Description
When an error is returned, kubewebhook returns error 500 with the JSON-encoded AdmissionReview response object. However, Kubernetes doesn't actually decode this response body, it just displays an error like this when failurePolicy: Fail:
Error from server (InternalError): Internal error occurred: failed calling webhook "example.com": an error on the server ("{\"kind\":\"AdmissionReview\",\"apiVersion\":\"admission.k8s.io/v1\",\"response\":{\"uid\":\"00000000-0000-0000-0000-000000000000\",\"allowed\":false,\"status\":{\"metadata\":{},\"status\":\"Failure\",\"message\":\"validator error: {actual error string from user}\"}}}") has prevented the request from succeeding
(and when failurePolicy: Ignore, it assumes the webhook is allowed, which is expected)
This is a bit misleading to users. A hurried new user to webhooks may skim through the Kubernetes docs on webhooks and see that an AdmissionReview response should be returned, and then assume that returning an error results in a rejection based on how the above error message looks like (because it resembles an actual rejection).
Why do we need to encode the error into a JSON object when the apiserver doesn't really handle it?