Constant S3_TLS_SKIP_VERIFY_WARNING 

pub const S3_TLS_SKIP_VERIFY_WARNING: &str = "s3 tls: insecureSkipVerify wins at kopia — the \
     referenced caBundleRef CA bundle is ignored while it is set; remove insecureSkipVerify \
     once the CA bundle verifies the endpoint";

The actionable admission warning for an S3 backend pairing tls.caBundleRef with tls.insecureSkipVerify: true: kopia’s --disable-tls-verification wins, so the referenced CA bundle is ignored while insecureSkipVerify is set. Deliberately a WARNING, never a hard error — the ClusterRepository and RepositoryReplication reconcilers defensively re-validate the FULL spec on every reconcile and hard-error on failure, so promoting this combination to an error would brick every already-persisted CR carrying it on operator upgrade, with no admission request in flight for a user to react to. (The caBundleRef + disableTls contradiction IS a hard error, but only because caBundleRef never worked at all before this validation existed — no working CR can carry it.) Kept short for the admission response (kube truncates very long warnings).