Validate Workload.spec.admission on webhook

[alculquicondor]

What would you like to be added:

The following validations should apply:

• The clusterQueue should be a valid object name.
• The list of podSetFlavors should match the podSets names.
• Each resourceName should be listed in the pod spec, although it might be too cumbersome to validate, so we could ignore it.
• Each flavorName should be a valid object name.

Also validate that, once set, the contents of the admission are immutable, except that it can be set to nil.

Why is this needed:

To prevent accidental misuse of this field by administrators.

Completion requirements:

This enhancement requires the following artifacts:

• Design doc
• API change
• Docs update

The artifacts should be linked in subsequent comments.

[alculquicondor]

/help

[k8s-ci-robot]

@alculquicondor:
This request has been marked as needing help from a contributor.

Guidelines

Please ensure that the issue body includes answers to the following questions:

• Why are we solving this issue?
• To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points?
• Does this issue have zero to low barrier of entry?
• How can the assignee reach out to you for help?

For more details on the requirements of such an issue, please see here and ensure that they are met.

If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-help command.

In response to this:

/help

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[kerthcet]

/assign

[kerthcet]

I wonder if we should allow parts of podsets to run first when out of resources, then we can release the resources for the left podsets to run. For podgroup pods, we should have a different set of logic.

[kerthcet]

And this can be configured.

[alculquicondor]

For now, we are going with the assumption that the entire Workload is all-or-nothing.