fix: make Project Contour ingress integration opt-in (crash loop without HTTPProxy CRD)

[amuraru]

Problem

Installing the operator on a cluster without Project Contour puts the pod in CrashLoopBackOff — even when Contour ingress is never used. This is the crash loop reported in #229.

Root cause: the KafkaCluster controller unconditionally registers a watch on Project Contour's HTTPProxy CRD:

// controllers/kafkacluster_controller.go
contourWatches(builder)   // -> Owns(&contour.HTTPProxy{})

When the projectcontour.io/v1 HTTPProxy CRD is absent, controller-runtime can never sync that informer, so mgr.Start fails with:

failed to wait for KafkaCluster caches to sync kind source: *v1.HTTPProxy: timed out waiting for cache to be synced

…and the process exits → crash loop. The Helm chart never shipped or required the Contour CRD, so a clean install is broken out of the box (the reporter's workaround was to manually kubectl apply the Contour CRDs).

This unconditional watch was introduced in #82 ("Adding Contour Ingress support").

Fix (Option A: opt-in flag, mirroring cert-manager)

• New --contour-enabled flag (default false), matching the existing --cert-manager-enabled pattern. The Contour HTTPProxy watch is only registered when it's set.
• Wired through the Helm chart as contour.enabled (default false) → --contour-enabled={{ .Values.contour.enabled }}.
• Default installs now start cleanly with no dependency on Project Contour. Users of ingressController: contour opt in via contour.enabled=true (which requires the HTTPProxy CRD to be installed).

Tests

• New regression test controllers/tests/contourwatch: boots an envtest API server without the Contour CRD and asserts the manager stays healthy when Contour is disabled. Verified it fails before the fix (reproduces the exact *v1.HTTPProxy sync timeout) and passes after (TDD red→green).
• Existing Contour integration specs (Label("contour")) still pass with contour.enabled=true.
• The e2e suite installs Contour as a dependency, so it now sets contour.enabled=true to keep exercising the integration end-to-end.

Upgrade note

Deployments that rely on Contour ingress must set contour.enabled=true after this change (previously always-on). Default/envoy users are unaffected and no longer need the Contour CRD.

Notes

• The docs/version portion of Fix Kafka Operator Crash Loop - Dependency of Project Contour's HTTPProxy Custom Resource Definition (CRD) #229 (OCI --version requirement) is being handled separately.

Fixes #229
Introduced by #82

🤖 Generated with Claude Code

[amuraru]

cc @dobrerazvan — this gates the Project Contour HTTPProxy watch you added in #82 behind a new --contour-enabled flag (default off), so default installs no longer crash-loop without the Contour CRD (#229). Would appreciate your review, especially the upgrade note: deployments using ingressController: contour must now set contour.enabled=true.