Add ImagePolicyWebhook docs

[ecordell]

This documents the ImagePolicyWebhook Admission controller as proposed in the image-provenance proposal.

cc @kubernetes/docs

---

This change is

[philips]

LGTM, thanks @ecordell

[jaredbhatti]

Part of kubernetes/enhancements#59

[jaredbhatti]

@ecordell Can you make this change against the release-1.4 branch instead of master?

[googlebot]

We found a Contributor License Agreement for you (the sender of this pull request) and all commit authors, but as best as we can tell these commits were authored by someone else. If that's the case, please add them to this pull request and have them confirm that they're okay with these commits being contributed to Google. If we're mistaken and you did author these commits, just reply here to confirm.

[googlebot]

CLAs look good, thanks!

[ecordell]

@jaredbhatti done!

[devin-donnelly]

@ecordell , would you mind rebasing this on the latest in release-1.4 real quick? I'm testing out a new staging capability.

[Q-Lee]

*access

[Q-Lee]

Please mention the flag required to turn this feature on (ImageReviewPolicy). Other than that I found 1 typo and like the rest.

[ecordell]

Nice catch @Q-Lee (I have a sticky e key)

Added info on enabling the controller to the intro in the docs.

[Q-Lee]

LGTM, @davidopp do you want to apply the lgtm label?

[devin-donnelly]

Review status: 0 of 1 files reviewed at latest revision, 4 unresolved discussions.

---

docs/admin/admission-controllers.md, line 83 [r2] (raw file):

### ImagePolicyWebhook

This plug-in will allow admission decisions to be made by a backend webhook. It must be enabled with:

Passive voice/future tense/pronouns.

"The ImagePolicyWebhook plug-in allows a backend webhook to make admission decisions. You enable this plug-in by setting the admission-control option as follows:"

---

docs/admin/admission-controllers.md, line 90 [r2] (raw file):

#### Configuration File Format
It uses the admission controller config file (`--admission-controller-config-file`) to set configuration options for the behavior of the backend. This file may be json or yaml and has the following format:

"ImagePolicyWebhook uses the admission controller config file..."

---

docs/admin/admission-controllers.md, line 106 [r2] (raw file):

The config file must reference a [kubeconfig](/docs/user-guide/kubeconfig-file/) formatted file which sets up the connection to the backend. It is required that the backend communicate over TLS.

The kubeconfig's cluster field is used to refer to the remote service, user refers to the returned authorizer.

The kubeconfig file's cluster field must point to the remote service, and the user field must contain the returned authorizer.

---

Comments from Reviewable

[ecordell]

@devin-donnelly fixed

[devin-donnelly]

---

Review status: 0 of 1 files reviewed at latest revision, 4 unresolved discussions.

---

Comments from Reviewable

[devin-donnelly]

Good from my perspective. Adding the tech review tag to make sure this gets a tech LGTM.

[devin-donnelly]

Never mind, looks like @philips took care of it. I'll merge this one in.