Remove overwriting the default HTTP transport

[mozesl-nokia]

Remove overwriting the default HTTP transport

---

Description

• What changed: Removed overwriting the default HTTP transport and the tag resolution from podevaluator.
• Why it’s needed: Overwriting the default transport breaks regclient and is generally bad practice. The tag resolution is already done in the runtime before the evaluator is called.
• How it works:

---

Related Issue(s)

• None

---

Type of Change

• Bug fix
• Refactor

---

Checklist

• Code follows project style guidelines
• Self-reviewed changes
• Tests added/updated
• Documentation added/updated
• All tests and gating checks pass

---

Additional Notes (Optional)

• Known issues: This way, we are not strictly tracking all http traffic going in and out of porch, but most metrics are already exposed by the apiserver framework.
• Further improvements: Add E2E tests for tag resolution and TLS handling
• Review notes:

---

AI Disclosure

• I have used AI in the creation of this PR.

If so, please describe how:

• The new httpclient package and the refactor of the TLS handling in podevaluator was done by composer-2.5

[netlify]

✅ Deploy Preview for kpt-porch ready!

Name	Link
🔨 Latest commit	2b04dd2
🔍 Latest deploy log	https://app.netlify.com/projects/kpt-porch/deploys/6a579e75c027470008d6cdeb
😎 Deploy Preview	https://deploy-preview-1112--kpt-porch.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[Copilot]

Pull request overview

This PR removes global mutation of http.DefaultTransport (previously used for OpenTelemetry wrapping) and introduces a dedicated pkg/httpclient helper for constructing registry-focused HTTP transports/clients. It also refactors TLS handling for private registry pulls and removes tag-resolution logic from the pod evaluator path.

Changes:

• Added pkg/httpclient with a snapshot-based base *http.Transport and helpers to create registry transports/clients with optional TLS config.
• Removed OpenTelemetry wrapping of http.DefaultTransport in telemetry setup to avoid breaking downstream clients (e.g., regclient).
• Refactored private-registry TLS CA discovery/transport creation in podmanager and removed pod-evaluator tag resolution + related tests.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pkg/httpclient/registry.go	New shared HTTP transport/client helpers for registry outbound calls without mutating global defaults.
pkg/httpclient/registry_test.go	Adds unit tests for the new httpclient helpers.
internal/telemetry/otel.go	Removes global HTTP default transport/client wrapping during OTel setup.
go.mod	Reclassifies sigs.k8s.io/cli-utils as indirect after refactor.
func/internal/podmanager.go	Uses new registry transport helper and factors CA path discovery into a helper.
func/internal/podmanager_unit_test.go	Removes tests tied to the deleted in-file transport constructor.
func/internal/podevaluator.go	Refactors construction wiring and removes tag resolution prior to evaluation.
func/internal/podevaluator_unit_test.go	Updates evaluator unit tests to match removed tag-resolver wiring.
func/internal/podevaluator_tag_resolution_test.go	Deletes tag resolution unit tests (tag resolution no longer done here).
func/internal/executableevaluator_test.go	Minor test constant addition for shared test image name.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
90.9% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[nagygergo]

My problem with this one is that it will disable monitoring http metrics for the following paths:
external -> porch server
porch-server -> kube-apiserver
porch-server -> git
function-runner -> oci
function-runner -> kube-apiserver

[mozesl-nokia]

We can add these individually, probably

How can an external service call porch server directly btw? Shouldn't it just be through the kube apiserver?

[mozesl-nokia]

I will add these individual wrappers after #1111 is merged and this is rebased.