Add CRD integration tests for ValidatingAdmissionPolicy

[DangerOnTheRanger]

What type of PR is this?

/kind feature

What this PR does / why we need it:

This PR adds integration tests that check CRD parameter resources can be used with ValidatingAdmissionPolicy. This PR also adds an additional test (TestBindingRemoval) that was originally intended to merge as a part of #113314.

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

[k8s-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[k8s-ci-robot]

@DangerOnTheRanger: This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[andrewsykim]

Should the expression use the param object to compare it against the object being validated in some way?

[andrewsykim]

Maybe compare someNum against a Deployment's replicaset or similar?

[DangerOnTheRanger]

I changed it to use strings/a similar name check as with some of the other tests - it's a bit similar to the ConfigMap tests now, but I think the CRD codepaths are still being hit, so it should be fine.

[andrewsykim]

Ran TestBindingRemoval locally a few times and I think it's flaky:

--- FAIL: TestBindingRemoval (4.72s)
    testserver.go:414: Resolved testserver package path to: "/home/andrewsy/go/src/k8s.io/kubernetes/cmd/kube-apiserver/app/testing"
    testserver.go:245: runtime-config=map[api/all:true]
    testserver.go:246: Starting kube-apiserver on port 32779...
    testserver.go:266: Waiting for /healthz to be ok...
    validatingadmissionpolicy_test.go:2042: expected namespace creation to succeed: namespaces "test-namespace" is forbidden: ValidatingAdmissionPolicy 'test-policy' with binding 'test-binding' denied request: policy still in effect
FAIL

[DangerOnTheRanger]

/retest

[andrewsykim]

LGTM, commits need to be cleaned up though (a commit per new test seems fine)

Not sure if release team is accepting new test PRs at this point (we're past test freeze I think). Putting the v1.26 milestone to put this on the release team's radar and will defer to them.

/milestone v1.26

[DangerOnTheRanger]

(force push to squash commits)

[cici37]

/release-note none

[cici37]

/release-note-none

[andrewsykim]

/milestone clear

(based on discussion with release team to defer this to v1.27)

[andrewsykim]

/approve
/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: andrewsykim, DangerOnTheRanger

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• test/integration/apiserver/OWNERS [andrewsykim]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment