[yaml/v2] Support for resource ordering (implicit and explicit)

[EronWright]

Proposed changes

This PR adds support for resource ordering within a ConfigGroup or ConfigFile. Two approaches are supported (and work in combination):

1. implicit dependencies: the provider uses heuristics to install CRDs and namespaces first.
2. explicit dependencies: the provider understands the config.kubernetes.io/depends-on annotation to explicitly declare a dependency on a given resource.

The implementation is based on kubernetes-sigs/cli-utils and its support for resource ordering (documentation).

To be clear, ordering across ConfigGroup resources is supported already, simply using the dependsOn option. This PR adds a more granular ordering within the group.

Testing

New test cases were added to verify the new behavior. Many tests rely on a common manifest file, and it is updated to include a CRD and a namespace.

Manual testing was performed with the following well-known manifests:

1. knative-serving-core (ref)
2. cert-manager (ref)

Example

Here's an example that installs cert-manager then provisions a certificate issuer and a TLS certificate. An explicit dependency is drawn between the Certificate and Issuer.

name: issue-2881-cert-manager
runtime: yaml
description: Installs cert-manager.  See https://cert-manager.io/docs/installation/kubectl/ for details.
variables: {}
resources:
  install:
    type: kubernetes:yaml/v2:ConfigGroup
    properties:
      files:
      - https://github.com/cert-manager/cert-manager/releases/download/v1.14.4/cert-manager.yaml
  test:
    type: kubernetes:yaml/v2:ConfigGroup
    options:
      dependsOn:
      - ${install}
    properties:
      yaml: |
        apiVersion: v1
        kind: Namespace
        metadata:
          name: cert-manager-test
        ---
        apiVersion: cert-manager.io/v1
        kind: Issuer
        metadata:
          name: test-selfsigned
          namespace: cert-manager-test
        spec:
          selfSigned: {}
        ---
        apiVersion: cert-manager.io/v1
        kind: Certificate
        metadata:
          name: selfsigned-cert
          namespace: cert-manager-test
          annotations:
            config.kubernetes.io/depends-on: cert-manager.io/namespaces/cert-manager-test/Issuer/test-selfsigned
        spec:
          dnsNames:
            - example.com
          secretName: selfsigned-cert-tls
          issuerRef:
            name: test-selfsigned

Within the stack state, one sees dependencies, e.g. on the Certificate resource.

{
    "urn": "urn:pulumi:dev::issue-2881-cert-manager::kubernetes:yaml/v2:ConfigGroup$kubernetes:cert-manager.io/v1:Certificate::test-cert-manager-test/selfsigned-cert",
    "id": "cert-manager-test/selfsigned-cert",
    "type": "kubernetes:cert-manager.io/v1:Certificate",
    "dependencies": [
        "urn:pulumi:dev::issue-2881-cert-manager::kubernetes:yaml/v2:ConfigGroup$kubernetes:cert-manager.io/v1:Issuer::test-cert-manager-test/test-selfsigned",
        "urn:pulumi:dev::issue-2881-cert-manager::kubernetes:yaml/v2:ConfigGroup$kubernetes:core/v1:Namespace::test-cert-manager-test"
    ]
}

Related issues (optional)

Closes #2881

[github-actions]

Does the PR have any schema changes?

Looking good! No breaking changes found.
No new resources/functions.

[codecov]

Codecov Report

Attention: Patch coverage is 81.13208% with 10 lines in your changes are missing coverage. Please review.

Project coverage is 27.19%. Comparing base (a6d364a) to head (119beeb).

Files	Patch %	Lines
provider/pkg/provider/yaml/v2/yaml.go	83.67%	4 Missing and 4 partials ⚠️
provider/pkg/provider/yaml/v2/configgroup.go	50.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2894      +/-   ##
==========================================
+ Coverage   26.97%   27.19%   +0.22%     
==========================================
  Files          53       53              
  Lines        7748     7780      +32     
==========================================
+ Hits         2090     2116      +26     
- Misses       5483     5486       +3     
- Partials      175      178       +3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[blampe]

Looks reasonable - just some small comments/questions.

[blampe]

Suggested change

	func Expand(objs []unstructured.Unstructured) ([]unstructured.Unstructured, error) {
	func expand(objs []unstructured.Unstructured) ([]unstructured.Unstructured, error) {

Or is there a reason this is public?

[EronWright]

I made it public for symmetry with Parse and Register, all of which are useful when implementing a component resource. It so happens that ConfigGroup and ConfigFile are in the same package, but Chart wouldn't be. That said, I don't anticipate any actual usages.

[EronWright]

BTW, I plan to rename Expand to Normalize in this follow-up PR and perform a couple of other fixups.
#2897

[lblackstone]

This change also relates to the following issues:
#1098
#1671
#2227

[rquitales]

LGTM