Repository: kubernetes
Issue: Ensuring Full Enforcement of ValidatingWebhookConfiguration for Namespace Lock
Labels: kind/bug,sig/api-machinery,sig/security,triage/accepted

### What happened?

As mentioned in https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#configure-admission-webhooks-on-the-fly
"After you create the webhook configuration, the system will take a few seconds to honor the new configuration."

Despite waiting for a validatingwebhookconfiguration to be considered for new pod creation requests, certain requests were able to bypass the validation process when the system was overloaded with requests.


### What did you expect to happen?

In this specific scenario, the expectation was that any creation requests occurring after the dryRun check(verification that the webhook reject my requests) would be subjected to the webhook validation process.

### How can we reproduce it (as minimally and precisely as possible)?

1. Create a ResourceQuota that allows a memory.request of 1 Mi.
2. Run a thread with the provided function, which continuously creates pods requiring 10Mi resources.
3. Create a ValidatingWebhookConfiguration that denies all pod creations except those with the name "allowed-pod".
4. Ensure that the webhook is functioning with dry run from the cluster's node.
5. Increase the memory.request of the ResourceQuota to 10Mi.
6. You will observe that the thread is able to create the pod even though its name is not "allowed-pod".

```
func abuseSystem(virtClient kubecli.KubevirtClient, ctx context.Context, testNs string) {
	pod := &v1.Pod{
		ObjectMeta: metav1.ObjectMeta{
			Name:      "pod" + rand.String(3),
			Namespace: testNs, // Adjust the namespace as needed
		},
		Spec: v1.PodSpec{
			Containers: []v1.Container{
				{
					Name:  "nginx",
					Image: "your-image", // Specify the container image to use
					Resources: v1.ResourceRequirements{
						Requests: v1.ResourceList{
							v1.ResourceMemory: resource.MustParse("10Mi"),
						},
					},
				},
			},
		},
	}

	for {
		select {
		case <-ctx.Done():
			fmt.Println("Abusing process canceled")
			return
		default:
			// Create a pod requiring 10Mi resources
			_, _ = virtClient.CoreV1().Pods(pod.Namespace).Create(context.TODO(), pod, metav1.CreateOptions{})
		}
	}
}
```


### Anything else we need to know?

I would expect that every request after the dryRun check would undergo the validation process. Alternatively, there should be a reliable way to determine when the validatingwebhookconfiguration is fully honored, indicating that all pod creation requests will undergo the intended validation.

### Kubernetes version

<details>

```console
Client Version: version.Info{Major:"1", Minor:"26", GitVersion:"v1.26.3", GitCommit:"9e644106593f3f4aa98f8a84b23db5fa378900bd", GitTreeState:"clean", BuildDate:"2023-03-15T13:40:17Z", GoVersion:"go1.19.7", Compiler:"gc", Platform:"linux/amd64"}
Kustomize Version: v4.5.7
Server Version: version.Info{Major:"1", Minor:"26", GitVersion:"v1.26.3", GitCommit:"9e644106593f3f4aa98f8a84b23db5fa378900bd", GitTreeState:"clean", BuildDate:"2023-03-15T13:33:12Z", GoVersion:"go1.19.7", Compiler:"gc", Platform:"linux/amd64"}
```

</details>


### Cloud provider

<details>
On prem
</details>


### OS version

<details>

```console
# On Linux:
$ cat /etc/os-release
# paste output here
$ uname -a
# paste output here

# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here
```

</details>


### Install tools

<details>

</details>


### Container runtime (CRI) and version (if applicable)

<details>

</details>


### Related plugins (CNI, CSI, ...) and versions (if applicable)

<details>

</details>