Admission controller validates KongClusterPlugin

[rainest]

Is there an existing issue for this?

• I have searched the existing issues

Problem Statement

The admission controller validates KongPlugins, but not KongClusterPlugins. The two resources are largely identical and could easily share validation logic.

Proposed Solution

• Reuse the KongPlugin validation functions in a validator for KongClusterPlugin.
• NamespacedConfigSource will require some wrapper to allow it to work with the KongPlugin validator.

Additional information

No response

Acceptance Criteria

• The admission controller validates KongClusterPlugins
• All validation failures for KongPlugins also result in failures for KongClusterPlugins with equivalent configuration.

[hhoover]

ran into this today when applying two KongClusterPlugins that conflicted. The API accepted the plugin config but didn't actually implement it in the ingress controller/proxy due to the conflict. The webhook should have rejected the conflicting object.