Repository: kubernetes
Issue: Add more info into webhook to differentiate if a request is originating from custom controller or from other clients like kubectl in webhook stage to have different behaivor
Labels: kind/documentation,sig/api-machinery,kind/feature,triage/accepted

### What would you like to be added?

If we want to develop a Kubernetes controller and an Admission Webhook to handle API requests. We want to be able to differentiate if a request is originating from my custom controller or from other clients like kubectl in webhook stage to have different behaivor. Is there any method to do this? Maybe we can add more custom info into webhook?

eg.
If we want to ensure that certain API object cannot be operated on using kubectl or other client when it contains a specific label, but allow custom controllers to operate on it. How can I do this in webhook?

### Why is this needed?

Main Question

The goal is to reliably differentiate requests originating from the controller and properly handle them in the Admission Webhook, either by leveraging existing fields like UserInfo or by exploring other feasible mechanisms.

If we could retain certain parameters from the original controller request, such as the user-agent, when the apiserver initiates a request to the webhook (currently, the webhook implementation directly sets the user-agent to apiserver-admission), we would be able to determine where the request originated from by using 
```go
WithContextFunc: func(ctx context.Context, request *http.Request) context.Context {
			userAgent := request.Header.Get("User-Agent")
			return context.WithValue(ctx, venti.ContextKeyUserAgent, userAgent)
		}})
```
in webhook handler.

When we initiate an operation request on a resource, we use rest.Config to send the request to the apiserver. After processing, when the apiserver reaches the admission phase, it reconstructs a client and sends an AdmissionReview request to the webhook server. At this point, we cannot distinguish the request source to the webhook server and cannot handle it differently in the webhook handler. It seems that neither `WithContextFunc `nor rest.Config's `WrapTransport` can retain some custom information from the first request to facilitate distinguishing the request source in the second request. We could also achieve this through `impersonate extra`, but this would require filling in additional information like `impersonate user` and `group`, which is not very efficient.
I want to add a field in rest.Config to allow developers to add additional information, which can be passed to the webhook server through the request header.
like:
```go
// Extra is a free-form field which can be used to add some custom information to the request header.
// This field allows you to determine how to handle the request in webhook handler or other plugins.
// For example, you can add some identity information to the request header and use this information in
// the webhook handler to determine whether the request is generated by controller or other components like kubectl.
Extra map[string][]string
```
I think this will enhance the capabilities of the webhook function. For example, in multi-cloud scenarios, a resource controlled by the host cluster can be modified by the host cluster's controller but not by the local cluster's controller or kubectl.
Do you have any suggestions? Any insights or recommendations would be greatly appreciated. Thanks in advance!:)