allow one to specify namespace or object selectors

[KhrisRichardson-BO]

Without this, if one were to set the webhook policy to Fail, a k8s-image-swapper pod would not be allowed to be created by kube-apiserver.

[estahn]

@KhrisRichardson-BO Thanks for the PR.

Imo the point of setting the policy to Fail is to prevent the creation of the pod, otherwise, you can just set it to Ignore.

[KhrisRichardson-BO]

@estahn I want the pod creation to fail if the mutation fails for whatever reason. I've observed a few instances where the image pull and push succeeded, but the pod spec mutation does not, resulting in the pod running with the public vs. private image repository, which is especially troublesome for nodes that cannot egress to the public image repository (i.e. - k8s-image-swapper runs on a tainted node that has permissions to egress).

[estahn]

@KhrisRichardson-BO I see. I think it makes sense to have the ability to preselect what should be mutated by the webhook. Let's get it merged :)

[estahn]

@KhrisRichardson-BO Please ignore lint-test. I need to fix up the integration test.

[estahn]

Sorry, missed that.

[KhrisRichardson-BO]

Thanks, Enrico