[Feature] Make MutatingWebhookConfiguration, ValidatingWebhookConfiguration name configurable

[iAnomaly]

Problem Statement

Multiple sources confirm anecdotally that the Kubernetes admission webhook requests are processed serially in lexicographical order. Given that Kyverno is a policy enforcement solution, it should be able to be configure as close as possible to the beginning of this pipeline.

Solution Description

*WebhookConfiguration names currently appeared hard coded here. Solution should support overriding these via runtime configuration (environment variables, command arguments, etc.) that can also be configured through Helm Chart values.

Alternatives

No response

Additional Context

I am trying to label Pods with a Kyverno policy for service mesh proxy injection by Istio but Istio's MutatingWebhookConfiguration responsible for injecting said Pods is lexicographically "lower" (comes before) Kyverno's:

...
mutatingwebhookconfiguration.admissionregistration.k8s.io/istio-sidecar-injector
...
mutatingwebhookconfiguration.admissionregistration.k8s.io/kyverno-resource-mutating-webhook-cfg
...

Slack discussion

https://kubernetes.slack.com/archives/CLGR9BJU9/p1691624820592279

Research

• I have read and followed the documentation AND the troubleshooting guide.
• I have searched other issues in this repository and mine is not recorded.

[welcome]

Thanks for opening your first issue here! Be sure to follow the issue template!

[chipzoller]

The only webhook which would benefit from a custom name is the resource mutating webhook.

[iAnomaly]

@chipzoller: Initial attempt at resolving this issue in #8059. How do you feel about applying the same prefix to all mutating webhooks for consistency even if the resource mutating webhook is the only one that would benefit functionally?

[chipzoller]

Probably not an issue but it would need to be attended carefully to ensure there are no code paths which reference static names anywhere.