Repository: kubernetes
Issue: Admission webhooks don't match changes on subresources like Scale
Labels: kind/bug,sig/api-machinery,triage/accepted

### What happened?

I have a statefulset with a label `colega.eu/webhook`:

`workload.yaml`:
```yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: workload
  labels:
    colega.eu/webhook: 'true'
spec:
  replicas: 1
  serviceName: workload
  selector:
    matchLabels:
      app: workload
  template:
    metadata:
      labels:
        app: workload
    spec:
      containers:
      - name: nothing
        image: alpine
        command: ["/bin/watch"]
        args: ["-t", "-n", "2", "date"]
```

And I've created a webhook for changes in `statefulsets` and `statefulsets/scale` that have that the `colega.eu/webhook=true` label:

```yaml
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: webhook
webhooks:
- name: webhook.colega.eu
  clientConfig:
    service:
      name: something-that-does-not-exist
      namespace: default
      path: /webhook
      port: 443
  objectSelector:
    matchLabels:
      colega.eu/webhook: 'true'
  rules:
  - apiGroups: ["apps"]
    apiVersions: ["v1"]
    operations: ["UPDATE"]
    resources: ["statefulsets"]
    scope: Namespaced
  - apiGroups: ["apps"]
    apiVersions: ["v1"]
    operations: ["*"]
    resources: ["statefulsets/scale"]
    scope: '*'
  admissionReviewVersions:
  - v1
  sideEffects: None
  failurePolicy: Fail
```

When I try to update my statefulset, the webhook is called (and it fails as the webhook service doesn't exist):
```
$ kubectl patch statefulsets.apps workload --patch='{"spec": {"replicas": 2}}'
Error from server (InternalError): Internal error occurred: failed calling webhook "webhook.colega.eu": Post "https://something-that-does-not-exist.default.svc:443/webhook?timeout=10s": service "something-that-does-not-exist" not found
```

However, when I update it using `kubectl scale` subcommand it does not call the webhook:
```
$ kubectl scale statefulset workload --replicas 2                             
statefulset.apps/workload scaled
```

However, the statefulset's `spec.replicas` field is updated.

### What did you expect to happen?

I expected the `kubectl scale` command to also fail, as I'd expect the `statefulset/scale` subresource to have the same labels as the parent resource (because the subresource doesn't have labels). 

### How can we reproduce it (as minimally and precisely as possible)?

<details>

<summary>Click me to expand</summary>

```
$ cat workload.yaml 
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: workload
  labels:
    colega.eu/webhook: 'true'
spec:
  replicas: 1
  serviceName: workload
  selector:
    matchLabels:
      app: workload
  template:
    metadata:
      labels:
        app: workload
    spec:
      containers:
      - name: nothing
        image: alpine
        command: ["/bin/watch"]
        args: ["-t", "-n", "2", "date"]

$ cat webhook.yaml 
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: webhook
webhooks:
- name: webhook.colega.eu
  clientConfig:
    service:
      name: something-that-does-not-exist
      namespace: default
      path: /webhook
      port: 443
  objectSelector:
    matchLabels:
      colega.eu/webhook: 'true'
  rules:
  - apiGroups: ["apps"]
    apiVersions: ["v1"]
    operations: ["UPDATE"]
    resources: ["statefulsets"]
    scope: Namespaced
  - apiGroups: ["apps"]
    apiVersions: ["v1"]
    operations: ["*"]
    resources: ["statefulsets/scale"]
    scope: '*'
  admissionReviewVersions:
  - v1
  sideEffects: None
  failurePolicy: Fail

$ kubectl apply -f workload.yaml 
statefulset.apps/workload created

$ kubectl apply -f webhook.yaml 
validatingwebhookconfiguration.admissionregistration.k8s.io/webhook created

$ kubectl patch statefulsets.apps workload --patch='{"spec": {"replicas": 2}}'
Error from server (InternalError): Internal error occurred: failed calling webhook "webhook.colega.eu": Post "https://something-that-does-not-exist.default.svc:443/webhook?timeout=10s": service "something-that-does-not-exist" not found

$ kubectl scale statefulset workload --replicas 2
statefulset.apps/workload scaled
```
</details>

### Anything else we need to know?

I know that [the documentation states](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector) that:

> Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels.

However, I'm not trying to prevent users from skipping the webhook here, I'm trying to catch changes to legitimately opted-in statefulsets replicas.

I can't see any way of creating a webhook without removing the label matchers on it (which would be highly undesired as there are a lot of objects that I don't want to validate in our clusters) and manually (from the webhook) accessing the deployment through the API when the validating request arrives to check whether it contains or not the labels.



### Kubernetes version

<details>

```console
$ kubectl version  
Client Version: version.Info{Major:"1", Minor:"22", GitVersion:"v1.22.3", GitCommit:"c92036820499fedefec0f847e2054d824aea6cd1", GitTreeState:"clean", BuildDate:"2021-10-27T18:41:28Z", GoVersion:"go1.16.9", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"21", GitVersion:"v1.21.1", GitCommit:"5e58841cce77d4bc13713ad2b91fa0d961e69192", GitTreeState:"clean", BuildDate:"2021-05-21T23:01:33Z", GoVersion:"go1.16.4", Compiler:"gc", Platform:"linux/amd64"}
```

</details>


### Cloud provider

None, I'm testing locally.


### OS version

<details>

```console
# On Linux:
$ cat /etc/os-release
NAME="Linux Mint"
VERSION="20.2 (Uma)"
ID=linuxmint
ID_LIKE=ubuntu
PRETTY_NAME="Linux Mint 20.2"
VERSION_ID="20.2"
HOME_URL="https://www.linuxmint.com/"
SUPPORT_URL="https://forums.linuxmint.com/"
BUG_REPORT_URL="http://linuxmint-troubleshooting-guide.readthedocs.io/en/latest/"
PRIVACY_POLICY_URL="https://www.linuxmint.com/"
VERSION_CODENAME=uma
UBUNTU_CODENAME=focal

$ uname -a
Linux beast 5.4.0-125-generic #141-Ubuntu SMP Wed Aug 10 13:42:03 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
```

</details>


### Install tools

_No response_

### Container runtime (CRI) and version (if applicable)

_No response_

### Related plugins (CNI, CSI, ...) and versions (if applicable)

_No response_