set/validate object namespace before admission

[liggitt]

What type of PR is this?

/kind bug
/kind cleanup

What this PR does / why we need it:
Ensures the namespace population/check that occurs before an object is persisted is done before it is sent to admission. This ensures the namespace in the object matches the request namespace attribute.

Currently, namespaced objects can be sent to admission with empty namespaces during creation (and are defaulted to match the request namespace just before persisting) or a mismatched namespace (and are rejected just before persisting).

Added tests around the following scenarios:

• cluster-scoped, no namespace in object
• cluster-scoped, mismatched namespace in object
• namespaced, no namespace in object
• namespaced, matching namespace in object
• namespaced, mismatched namespace in object

xref https://github.com/kubernetes/kubernetes/issues/88282

Does this PR introduce a user-facing change?:

kube-apiserver: ensures the namespace of objects sent to admission webhooks matches the request namespace. Previously, objects without a namespace set would have the request namespace populated after mutating admission, and objects with a namespace that did not match the request namespace would be rejected after admission.

/cc @deads2k

[k8s-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[lavalamp]

/assign @deads2k
cc @MikeSpreitzer @yue9944882

[MikeSpreitzer]

Do not forget that CRDs are still not fully up to the job of obviating the original way of defining new resources using aggregated custom apiservers. Some of us are doing that, with a distinct etcd cluster for the custom resources too. Now think about backup/restore of the etcd clusters. It would be best if there is a rigorous independence of their content. It might be best to not require one etcd cluster to contain a namespace object in order to persist an object in a different etcd cluster.

[liggitt]

Do not forget that CRDs are still not fully up to the job of obviating the original way of defining new resources using aggregated custom apiservers. Some of us are doing that, with a distinct etcd cluster for the custom resources too. Now think about backup/restore of the etcd clusters. It would be best if there is a rigorous independence of their content. It might be best to not require one etcd cluster to contain a namespace object in order to persist an object in a different etcd cluster.

That is unrelated to this PR.

The API server currently ensures the namespace in the request path and the namespace in the object match prior to persisting in etcd, but that check is done post-admission. This PR ensures that check is done prior to admission to avoid sending namespaced objects to admission with their namespace field unset (to be filled in later prior to persistence) or mismatching the request (to be rejected later prior to persistence).

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

[fedebongio]

/assign @jpbetz
Joe would you be able to take a look?
/remove-triage accepted

[jpbetz]

/triage accepted

[deads2k]

/lgtm
/hold cancel