implement Mutating Admission Policy

[olamilekan000]

Summary

change implements Mutating Admission Policy for both workspace-scoped and inter-workspace mutation

What Type of PR Is This?

/kind feature

Related Issue(s)

Fixes 3291

Release Notes

Added implementation of Mutating Admission Policy

[kcp-ci-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign mjudeikis for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS
• config/crds/OWNERS
• pkg/admission/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[mjudeikis]

Did you manage to find the issue with this on?

[olamilekan000]

Did you manage to find the issue with this on?

Yes, I did leave them as comment in the PR
1: https://github.com/kcp-dev/kcp/pull/3781/changes#diff-6fe5375231e6ece6cd7eafb4e8a2370fcd2059f8026d84de6fc647a641318da9R416-R418
2. https://github.com/kcp-dev/kcp/pull/3781/changes#diff-44c96ee1d9fbbf3da5546d72aefffff897783f90c8911d9ac7695fcb94ab49acR220-R223
3. https://github.com/kcp-dev/kcp/pull/3781/changes#diff-44c96ee1d9fbbf3da5546d72aefffff897783f90c8911d9ac7695fcb94ab49acR220-R223
4. It also disables plugin by default. I have to enable with plugin.SetEnabled(true) it for it "work".

For more contexts, the package for interacting with MutatingAdmissionPolices doesn't seem complete https://pkg.go.dev/k8s.io/apiserver@v0.35.0/pkg/admission/plugin/policy/mutating#pkg-functions. If you compare it wih ValidatingAdmissionPolicy, you'll see that it seems more mature than it.https://pkg.go.dev/k8s.io/apiserver@v0.35.0/pkg/admission/plugin/policy/validating#NewPlugin

Additionally, the package lacks methods like CompilePolicy, which I had to recreate (I feel this is incorrect), and it also fails to start informers automatically.

[mjudeikis]

we decided to put this on ice until 1.35 rebase. Due to MAP being still not fully implemented in upstream