Document responsibility for invoking admission webhooks

[sftim]

This is a Feature Request

When someone defines an APIService backed by an aggregated API server, we need readers to be aware that they (and specifically the aggregated API server they deploy)

are responsible for calling out to admission webhooks for the resource types they serve (edited)

(quoting @liggitt)

What would you like to be added

• clearly mention aggregated API server invocations of webhooks in the pages about admission webhooks
• mention API server invocations of webhooks in the cluster networking page
• mention aggregated API server invocations of webhooks in security hardening guides and checklists

Why is this needed
It's a detail that's obvious when you think about it but likely to be missed unless you do

Comments
/language en
/kind feature
/sig api-machinery
/priority backlog

[k8s-ci-robot]

This issue is currently awaiting triage.

SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the triage/accepted label.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.