Strip remaining webhook-only scaffold and network-policy manifests

Follows the approved lean-down plan
(docs/plans/2026-08-08-1335-lean-scaffold-cleanup.md). Removes from the
application's deployed footprint:

- config/network-policy/ and its commented enable line -- the user does
  not need network policies at the moment.
- The webhook-only halves of config/default/kustomization.yaml: the
  commented ../webhook and ../certmanager resource lines, the
  manager_webhook_patch.yaml reference, the serving-cert ->
  Validating/Mutating WebhookConfiguration cainjection replacement
  blocks, and the crdkustomizecainjection* scaffold markers -- anchors
  only for `kubebuilder create webhook`, which is a permanent non-goal.
- The two commented [WEBHOOK] blocks in config/crd/kustomization.yaml
  plus the now-empty patches: key; kept the one-line
  crdkustomizeresource marker since `kubebuilder create api` could
  legitimately run again.
- config/crd/kustomizeconfig.yaml, whose only consumer was the removed
  configurations: block.

Explicitly kept per user direction: all of config/prometheus/, the
paired metrics-TLS-via-cert-manager plumbing (cert_metrics_manager_patch
+ the metrics-certs/ServiceMonitor replacement halves), all RBAC
manifests including the admin/editor/viewer helper roles, and all
developer tooling.

Also records in the execution log why the webhook machinery existed at
all: kubebuilder init emits it unconditionally, verified against the
v4.15.0 binary that no init flag can suppress it -- scaffold-then-prune
is the only supported path, and the pruning pass should have happened
at Step 0.

Verified: kustomize build clean on config/default and config/crd,
go build/vet clean with and without -tags=e2e, make test green with
coverage identical to pre-cleanup.

Co-Authored-By: Claude <noreply@anthropic.com>

config/crd/kustomization.yaml

@@ -4,13 +4,3 @@
 resources:
 - bases/crawl.example.com_proxies.yaml
 # +kubebuilder:scaffold:crdkustomizeresource
-
-patches:
-# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
-# patches here are for enabling the conversion webhook for each CRD
-# +kubebuilder:scaffold:crdkustomizewebhookpatch
-
-# [WEBHOOK] To enable webhook, uncomment the following section
-# the following config is for teaching kustomize how to do kustomization for CRDs.
-#configurations:
-#- kustomizeconfig.yaml

config/crd/kustomizeconfig.yaml

@@ -1,12 +0,0 @@
-# This file is for teaching kustomize how to substitute name and namespace reference in CRD
-nameReference:
-- kind: Service
-  version: v1
-  fieldSpecs:
-  - kind: CustomResourceDefinition
-    version: v1
-    group: apiextensions.k8s.io
-    path: spec/conversion/webhook/clientConfig/service/name
-
-varReference:
-- path: metadata/annotations

config/default/kustomization.yaml

@@ -18,20 +18,10 @@ resources:
 - ../crd
 - ../rbac
 - ../manager
-# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
-# crd/kustomization.yaml
-#- ../webhook
-# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
-#- ../certmanager
 # [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
 #- ../prometheus
 # [METRICS] Expose the controller manager metrics service.
 - metrics_service.yaml
-# [NETWORK POLICY] Protect the /metrics endpoint and Webhook Server with NetworkPolicy.
-# Only Pod(s) running a namespace labeled with 'metrics: enabled' will be able to gather the metrics.
-# Only CR(s) which requires webhooks and are applied on namespaces labeled with 'webhooks: enabled' will
-# be able to communicate with the Webhook Server.
-#- ../network-policy
 
 # Uncomment the patches line if you enable Metrics
 patches:
@@ -48,14 +38,9 @@ patches:
 #  target:
 #    kind: Deployment
 
-# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
-# crd/kustomization.yaml
-#- path: manager_webhook_patch.yaml
-#  target:
-#    kind: Deployment
-
-# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
-# Uncomment the following replacements to add the cert-manager CA injection annotations
+# [METRICS-WITH-CERTS] Uncomment the following replacements together with the patch
+# above to wire the metrics Service name/namespace into the cert-manager Certificate
+# and the Prometheus ServiceMonitor TLS config.
 #replacements:
 # - source: # Uncomment the following block to enable certificates for metrics
 #     kind: Service
@@ -116,119 +101,3 @@ patches:
 #         delimiter: '.'
 #         index: 1
 #         create: true
-
-# - source: # Uncomment the following block if you have any webhook
-#     kind: Service
-#     version: v1
-#     name: webhook-service
-#     fieldPath: .metadata.name # Name of the service
-#   targets:
-#     - select:
-#         kind: Certificate
-#         group: cert-manager.io
-#         version: v1
-#         name: serving-cert
-#       fieldPaths:
-#         - .spec.dnsNames.0
-#         - .spec.dnsNames.1
-#       options:
-#         delimiter: '.'
-#         index: 0
-#         create: true
-# - source:
-#     kind: Service
-#     version: v1
-#     name: webhook-service
-#     fieldPath: .metadata.namespace # Namespace of the service
-#   targets:
-#     - select:
-#         kind: Certificate
-#         group: cert-manager.io
-#         version: v1
-#         name: serving-cert
-#       fieldPaths:
-#         - .spec.dnsNames.0
-#         - .spec.dnsNames.1
-#       options:
-#         delimiter: '.'
-#         index: 1
-#         create: true
-
-# - source: # Uncomment the following block if you have a ValidatingWebhook (--programmatic-validation)
-#     kind: Certificate
-#     group: cert-manager.io
-#     version: v1
-#     name: serving-cert # This name should match the one in certificate.yaml
-#     fieldPath: .metadata.namespace # Namespace of the certificate CR
-#   targets:
-#     - select:
-#         kind: ValidatingWebhookConfiguration
-#       fieldPaths:
-#         - .metadata.annotations.[cert-manager.io/inject-ca-from]
-#       options:
-#         delimiter: '/'
-#         index: 0
-#         create: true
-# - source:
-#     kind: Certificate
-#     group: cert-manager.io
-#     version: v1
-#     name: serving-cert
-#     fieldPath: .metadata.name
-#   targets:
-#     - select:
-#         kind: ValidatingWebhookConfiguration
-#       fieldPaths:
-#         - .metadata.annotations.[cert-manager.io/inject-ca-from]
-#       options:
-#         delimiter: '/'
-#         index: 1
-#         create: true
-
-# - source: # Uncomment the following block if you have a DefaultingWebhook (--defaulting )
-#     kind: Certificate
-#     group: cert-manager.io
-#     version: v1
-#     name: serving-cert
-#     fieldPath: .metadata.namespace # Namespace of the certificate CR
-#   targets:
-#     - select:
-#         kind: MutatingWebhookConfiguration
-#       fieldPaths:
-#         - .metadata.annotations.[cert-manager.io/inject-ca-from]
-#       options:
-#         delimiter: '/'
-#         index: 0
-#         create: true
-# - source:
-#     kind: Certificate
-#     group: cert-manager.io
-#     version: v1
-#     name: serving-cert
-#     fieldPath: .metadata.name
-#   targets:
-#     - select:
-#         kind: MutatingWebhookConfiguration
-#       fieldPaths:
-#         - .metadata.annotations.[cert-manager.io/inject-ca-from]
-#       options:
-#         delimiter: '/'
-#         index: 1
-#         create: true
-
-# - source: # Uncomment the following block if you have a ConversionWebhook (--conversion)
-#     kind: Certificate
-#     group: cert-manager.io
-#     version: v1
-#     name: serving-cert
-#     fieldPath: .metadata.namespace # Namespace of the certificate CR
-#   targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
-# +kubebuilder:scaffold:crdkustomizecainjectionns
-# - source:
-#     kind: Certificate
-#     group: cert-manager.io
-#     version: v1
-#     name: serving-cert
-#     fieldPath: .metadata.name
-#   targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
-# +kubebuilder:scaffold:crdkustomizecainjectionname

config/network-policy/allow-metrics-traffic.yaml

@@ -1,27 +0,0 @@
-# This NetworkPolicy allows ingress traffic
-# with Pods running on namespaces labeled with 'metrics: enabled'. Only Pods on those
-# namespaces are able to gather data from the metrics endpoint.
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  labels:
-    app.kubernetes.io/name: egress-proxies-operator
-    app.kubernetes.io/managed-by: kustomize
-  name: allow-metrics-traffic
-  namespace: system
-spec:
-  podSelector:
-    matchLabels:
-      control-plane: controller-manager
-      app.kubernetes.io/name: egress-proxies-operator
-  policyTypes:
-    - Ingress
-  ingress:
-    # This allows ingress traffic from any namespace with the label metrics: enabled
-    - from:
-      - namespaceSelector:
-          matchLabels:
-            metrics: enabled  # Only from namespaces with this label
-      ports:
-        - port: 8443
-          protocol: TCP

config/network-policy/kustomization.yaml

@@ -1,2 +0,0 @@
-resources:
-- allow-metrics-traffic.yaml

docs/plans-executions/2026-08-07-1747-proxy-operator.md

@@ -477,3 +477,86 @@ go build -tags=e2e ./... && go vet -tags=e2e ./...
 
 Both clean. `make test` green across the whole repo, unchanged from before
 the cleanup.
+
+## Cleanup — lean-down audit of Steps 0–3
+
+Planned and approved separately in
+[docs/plans/2026-08-08-1335-lean-scaffold-cleanup.md](../plans/2026-08-08-1335-lean-scaffold-cleanup.md).
+Prompted by the user asking (a) why webhook machinery existed at all when the
+spec's §12 says "do NOT build: admission webhooks, cert-manager wiring", and
+(b) for a full audit of completed work so the project starts as lean as
+possible.
+
+**Why the webhook machinery existed — for the record.** `kubebuilder init`
+emits it unconditionally: the active webhook-server wiring in `cmd/main.go`,
+cert-manager install in the e2e utils, and commented kustomize anchor blocks
+all arrive with `init`, not with `create webhook` (never run here). At Step 0
+the scaffold was deliberately committed untouched as a reviewable baseline
+(only `.github/` stripped), and spec §3's "config/ (scaffold-generated, kept
+working)" was read as license to keep the rest. The process gap: §12's
+non-goals deserved a pruning pass immediately *after* the baseline commit,
+especially for the parts that actually did something. The user caught it, not
+the build process.
+
+**Could `init` have skipped it?** No — verified against the v4.15.0 binary,
+not from memory:
+
+```bash
+kubebuilder init --help
+# flags: --domain --repo --owner --license(-file) --multigroup --namespaced
+#        --fetch-deps --skip-go-version-check --project-version --plugins
+# nothing subtracts features; optional plugins (helm, grafana, deploy-image,
+# autoupdate) are all additive — there is no "minimal" plugin
+```
+
+Scaffold-then-prune is the only supported path to a lean baseline. Worth
+knowing at the *next* project bootstrap: plan the pruning pass as part of
+scaffolding, not as a later discovery. (`--namespaced` was the one
+arguably-applicable flag, but it conflicts with the kubernetes-pod provider's
+cluster-wide `ListByTag` for orphan GC — cluster-scoped was correct.)
+
+**Audit result for the Go code: clean.** Nothing beyond spec that isn't a
+justified, already-logged deviation (`Instance.UID`/`CreatedAt`,
+`MaxLeases *int32`, `HealthCheck default={}`, registry-as-parameter,
+kubernetes provider per user decision). Trivial extras (`shortName=px`,
+`MaxProperties=32`) stay.
+
+**Scope lines drawn by the user during plan review** — recorded because they
+shape what "lean" means for this repo going forward:
+
+- Developer tooling is exempt: `.golangci.yml`, `.custom-gcl.yml`,
+  `.devcontainer/`, `AGENTS.md`, Makefile `lint`/`docker-buildx`/
+  `build-installer` targets all stay ("tooling around the project is cool, i
+  just want the application code produced to start as lean as possible").
+- Monitoring manifests stay: all of `config/prometheus/`, plus the paired
+  metrics-TLS-via-cert-manager plumbing
+  (`config/default/cert_metrics_manager_patch.yaml` and the metrics-certs/
+  ServiceMonitor halves of the commented replacements block) — removing half
+  of a pair would leave dangling comment references.
+- All RBAC manifests stay, including the `proxy_admin/editor/viewer` helper
+  ClusterRoles whose own headers say "not used by the project itself".
+- Network policies go: "we do not need any network policies at the moment".
+
+**Removed:**
+
+- `config/network-policy/` (kustomization.yaml, allow-metrics-traffic.yaml)
+  plus its commented `#- ../network-policy` line in the default kustomization.
+- Webhook-only remnants in `config/default/kustomization.yaml`: the commented
+  `#- ../webhook` / `#- ../certmanager` resource lines, the
+  `manager_webhook_patch.yaml` patch reference, and the webhook halves of the
+  replacements block (serving-cert → Validating/Mutating WebhookConfiguration
+  cainjection, conversion webhook, and the
+  `+kubebuilder:scaffold:crdkustomizecainjection*` markers — anchors only for
+  `kubebuilder create webhook`, permanently a non-goal).
+- The two commented `[WEBHOOK]` blocks in `config/crd/kustomization.yaml`
+  (conversion patches + the `configurations:` reference), along with the empty
+  `patches:` key they lived under and the `crdkustomizewebhookpatch` marker.
+  Kept the one-line `crdkustomizeresource` marker — `kubebuilder create api`
+  could legitimately run again.
+- `config/crd/kustomizeconfig.yaml` — only consumer was the removed
+  `configurations:` block.
+
+Verified: `bin/kustomize build config/default` and `... config/crd` both
+render cleanly (no dangling references), `go build`/`go vet` clean with and
+without `-tags=e2e`, `make test` green with coverage numbers identical to
+pre-cleanup.