fix: echo request TypeMeta in admission response to comply with Kubernetes webhook spec

[dom-colangelo]

Problem

The Kubernetes webhook specification requires that a webhook response include the same apiVersion and kind as the request. The handler was building the response AdmissionReview struct without copying TypeMeta from the request, so every response serialized as:

{"response": {"uid": "...", "allowed": true, "patch": "..."}}

API servers enforce this strictly:

received invalid webhook response: expected webhook response of admission.k8s.io/v1,
Kind=AdmissionReview, got /, Kind=

This is a known issue — see #225, where an EKS cluster upgraded to Kubernetes 1.27 with admissionReviewVersions: v1 began rejecting webhook responses and injection stopped working. The only workaround was to downgrade to v1beta1. The root cause is the same: when the API server negotiates v1, the response comes back with an empty apiVersion/kind and is rejected.

A related issue: deserializer.Decode used a codec scheme that registered only corev1 and admissionregistrationv1beta1 — not the admission API types. Any cluster sending admission.k8s.io/v1 requests would fail to decode before mutation ran.

Fix

pkg/handler/handler.go

1. Copy ar.TypeMeta into the response struct before marshalling — the response echoes back whatever apiVersion/kind the request carried, as the spec requires.
2. Replace deserializer.Decode with json.Unmarshal. json.Unmarshal decodes both v1 and v1beta1 payloads correctly without a registered scheme. The old codec scheme did not include the admission API types, so it was incapable of decoding v1 requests.
3. Remove the now-unused runtimeScheme, codecs, deserializer package vars and init().

pkg/handler/handler_test.go

1. Update two test cases for the new json.Unmarshal error strings.
2. Add regression test ValidRequestV1TypeMetaEchoed: sends an AdmissionReview with apiVersion: admission.k8s.io/v1 and asserts the response echoes it back.

Testing

go test ./pkg/handler/...

All tests pass.

Related

• Get error during creation of pod with service-account that has eks.amazonaws.com/role-arn annotation #225 — EKS 1.27 upgrade breaks injection when admissionReviewVersions: v1; workaround was to force v1beta1