fix(operator): stage DGD admission path migration

[sttts]

Summary

• Backport fix(operator): stage DGD admission path migration #11117 to the 1.3 release branch.
• Serve both legacy v1alpha1 and v1beta1 DGD admission endpoints.
• Convert v1alpha1 admission objects to the v1beta1 hub before validation and defaulting.
• Keep Helm registered on the v1alpha1 routes through 1.3 so the route switch can happen safely in 1.4.

Validation

• GOCACHE=/private/tmp/dynamo-go-cache go test ./internal/webhook/...
• helm lint .
• helm template dynamo-operator . --namespace dynamo-system --set discoveryBackend=kubernetes

---

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

👋 Hi sttts! Thank you for contributing to ai-dynamo/dynamo.

Just a reminder: The NVIDIA Test Github Validation CI runs an essential subset of the testing framework to quickly catch errors.Your PR reviewers may elect to test the changes comprehensively before approving your changes.

🚀

[sttts]

/ok to test 107ff0f

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🚩 Helm webhook apiVersion downgrade leaves v1beta1 requests unvalidated

The Helm chart changes the webhook rules from apiVersions: v1beta1 to apiVersions: v1alpha1 for both the validating and mutating DynamoGraphDeployment webhooks (webhook-configuration.yaml:98 and webhook-configuration.yaml:256). While the operator binary serves both v1alpha1 and v1beta1 endpoints (dynamographdeployment_handler.go:140-149 for defaulting, dynamographdeployment_handler.go:197-215 for validation), the Kubernetes API server only dispatches admission requests matching the registered rules. Any direct v1beta1 DynamoGraphDeployment CREATE/UPDATE requests will bypass both validation and defaulting entirely during the 1.3 release window. The TODO comments indicate this is intentional for the migration, but the reviewer should confirm that v1beta1 is not yet served by the CRD or that bypassing validation is acceptable during this period.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[datadog-official]

⚠️ Warnings

🚦 2 Pipeline jobs failed

Pre Merge | operator     

Pre Merge | pre-merge-status-check     

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 107ff0f | Docs | Give us feedback!}

[sttts]

Superseded by #11130, which follows the release cherry-pick process: convention-compliant branch name and git cherry-pick --signoff of merged main commit 7e6a8c6.