Validate workload PodSetUpdates

[mimowo]

What happened:

It is possible to set workload PodSetUpdates with invalid values, resulting in errors during workload admission.

What you expected to happen:

Fail fast on modifications to workload.PodSetUpdates which are performed by external controllers.

Validated things:

• PodSetUpdates.name should be a valid pod set name
• PodSetUpdates.tolerations should a valid list of tolerations, see https://github.com/kubernetes/kubernetes/blob/57d3cc66050545d7fefb0841e750a0a41df14144/pkg/apis/core/validation/validation.go#L3749
• validate annotations and labels, see: https://github.com/kubernetes/kubernetes/blob/57d3cc66050545d7fefb0841e750a0a41df14144/pkg/apis/core/validation/validation.go#L126

Proposed solution: workload webhook.

Part of #1145

[mimowo]

FYI @mwielgus @trasc
/assign @stuton

[k8s-ci-robot]

@mimowo: GitHub didn't allow me to assign the following users: stuton.

Note that only kubernetes-sigs members with read permissions, repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time.
For more information please see the contributor guide

In response to this:

FYI @mwielgus @trasc
/assign @stuton

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[mimowo]

FYI @alculquicondor

[alculquicondor]

+1

[stuton]

/assign