KEP-3962: MutatingAdmissionPolicy Alpha

[jpbetz]

What type of PR is this?

/kind feature

What this PR does / why we need it:

Implements alpha of kubernetes/enhancements#3962

This supersedes #126497 to include:

• API Updated to support JSON Patch and Apply Configuration mutations
• Remove message and messageExpression since they have no obvious relevance for mutation
• JSON Patch implementation + "jsonpatch.escapeKey()" CEL function
• Variables
• Runtime cost
• request variable
• authorizer variable
• type check: CEL Object types must match field name paths
• CRD version conversion
• matchConditions
• failurePolicy handling
• relocation of reinvocationPolicy field to spec level
• Disallow mutation of atomics with apply configurations
• integration testing of: CRDs, CRD version conversion, matchConditions, failurePolicy, subresources, authorizers, request variables, json patch

Which issue(s) this PR fixes:

Special notes for your reviewer:

• CEL expressions for Validating and Mutating admission policy are not type checked at compile time because there is no guarantee that the type to be validated exists yet (for CRDs), and the expressions are allowed to match multiple types. This has lots of ripple effects in this PR. At runtime we do some additional type checking.. I've added some type mismatch checking to avoid obvious errors, but there are still significant gaps, even at runtime. I have additional work not yet in this PR that takes the type checking further, but I figured it would be good to get a baseline implementation reviewed and then iterate.

Does this PR introduce a user-facing change?

Introduce v1alpha1 API for mutating admission policies, enabling extensible admission control via CEL expressions (KEP  3962: Mutating Admission Policies). To use, enable the `MutatingAdmissionPolicy` feature gate and the `admissionregistration.k8s.io/v1alpha1` API via `--runtime-config`.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

Please use the following format for linking documentation:

• KEP

[jpbetz]

/label api-review

This needs additional tests but is otherwise feature complete and ready for API review.

[jpbetz]

/triage accepted
/priority important-longterm

[sttts]

/lgtm
/approve

/assign @deads2k
for final API review and approval.

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: 59aabefafd6d980290490755f44ea9e39d30ff16

[jpbetz]

/retest

Flake was:

Kubernetes e2e suite: [It] [sig-node] Lifecycle Sleep Hook [NodeConformance] when create a pod with lifecycle hook using sleep action reduce GracePeriodSeconds during runtime expand_less	39s
{ failed [FAILED] unexpected delay duration before killing the pod, cost = 20.523691046s
In [It] at: k8s.io/kubernetes/test/e2e/common/node/lifecycle_hook.go:610 @ 11/05/24 13:29:02.553
}

[Jefftree]

@aaron-prindle fyi something like this could cause our feature gate test to fail with 1.32 emulating 1.31. We should special case scenarios where gates were introduced and then deferred to a following release.

[aaron-prindle]

Discussed offline, the Compatility versions feature gate integration test that verifies gates are correct for n-1..3 versions (eg: binary @ 1.32 using --emulated-version=1.31 is in compliance with the feature gates from 1.31) already will work for this change as it is an alpha API and alpha APIs are allowed to be removed w.r.t to Compatibility versions

[deads2k]

/approve

[jpbetz]

/assign @seans3 or @soltysh would either of you be willing to approve the printer changes here?

[ardaguclu]

/lgtm

[ardaguclu]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ardaguclu, deads2k, jpbetz, sttts

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [sttts]
• api/OWNERS [deads2k]
• pkg/api/OWNERS [deads2k]
• pkg/apis/OWNERS [deads2k]
• pkg/controlplane/apiserver/samples/generic/OWNERS [deads2k,jpbetz,sttts]
• pkg/features/OWNERS [ardaguclu,deads2k,jpbetz,sttts]
• pkg/generated/openapi/OWNERS [deads2k,sttts]
• pkg/kubeapiserver/OWNERS [deads2k,jpbetz,sttts]
• pkg/printers/OWNERS [ardaguclu]
• pkg/registry/admissionregistration/OWNERS [deads2k,jpbetz]
• staging/src/k8s.io/api/OWNERS [deads2k]
• staging/src/k8s.io/apiserver/OWNERS [deads2k,jpbetz,sttts]
• staging/src/k8s.io/client-go/OWNERS [deads2k,jpbetz,sttts]
• test/OWNERS [deads2k,sttts]
• test/featuregates_linter/test_data/OWNERS [ardaguclu,deads2k,jpbetz,sttts]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment