Support excluding certain namespaces in admission webhook configuration

[randmonkey]

From FTI-6400.
Customers failed to update kube-dns service in kube-system because the validating admission webhook fails.
We could Add such namespace selector in admission webhook configuration to exclude kube-system service:

  ingressController:
    admissionWebhook:
      namespaceSelector:
        matchExpressions:
          - key: kubernetes.io/metadata.name
            operator: NotIn
            values:
              - kube-system

[lahabana]

@pmalek mentioned there are existing selectors in admission webhooks. This may bring breaking changes.

Is the right behaviour to change the default in values.yaml? It's technically a breaking change but you can always override it by explicitly setting the value to {}.
This change would require proper documentation but I feel like the annoyance to many valid use cases (blocking EKS upgrades) warrants annoying a few non recommended use-cases. WDYT?

[pmalek]

To be precise the one that user hit is in

charts/charts/kong/templates/admission-webhook.yaml

Lines 146 to 149 in 73ed470

	{{- with .Values.ingressController.admissionWebhook.namespaceSelector }}
	namespaceSelector:
	{{- toYaml . | nindent 4 }}
	{{- end }}

as that's the webhook that validates services.

Is the right behaviour to change the default in values.yaml? It's technically a breaking change but you can always override it by explicitly setting the value to {}.

This could potentially break users' configurations where they rely on webhook and deploy Service (for KIC to reconcile) in kube-system ns. Probably the blast radius is small but it's possible. I'd suggest to document this in kong/README.md (perhaps in a section Excluding objects from webhook validation) rather than change this in a minor/patch version bump.