KEP-3488: CEL admission: Add graceful rollout, warning and audit support

[jpbetz]

• One-line PR description: Update the CEL admission KEP to support graceful policy rollout by adding ability to report validation failures only as warnings or audit annotations and for enhancing metrics to container the information needed to monitor a rollout.

• Issue link: KEP-3488: CEL Admission Control #3492

[jpbetz]

cc @maxsmythe @cici37 @liggitt @tallclair @andrewsykim

[jpbetz]

cc @liggitt

[jpbetz]

/assign @deads2k @lavalamp
Here is another small KEP update to ValidatingAdmissionPolicy is ready for an approver pass.

[lavalamp]

LGTM but two comments for you to look at first

[jpbetz]

Feedback applied. I've left some of the comment threads open where further discussion might be needed.

[liggitt]

thanks for the update, I did a quick sweep and my open questions were resolved

[jpbetz]

@deads2k @lavalamp All open issues on this one are resolved. It's ready for another approver pass.

[tallclair]

not something you need to address here, but I'm starting to worry that we're overusing audit annotations, and should start moving more metadata like this to dedicated fields.

[jpbetz]

Good point. I'm not satisfied with how the value payload works here. I'll admit to following precedence of other audit annotations rather than trying to re-think it. That said, I'd be okay with restructuring this. Any recommendations?

[jpbetz]

Thanks @tallclair, I've incorporated the feedback into the KEP. I've left some of the comments open until you've gotten a chance to respond.

[jpbetz]

@lavalamp this is ready for another approver pass.

[jpbetz]

Thanks @lavalamp, feedback applied.

[lavalamp]

/lgtm
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jpbetz, lavalamp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• keps/sig-api-machinery/OWNERS [jpbetz,lavalamp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment