Update cert-rotator to 0.2.0; tweak test targets

This change uses an "official" cert-rotator release for the first time,
and includes support for v1 of all K8s APIs.

It also introduces the "test-smoke" target that only runs the quickstart
tests, to allow for faster local development. This allows developers to
rely more heavily on the postsubmit and periodic tests we worked so hard
to set up for HNC.

Finally, it clarifies some of the warnings around HNC_REPAIR.

Tested: make test-smoke passes. Tried running 'make test-e2e' with and
without HNC_REPAIR set to verify that the warnings look correct in both
cases.

incubator/hnc/Makefile

@@ -258,21 +258,28 @@ kind-deploy:
 # Go test suite has a 10m timeout, and the flag disables that timeout (as of
 # July 2020, these tests take ~15m and that number is expected to grow).
 .PHONY: test-e2e
-test-e2e: exclude-system-namespaces
+test-e2e: warn-hnc-repair exclude-system-namespaces
 	go clean -testcache
 	go test -v -timeout 0 ./test/e2e/...
 
 # This batch test will run e2e tests N times on the current cluster the user
 # deployed (either kind or a kubernetes cluster), e.g. "make test-e2e-batch N=10"
 .PHONY: test-e2e-batch
-test-e2e-batch: exclude-system-namespaces
+test-e2e-batch: warn-hnc-repair exclude-system-namespaces
 	number=1 ; while [[ $$number -le $N ]] ; do \
 		echo $$number ; \
     ((number = number + 1)) ; \
 		go clean -testcache ; \
 		go test -v -timeout 0 ./test/e2e/... ; \
 	done
 
+# This will *only* run a small number of tests (specifically, the quickstarts). You can run this when you're fairly confident that
+# everything will work, but be sure to watch for the postsubmits and periodic tests to ensure they pass too.
+.PHONY: test-smoke
+test-smoke: exclude-system-namespaces
+	go clean --testcache
+	go test -v -timeout 0 ./test/e2e/... -args --ginkgo.focus "Quickstart"
+
 # exclude-system-namespaces is called before we run any e2e tests. We do ensure
 # the system namespaces are excluded in the "deploy" target. However, we need to
 # do it here too in case users install HNC by applying manifests. Ensuring the
@@ -289,14 +296,27 @@ exclude-system-namespaces:
 	@echo "If these tests fail due to the webhook not being ready, wait 30s and try again. Note that webhooks can take up to 30s to become ready"
 	@echo "after HNC is first deployed in a cluster."
 	@echo
+
+warn-hnc-repair:
+	@echo "************************************************************"
 ifndef HNC_REPAIR
-	@echo "******************************************************"
 	@echo "HNC_REPAIR IS NOT SET. CRITICAL TESTS WILL BE SKIPPED."
-	@echo "You have 5s to hit Ctrl-C to cancel and try again."
-	@echo "******************************************************"
 	@echo
-	@sleep 5
+	@echo "If HNC is installed via an operator (e.g. GKE Hierarchy"
+	@echo "Controller), this is probably what you want to do. Otherwise,"
+	@echo "consider setting HNC_REPAIR to run the full set of tests."
+else
+	@echo "HNC_REPAIR IS SET; ENSURE YOU HAVE PERMISSION TO DELETE HNC."
+	@echo
+	@echo "If HNC is installed via an operator (e.g. GKE Hierarchy"
+	@echo "Controller), these tests will fail and your cluster could"
+	@echo "be left in a bad state."
 endif
+	@echo
+	@echo "You have 5s to hit Ctrl-C to cancel..."
+	@echo "************************************************************"
+	@echo
+	@sleep 5
 
 ###################### RELEASE ACTIONS #########################
 # Build the container image by Cloud Build and build YAMLs locally

incubator/hnc/go.mod

@@ -12,7 +12,7 @@ require (
 	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
 	github.com/onsi/ginkgo v1.14.1
 	github.com/onsi/gomega v1.10.2
-	github.com/open-policy-agent/cert-controller v0.0.0-20210202184811-4842e4760ab0
+	github.com/open-policy-agent/cert-controller v0.2.0
 	github.com/spf13/cobra v1.1.1
 	go.opencensus.io v0.22.3
 	go.uber.org/zap v1.15.0