the fragile .items[0] jsonpath
probe with kubectl wait which handles rolling restarts correctly.

Addresses review feedback from #421.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Paolo Dettori <dettori@us.ibm.com>

Author: pdettori

kagenti-operator/cmd/main.go

@@ -688,6 +688,10 @@ func main() {
 		setupLog.Error(err, "unable to set up ready check")
 		os.Exit(1)
 	}
+	if err := mgr.AddReadyzCheck("webhook", webhookServer.StartedChecker()); err != nil {
+		setupLog.Error(err, "unable to set up webhook ready check")
+		os.Exit(1)
+	}
 
 	setupLog.Info("starting manager")
 	if err := mgr.Start(ctx); err != nil {

kagenti-operator/test/utils/utils.go

@@ -752,20 +752,18 @@ func UncommentCode(filename, target, prefix string) error {
 	return os.WriteFile(filename, out.Bytes(), 0644)
 }
 
-// ProbeWebhookReady checks that the controller pod is fully Ready (all
-// containers passing readiness probes). The manager's readiness probe gates
-// on full initialization including the webhook server startup.
+// ProbeWebhookReady checks that the controller pod is fully Ready.
+// The readyz endpoint gates on webhookServer.StartedChecker(), so Ready
+// means the webhook TLS server is accepting connections on :9443.
 func ProbeWebhookReady(namespace string) error {
-	cmd := exec.Command("kubectl", "get", "pods",
-		"-l", "control-plane=controller-manager",
+	cmd := exec.Command("kubectl", "wait",
+		"--for=condition=Ready",
+		"pod", "-l", "control-plane=controller-manager",
 		"-n", namespace,
-		"-o", "jsonpath={.items[0].status.conditions[?(@.type==\"Ready\")].status}")
-	output, err := Run(cmd)
+		"--timeout=5s")
+	_, err := Run(cmd)
 	if err != nil {
-		return fmt.Errorf("failed to check controller pod readiness: %w", err)
-	}
-	if strings.TrimSpace(output) != "True" {
-		return fmt.Errorf("controller pod not yet Ready (status=%q)", output)
+		return fmt.Errorf("controller pod not yet Ready: %w", err)
 	}
 	return nil
 }