chore: Add support for extra in validating webhook

[miketonks-form3]

What problem does this PR solve?

We experienced problems in our GKE and AKS stacks, where user authentication does not work correctly creating chaos-mesh CRDs.

We received errors such as:

Error from server (Forbidden): error when creating "/experiment.yaml": admission webhook "vauth.kb.io" denied the request: [email protected] is forbidden on namespace test

On investigation, we identified that the validating webooks are at fault, since they do not pass all user information: username and groups are passed, but not extra field which contains cloud provider specific auth tokens.

What's changed and how it works?

This PR adds extra field to the request. Tested in the development stacks and worked as expected.

Test can be reproduced by creating a SAR with the following bash command:

kubectl --context my-gke-stack auth whoami -o json | jq '{
  "apiVersion": "authorization.k8s.io/v1",
  "kind": "SubjectAccessReview",
  "spec": {
    "resourceAttributes": {
      "namespace": "nats",
      "verb": "create",
      "group": "chaos-mesh.org",
      "resource": "networkchaos"
    },
    "user": .status.userInfo.username,
    "groups": .status.userInfo.groups,
     "extra": .status.userInfo.extra
  }
}' | kubectl --context  my-gke-stack create --v=9 -f -  

"status":{"allowed":true,"reason":"access granted by IAM permissions."

Related changes

• This change also requires further updates to the website (e.g. docs)
• This change also requires further updates to the UI interface

Cherry-pick to release branches (optional)

This PR should be cherry-picked to the following release branches:

• release-2.6
• release-2.5

Checklist

CHANGELOG

Must include at least one of them.

• I have updated the CHANGELOG.md
• I have labeled this PR with "no-need-update-changelog"

Tests

Must include at least one of them.

• Unit test
• E2E test
• Manual test

Side effects

• Breaking backward compatibility

DCO

If you find the DCO check fails, please run commands like below (Depends on the actual situations. For example, if the failed commit isn't the most recent) to fix it:

git commit --amend --signoff
git push --force

[github-actions]

Created new release based on commit 2a6a12e

Release tag: v2.6.1-f3-2a6a1-mike-auth-extra

Link to release

[github-actions]

Created new release based on commit a185473

Release tag: v2.6.1-f3-a1854-mike-auth-extra

Link to release

[github-actions]

Created new release based on commit f527454

Release tag: v2.6.1-f3-f5274-mike-auth-extra

Link to release

[miketonks-form3]

Upstream PR:

• chore: Add support for userInfo.extra in validating webhook chaos-mesh/chaos-mesh#4559