CNTRLPLANE-4150: release-5.0: feat: Maintain ingress serving cert for HostedCluster ingress - #9604

Regenerated output for the ingress defaultCertificate field and the
IngressDefaultCertificateSynced condition:

- applyconfiguration clients for IngressDefaultCertificateReference and
  IngressOperatorSpec.
- Installed CRD manifests for hostedclusters and hostedcontrolplanes.
- Vendored copy of the api module.

Signed-off-by: David Eads <deads@redhat.com>
Commit-Message-Assisted-by: Claude (via Claude Code)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(cherry picked from commit aa8e527)

…t status

Sync the user-provided ingress default certificate secret from the HostedCluster
namespace into the control plane namespace and surface the outcome:

- Report the IngressDefaultCertificateSynced condition via optimistic-lock
  status patching; degrade gracefully (no reconcile failure) on a missing or
  malformed source secret, preserving the previously synced certificate.
- Skip the sync on IBM Cloud (PlatformNotSupported) and when the ingress
  capability is disabled, since no ingress controller consumes the certificate.
- When the certificate is unset, clean up the stale synced secret and condition,
  short-circuiting the common path before any re-Get/DeepCopy.
- Annotate the referenced secret before validation and index HostedClusters by
  the referenced secret name so a delete+recreate re-enqueues the owner promptly.
- Also invoke the sync from the legacy reconcile path.
- Add unit tests for the sync and the secret-referencing enqueue mapper.

Signed-off-by: David Eads <deads@redhat.com>
Commit-Message-Assisted-by: Claude (via Claude Code)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(cherry picked from commit d346163)

…ficate in HCCO

Propagate the user-provided default certificate into the hosted cluster:

- When a custom certificate is configured, HCCO sources default-ingress-cert
  from the synced service-provider secret; otherwise it falls back to the
  CPO-generated wildcard.
- Do not fail reconciliation (do not degrade the HostedCluster) when the synced
  secret has not landed yet, and treat IBM Cloud as having no custom certificate.
- Add the ServiceProviderDefaultIngressServingCert manifest and thread
  DefaultCertificate through the ingress params.
- Add unit tests for certificate-source selection and params.

Signed-off-by: David Eads <deads@redhat.com>
Commit-Message-Assisted-by: Claude (via Claude Code)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(cherry picked from commit 408113b)

- Add a v2 lifecycle test covering propagation, rotation, TLS handshake, the
  IngressDefaultCertificateSynced condition, source-secret deletion, revert to
  the wildcard, and a malformed-source negative case. Wire it into the Azure
  public group and skip it on Azure until the ingress endpoint is reachable from
  the build farm.
- Add envtest cases for the defaultCertificate name (CEL, MinLength, MaxLength).
- Add an IngressOperatorSpec serialization round-trip test and move
  GenerateCustomCertificate to test/e2e/v2/util to satisfy the e2eutilallowlist.

Signed-off-by: David Eads <deads@redhat.com>
Commit-Message-Assisted-by: Claude (via Claude Code)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(cherry picked from commit 004ae9b)

Regenerate the API reference and aggregated docs for the defaultCertificate
field and the IngressDefaultCertificateSynced condition.

Signed-off-by: David Eads <deads@redhat.com>
Commit-Message-Assisted-by: Claude (via Claude Code)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(cherry picked from commit 01dee99)

… disabled

Assert that both destination secrets and the synced condition remain absent
 after configuring a valid source certificate. Skip the enabled-ingress
 lifecycle tests safely when ingress is disabled.

Signed-off-by: David Eads <deads@redhat.com>
(cherry picked from commit 57221be)