feat: gate the WAF management UI on the waf-ui-config ConfigMap

[electricjesus]

Jira: https://tigera.atlassian.net/browse/EV-6793

Description

New feature. This turns the WAF management UI on or off per cluster, using the waf-ui-config ConfigMap in calico-system, keyed waf-ui-enabled. An admin creates and edits it. The operator only reads it.

A missing ConfigMap, a missing key, or a value it cannot parse all read as disabled. So the feature stays off until an admin turns it on, and deleting the switch turns it back off.

This PR used to add a wafUI field to the Manager CRD, copying the old rbacUI field. #5114 replaced that pattern with the ConfigMap gate and deleted spec.rbacUI, so this now follows the same shape. No CRD change and no API change.

One difference from the RBAC gate. ui-apis watches rbac-ui-config and picks up a change live. It does not watch the WAF one: it reads WAF_UI_ENABLED at startup (see ui-apis/pkg/server/config.go). So the operator reads the ConfigMap and writes the value onto the container, and flipping the switch rolls the manager Deployment. Moving ui-apis onto a live read would be a nice follow-up, and it would drop the env var.

tigera-network-admin gets write access to the switch, next to the RBAC one, ungated. A rule that only shows up while the feature is on could never be used to turn it on.

This only controls whether the WAF management UI shows up. It does not turn on WAF enforcement, which is still configured through GatewayAPI.spec.extensions.waf. The two are meant to be independent.

The ui-apis half is already merged: https://github.com/tigera/calico-private/pull/12655 adds the /waf/v1 routes behind WAF_UI_ENABLED.

No kube-controllers change. The WAF handlers impersonate the calling user, and the end-user WAF CRD permissions already exist in the apiserver.

Affected component: operator (manager render, apiserver render, manager controller).

Testing:

• go test ./pkg/render/ ./pkg/render/common/wafmanagement/ ./pkg/controller/manager/ ./pkg/controller/utils/ ./pkg/controller/apiserver/ all pass.
• New wafmanagement gate specs cover nil, missing key, true, True, 1, false, junk, and empty.
• New manager render specs assert WAF_UI_ENABLED tracks the flag both ways.
• New manager controller specs cover no ConfigMap, true, false, and an unreadable ConfigMap degrading instead of reading as off.
• Updated the tigera-network-admin rule fixtures in apiserver_test.go for the new resource name.

Release Note

Added the waf-ui-config ConfigMap in calico-system to enable the WAF management UI.

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • kind/bug if this is a bugfix.
  • kind/enhancement if this is a a new feature.
  • enterprise if this PR applies to Calico Enterprise only.