Add missing namespace specification + address linting issues

[irby]

Fixes

• Fixes an issue where a namespace may not be properly applied if applying the Helm template without a namespace specified / using kubectl apply -f directly with the rendered template.
• Fixes an issue where the error message from a failed Enrollment API call is not logged.

Chores

• Update GitHub Actions workflow to check for policy enforcement on Helm chart rendered manifests in addition to checking for drift in generated CRDs.
• Fixes various linting issues in the codebase.

[Copilot]

Pull request overview

This PR improves Helm-rendered manifest safety and observability by enforcing explicit namespaces on namespace-scoped RBAC resources, adding Conftest policy checks for rendered manifests, and enhancing logging/error-wrapping in the controller + Command client.

Changes:

• Add Conftest Rego policies and CI/local targets to lint Helm-rendered manifests (including new CI values matrices).
• Ensure Helm templates explicitly set metadata.namespace where appropriate and add RBAC finalizer permissions.
• Improve Go code quality: better error wrapping (%w), log response bodies on failed enrollment, and address lint/test cleanups.

Reviewed changes

Copilot reviewed 25 out of 25 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
policy/serviceaccounts.rego	New Conftest policy requiring explicit namespace on ServiceAccounts.
policy/roles.rego	New Conftest policies for Role/RoleBinding namespaces and RBAC hygiene checks.
internal/controller/issuer_controller_test.go	Test refactors to use a single API import alias.
internal/controller/issuer_controller.go	Improve error wrapping; minor control-flow cleanup.
internal/controller/certificaterequest_controller_test.go	Remove unused crypto helpers/imports.
internal/controller/certificaterequest_controller.go	Improve error wrapping; add success log line after signing.
internal/command/command_test.go	Add coverage to assert failed EnrollCSR response body is included in error output.
internal/command/command.go	Include failed enrollment response body in error details; remove unused context plumb-through.
internal/command/client_test.go	Update tests for printClaims no longer returning an error.
internal/command/client.go	Change GetAllMetadataFields API to close response body internally; make printClaims fire-and-forget.
deploy/charts/command-cert-manager-issuer/templates/serviceaccount.yaml	Add explicit namespace to ServiceAccount metadata.
deploy/charts/command-cert-manager-issuer/templates/rolebinding.yaml	Add explicit namespaces to namespaced RoleBindings; conditionally omit for ClusterRoleBinding.
deploy/charts/command-cert-manager-issuer/templates/role.yaml	Add explicit namespaces to namespaced Roles; conditionally omit for ClusterRole.
deploy/charts/command-cert-manager-issuer/templates/clusterrole.yaml	Add finalizer subresource permission for clusterissuers.
deploy/charts/command-cert-manager-issuer/ci/default-values.yaml	Add CI values file to exercise namespaced RBAC paths.
deploy/charts/command-cert-manager-issuer/ci/cluster-access-values.yaml	Add CI values file to exercise cluster-wide RBAC paths.
cmd/main.go	Simplify error creation (use fmt.Errorf).
api/v1alpha1/issuer_types_test.go	Fix time comparison usage in tests.
api/v1alpha1/issuer_types.go	Minor slice manipulation cleanup in UnsetCondition.
Makefile	Add conftest/kube-linter tooling + manifest linting targets; update golangci-lint version/install logic.
CONTRIBUTING.md	Document local linting/testing workflow and Helm manifest linting.
CHANGELOG.md	Add release notes for v2.5.2.
.kube-linter.yaml	Add baseline kube-linter configuration.
.golangci.yml	Update golangci-lint configuration for v2 format and enable goimports formatter.
.github/workflows/test.yml	Restructure CI jobs to include linting + manifest checks (but currently drops running unit tests).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

This PR improves Kubernetes manifest hygiene and CI enforcement for the Helm chart, while also tightening Go error wrapping/logging and addressing various lint-driven refactors across controllers and Command client code.

Changes:

• Add Conftest Rego policies to enforce explicit namespaces on namespace-scoped RBAC/ServiceAccounts (and other RBAC correctness checks).
• Update Helm templates (ServiceAccount/Role/RoleBinding) to explicitly set namespaces and add CI values files for manifest linting scenarios.
• Refine Go codebase linting/error-handling (more %w wrapping, improved error detail logging for failed enrollment calls) and update CI workflow + lint configuration.

Reviewed changes

Copilot reviewed 25 out of 25 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
policy/serviceaccounts.rego	New Conftest policy requiring ServiceAccounts to set metadata.namespace.
policy/roles.rego	New Conftest policies for Role/RoleBinding namespace enforcement and RBAC/Deployment checks.
deploy/charts/command-cert-manager-issuer/templates/serviceaccount.yaml	Set ServiceAccount namespace explicitly from .Release.Namespace.
deploy/charts/command-cert-manager-issuer/templates/role.yaml	Set Role namespace explicitly (and conditionally for cluster-scoped variants).
deploy/charts/command-cert-manager-issuer/templates/rolebinding.yaml	Set RoleBinding namespace explicitly (and conditionally for cluster-scoped variants).
deploy/charts/command-cert-manager-issuer/templates/clusterrole.yaml	Add finalizers subresource to RBAC rules.
deploy/charts/command-cert-manager-issuer/ci/default-values.yaml	Add CI values file for namespace-scoped RBAC path testing.
deploy/charts/command-cert-manager-issuer/ci/cluster-access-values.yaml	Add CI values file for cluster-scoped RBAC + secure metrics path testing.
Makefile	Add Helm/conftest manifest lint targets and tooling installs; bump linter versions.
.github/workflows/test.yml	Split build/test and lint jobs; add Helm + manifest linting + CRD drift checks.
.golangci.yml	Update golangci-lint configuration format, linters, and formatter settings.
.kube-linter.yaml	Add kube-linter configuration scaffold.
CONTRIBUTING.md	Add contributor guidance for linting/manifests/policies and local workflows.
CHANGELOG.md	Add v2.5.2 entry describing the fixes/chores in this PR.
cmd/main.go	Improve health check interval validation error construction.
internal/controller/issuer_controller.go	Use %w wrapping and simplify secret type switch.
internal/controller/issuer_controller_test.go	Lint-driven import/type alias cleanup in tests.
internal/controller/certificaterequest_controller.go	Use %w wrapping and add a success log on signing completion.
internal/controller/certificaterequest_controller_test.go	Remove unused crypto helpers/imports from tests.
api/v1alpha1/issuer_types.go	Fix/clean up condition removal logic to mutate the backing slice directly.
api/v1alpha1/issuer_types_test.go	Update LastTransitionTime assertion to match type API.
internal/command/client.go	Change metadata fields API to close response body internally; make JWT claim printing non-error-returning.
internal/command/client_test.go	Align tests with printClaims no longer returning errors.
internal/command/command.go	Improve enrollment error detail construction and refactor request builder signatures.
internal/command/command_test.go	Add coverage asserting enrollment error includes response body content; refactor to match API changes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.