Merge pull request #67085 from jennybuckley/dry-run-admission-2

Automatic merge from submit-queue (batch tested with PRs 67085, 66559, 67089). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Block dry-run if a webhook would be called

**What this PR does / why we need it**:
Follow up to kubernetes/kubernetes#66391
Suggested in kubernetes/kubernetes#66391 (comment)

Makes dry-run safe in case kubernetes/kubernetes#66936 takes a long time to merge

**Release note**:

```release-note
NONE
```

/sig api-machinery
cc @lavalamp

Kubernetes-commit: 47878f2bd1642145e311d2336e3103c6edcd50de

pkg/admission/plugin/webhook/errors/statuserror.go

@@ -45,3 +45,9 @@ func ToStatusErr(webhookName string, result *metav1.Status) *apierrors.StatusErr
 		ErrStatus: *result,
 	}
 }
+
+// NewDryRunUnsupportedErr returns a StatusError with information about the webhook plugin
+func NewDryRunUnsupportedErr(webhookName string) *apierrors.StatusError {
+	reason := fmt.Sprintf("admission webhook %q does not support dry run", webhookName)
+	return apierrors.NewBadRequest(reason)
+}

pkg/admission/plugin/webhook/mutating/dispatcher.go

@@ -82,6 +82,11 @@ func (a *mutatingDispatcher) Dispatch(ctx context.Context, attr *generic.Version
 
 // note that callAttrMutatingHook updates attr
 func (a *mutatingDispatcher) callAttrMutatingHook(ctx context.Context, h *v1beta1.Webhook, attr *generic.VersionedAttributes) error {
+	if attr.IsDryRun() {
+		// TODO: support this
+		webhookerrors.NewDryRunUnsupportedErr(h.Name)
+	}
+
 	// Make the webhook request
 	request := request.CreateAdmissionReview(attr)
 	client, err := a.cm.HookClient(h)

pkg/admission/plugin/webhook/validating/dispatcher.go

@@ -97,6 +97,11 @@ func (d *validatingDispatcher) Dispatch(ctx context.Context, attr *generic.Versi
 }
 
 func (d *validatingDispatcher) callHook(ctx context.Context, h *v1beta1.Webhook, attr *generic.VersionedAttributes) error {
+	if attr.IsDryRun() {
+		// TODO: support this
+		webhookerrors.NewDryRunUnsupportedErr(h.Name)
+	}
+
 	// Make the webhook request
 	request := request.CreateAdmissionReview(attr)
 	client, err := d.cm.HookClient(h)