Run validation on secrets if it is used for plugin config to prevent dataplane stuck

[randmonkey]

Is there an existing issue for this?

• I have searched the existing issues

Problem Statement

FTI-5314, Also part of #2195
When a secret is used as configuration of KongPlugin or KongClusterPlugin (in ConfigFrom or ConfigPatches), we need to check if it will generate invalid configuration of kong plugin after the secret is applied when the secret is created or updated. This could prevent from generating invalid configuration of plugin when translating to kong state and then make the dataplane lock up.

Proposed Solution

• Update the admission webhook for checking secrets, when a secret is used as part of plugin configuration, reject it if the "new" value will generate an invalid one

Additional information

No response

Acceptance Criteria

• Updating Secret that will generate invalid kong plugin configuration will get rejected on the webhook.