webhook: support validation rules

[AlexanderYastrebov]

Add new webhook admitter that evaluates Ingresses and RouteGroups against a set of rules.

Each rule defines properties of matching resource and rejection message.

The implementation uses Common Expression Language to match properties which is also used in Kubernetes.

[AlexanderYastrebov]

We may also implement

rules:
  - warning: Feature X will be deprecated
    when:  request.kind.kind == "RouteGroup" && ...

that would allow request with warnings, see 9281783

[szuecs]

I would assume that you would share pros and cons and why it's better than what we have today.
Not being able to parse eskip sounds like a step backwards.

[AlexanderYastrebov]

I would assume that you would share pros and cons

This approach allows skipper operator to define custom rules that may be specific to a given setup or contain sensitive bits.
E.g. a custom rule may reject certain filter or predicate configurations or deny backend addresses.
The downside is usage of another language (although having very simple syntax) and a need to have end-to-end test suite to test custom rules.

Alternative is to deploy closed-source webhook written in go.

Not being able to parse eskip sounds like a step backwards.

Its possible, see TODO comment #2885 (comment), I decided not to invest into it until we decide to move forward with this (or abandon the idea).