Code change:
[x] write e2e tests for all admission operations [x] (for resource APIs) [x] (for discovery docs) [x] switch to v1 admission APIs in e2e - [x] remove skips/time.Sleeps - and promote to conformance tests - AdmissionWebhook should have tests for all stable operations. Those tests should go through the conformance process before being released. This ticket is to help track what operations are yet to be covered by conformance tests. These stable endpoints should be hit by e2e tests tagged with [conformance]. There are tests currently hitting 6 of the corresponding beta endpoints that could be updated to use stable. Tests should be written to exercise the remaining 9 untested stable endpoints as well. These twelve tests could be updated to use the stable API, and subsequently promoted to conformance. / ! ! These will need tests written for them.  untested beta/admissionregistration !
/sig api-machinery
/assign
/area conformance
/assign ^ This is a requirement for graduation to GA.
can we get another apisnoop run? We've coverage for admissionregistration and apiextensions and I'd like to get confirmation from apisnoop that we've got full coverage now.
Keeping this open until tests are actually promoted to conformance
is ready for review. It adds our admission e2e tests to conformance as part of graduation to GA.
is updated currently not hit by any tests, one will need to be updated or written to cover it. Might want to ensure you've promoted one test that hit's each endpoint. !
The PR to do that is at

Related discussion:
text: MatchLabels: map[string]string{f.UniqueName: "true"}, } <del> sideEffectsNone := admissionregistrationv1.SideEffectClassNone </del> _, err := createValidatingWebhookConfiguration(f, &admissionregistrationv1.ValidatingWebhookConfiguration{ ObjectMeta: metav1.ObjectMeta{ Name: configName, }, Webhooks: []admissionregistrationv1.ValidatingWebhook{ <del> { Name: "deny-unwanted-pod-container-name-and-label.k8s.io", Rules: []admissionregistrationv1.RuleWithOperations{{ Operations: []admissionregistrationv1.OperationType{admissionregistrationv1.Create}, Rule: admissionregistrationv1.Rule{ APIGroups:   []string{""}, APIVersions: []string{"v1"}, Resources:   []string{"pods"}, }, }}, ClientConfig: admissionregistrationv1.WebhookClientConfig{ Service: &admissionregistrationv1.ServiceReference{ Namespace: namespace, Name:      serviceName, Path:      strPtr("/pods"), Port:      pointer.Int32Ptr(servicePort), }, CABundle: context.signingCert, }, SideEffects:             &sideEffectsNone, AdmissionReviewVersions: []string{"v1beta1"}, // Scope the webhook to just this namespace NamespaceSelector: &metav1.LabelSelector{ MatchLabels: map[string]string{f.UniqueName: "true"}, }, }, { Name: "deny-unwanted-configmap-data.k8s.io", Rules: []admissionregistrationv1.RuleWithOperations{{ Operations: []admissionregistrationv1.OperationType{admissionregistrationv1.Create, admissionregistrationv1.Update, admissionregistrationv1.Delete}, Rule: admissionregistrationv1.Rule{ APIGroups:   []string{""}, APIVersions: []string{"v1"}, Resources:   []string{"configmaps"}, }, }}, // The webhook skips the namespace that has label "skip-webhook-admission":"yes" NamespaceSelector: &metav1.LabelSelector{ MatchLabels: map[string]string{f.UniqueName: "true"}, MatchExpressions: []metav1.LabelSelectorRequirement{ { Key:      skipNamespaceLabelKey, Operator: metav1.LabelSelectorOpNotIn, Values:   []string{skipNamespaceLabelValue}, }, }, }, ClientConfig: admissionregistrationv1.WebhookClientConfig{ Service: &admissionregistrationv1.ServiceReference{ Namespace: namespace, Name:      serviceName, Path:      strPtr("/configmaps"), Port:      pointer.Int32Ptr(servicePort), }, CABundle: context.signingCert, }, SideEffects:             &sideEffectsNone, AdmissionReviewVersions: []string{"v1beta1"}, }, </del> <ins> newDenyPodWebhookFixture(f, context), newDenyConfigMapWebhookFixture(f, context), </ins> // Server cannot talk to this webhook, so it always fails. // Because this webhook is configured fail-open, request should be admitted after the call fails. failOpenHook,