Address copilot comments and update 3pp versions

Signed-off-by: Fiachra Corcoran <fiachra.corcoran@est.tech>

Author: efiacor

docs/config.toml

@@ -71,12 +71,13 @@ version = "latest"
 latestTag = "1.5.7"
 
 # latest tested versions
-version_docker = "v28.1.1"
-version_go = "v1.25.3"
-version_git = "v2.51.2"
-version_kind = "v0.30.0"
-version_kube = "v1.34.2"
-version_kpt = "v1.0.0-beta.62.1"
+version_docker = "28.0.4"
+version_go = "1.26.3"
+version_git = "2.54.0"
+version_kind = "0.32.0"
+version_kube = "1.36.1"
+version_kpt = "1.0.0-beta.67"
+version_certmanager = "1.21.1"
 
 # A link to latest version of the docs. Used in the "version-banner" partial to
 # point people to the main doc site.

docs/content/en/docs/6_configuration_and_deployments/configurations/components/porch-webhooks/cert-manager-webhooks.md

@@ -13,14 +13,16 @@ Self-signed certificates are generated by `scripts/webhook-utils.sh` during depl
 
 The limitation of self-signed certificates is that they don't auto-rotate before expiration, which can cause webhook outages if not manually renewed.
 
-## Production Setup with cert-manager
+## cert-manager Setup (Example)
+
+This section shows a basic cert-manager setup using self-signed certificates. This approach is suitable for testing and development environments. For production deployments with organizational trust requirements, use a CA-backed issuer or ACME provider instead.
 
 Use cert-manager for automatic certificate management:
 
 1. **Install cert-manager** (if not already installed):
 
 ```bash
-kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.0/cert-manager.yaml
+kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v{{ .Site.Params.version_certmanager }}/cert-manager.yaml
 ```
 
 2. **Create an Issuer** that signs webhook certificates:
@@ -65,7 +67,9 @@ kubectl apply -f issuer.yaml
 kubectl apply -f certificate.yaml
 ```
 
-Once deployed, cert-manager automatically manages the certificate lifecycle. It creates and updates the Secret `porch-controllers-webhook-tls`, watches for expiration, rotates before renewal, and patches the caBundle into ValidatingWebhookConfiguration resources. No code changes or manual intervention required—the porch-controllers pod automatically uses the updated certificate.
+Once deployed, cert-manager automatically manages the certificate lifecycle. It creates and updates the Secret `porch-controllers-webhook-tls`, watches for expiration, and rotates before renewal.
+
+The `caBundle` is automatically patched into ValidatingWebhookConfiguration resources when cert-manager's CA injector is enabled (via the `cert-manager.io/inject-ca-from` annotation on the webhook configuration). This requires cert-manager's cainjector component. Without it, you must manually patch the caBundle or use a webhook configuration that references the certificate directly. The porch-controllers pod automatically uses the updated certificate once it's in place.
 
 ## Certificate Paths