bump(*): kubernetes release-1.16.0 dependencies

2026-01-28 06:29:29 +01:00 · 2019-10-12 11:11:43 -04:00
parent 5af668e89a
commit 1652ba7976
28121 changed files with 3491095 additions and 2280257 deletions
--- a/vendor/k8s.io/apiserver/.github/PULL_REQUEST_TEMPLATE.md
+++ b/vendor/k8s.io/apiserver/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,2 @@
+Sorry, we do not accept changes directly against this repository. Please see
+CONTRIBUTING.md for information on where and how to contribute instead.
--- a/vendor/k8s.io/apiserver/CONTRIBUTING.md
+++ b/vendor/k8s.io/apiserver/CONTRIBUTING.md
@@ -0,0 +1,7 @@
+# Contributing guidelines
+
+Do not open pull requests directly against this repository, they will be ignored. Instead, please open pull requests against [kubernetes/kubernetes](https://git.k8s.io/kubernetes/).  Please follow the same [contributing guide](https://git.k8s.io/kubernetes/CONTRIBUTING.md) you would follow for any other pull request made to kubernetes/kubernetes.
+
+This repository is published from [kubernetes/kubernetes/staging/src/k8s.io/apiserver](https://git.k8s.io/kubernetes/staging/src/k8s.io/apiserver) by the [kubernetes publishing-bot](https://git.k8s.io/publishing-bot).
+
+Please see [Staging Directory and Publishing](https://git.k8s.io/community/contributors/devel/sig-architecture/staging.md) for more information
--- a/vendor/k8s.io/apiserver/Godeps/Godeps.json
+++ b/vendor/k8s.io/apiserver/Godeps/Godeps.json
--- a/vendor/k8s.io/apiserver/Godeps/Readme
+++ b/vendor/k8s.io/apiserver/Godeps/Readme
@@ -1,5 +0,0 @@
-This directory tree is generated automatically by godep.
-
-Please do not edit.
-
-See https://github.com/tools/godep for more information.
--- a/vendor/k8s.io/apiserver/OWNERS
+++ b/vendor/k8s.io/apiserver/OWNERS
@@ -1,3 +1,5 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
 approvers:
 - lavalamp
 - smarterclayton
@@ -14,5 +16,11 @@ reviewers:
 - sttts
 - ncdc
 - tallclair
- timothysc
 - enj
+- hzxuzhonghu
+- CaoShuFeng
+- jennybuckley
+- apelisse
+labels:
+- sig/api-machinery
+- area/apiserver
--- a/vendor/k8s.io/apiserver/README.md
+++ b/vendor/k8s.io/apiserver/README.md
@@ -5,7 +5,7 @@ Generic library for building a Kubernetes aggregated API server.

 ## Purpose

-This library contains code to create Kubernetes aggregation server complete with delegated authentication and authorization, 
+This library contains code to create Kubernetes aggregation server complete with delegated authentication and authorization,
 `kubectl` compatible discovery information, optional admission chain, and versioned types.  It's first consumers are
 `k8s.io/kubernetes`, `k8s.io/kube-aggregator`, and `github.com/kubernetes-incubator/service-catalog`.

@@ -14,7 +14,7 @@ This library contains code to create Kubernetes aggregation server complete with

 There are *NO compatibility guarantees* for this repository, yet.  It is in direct support of Kubernetes, so branches
 will track Kubernetes and be compatible with that repo.  As we more cleanly separate the layers, we will review the
-compatibility guarantee.  We have a goal to make this easier to use in 2017.
+compatibility guarantee. We have a goal to make this easier to use in the future.


 ## Where does it come from?
@@ -25,6 +25,6 @@ Code changes are made in that location, merged into `k8s.io/kubernetes` and late

 ## Things you should *NOT* do

- 1. Directly modify any files under `pkg` in this repo.  Those are driven from `k8s.io/kuberenetes/staging/src/k8s.io/apiserver`.
+ 1. Directly modify any files under `pkg` in this repo.  Those are driven from `k8s.io/kubernetes/staging/src/k8s.io/apiserver`.
 2. Expect compatibility.  This repo is changing quickly in direct support of
    Kubernetes and the API isn't yet stable enough for API guarantees.
--- a/vendor/k8s.io/apiserver/SECURITY_CONTACTS
+++ b/vendor/k8s.io/apiserver/SECURITY_CONTACTS
@@ -0,0 +1,17 @@
+# Defined below are the security contacts for this repo.
+#
+# They are the contact point for the Product Security Committee to reach out
+# to for triaging and handling of incoming issues.
+#
+# The below names agree to abide by the
+# [Embargo Policy](https://git.k8s.io/security/private-distributors-list.md#embargo-policy)
+# and will be removed and replaced if they violate that agreement.
+#
+# DO NOT REPORT SECURITY VULNERABILITIES DIRECTLY TO THESE NAMES, FOLLOW THE
+# INSTRUCTIONS AT https://kubernetes.io/security/
+
+cjcullen
+joelsmith
+liggitt
+philips
+tallclair
--- a/vendor/k8s.io/apiserver/code-of-conduct.md
+++ b/vendor/k8s.io/apiserver/code-of-conduct.md
@@ -0,0 +1,3 @@
+# Kubernetes Community Code of Conduct
+
+Please refer to our [Kubernetes Community Code of Conduct](https://git.k8s.io/community/code-of-conduct.md)
--- a/vendor/k8s.io/apiserver/go.mod
+++ b/vendor/k8s.io/apiserver/go.mod
@@ -0,0 +1,75 @@
+// This is a generated file. Do not edit directly.
+
+module k8s.io/apiserver
+
+go 1.12
+
+require (
+	github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78 // indirect
+	github.com/coreos/bbolt v1.3.1-coreos.6 // indirect
+	github.com/coreos/etcd v3.3.15+incompatible
+	github.com/coreos/go-oidc v2.1.0+incompatible
+	github.com/coreos/go-semver v0.3.0 // indirect
+	github.com/coreos/go-systemd v0.0.0-20180511133405-39ca1b05acc7
+	github.com/coreos/pkg v0.0.0-20180108230652-97fdf19511ea
+	github.com/docker/docker v0.7.3-0.20190327010347-be7ac8be2ae0
+	github.com/emicklei/go-restful v2.9.5+incompatible
+	github.com/evanphx/json-patch v4.2.0+incompatible
+	github.com/go-openapi/spec v0.19.2
+	github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d
+	github.com/google/go-cmp v0.3.0
+	github.com/google/gofuzz v1.0.0
+	github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d
+	github.com/gorilla/websocket v1.4.0 // indirect
+	github.com/grpc-ecosystem/go-grpc-middleware v0.0.0-20190222133341-cfaf5686ec79 // indirect
+	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0
+	github.com/grpc-ecosystem/grpc-gateway v1.3.0 // indirect
+	github.com/hashicorp/golang-lru v0.5.1
+	github.com/jonboulle/clockwork v0.1.0 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d
+	github.com/pborman/uuid v1.2.0
+	github.com/pkg/errors v0.8.0 // indirect
+	github.com/pquerna/cachecontrol v0.0.0-20171018203845-0dec1b30a021 // indirect
+	github.com/prometheus/client_golang v0.9.2
+	github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910
+	github.com/sirupsen/logrus v1.4.2 // indirect
+	github.com/soheilhy/cmux v0.1.3 // indirect
+	github.com/spf13/pflag v1.0.3
+	github.com/stretchr/testify v1.3.0
+	github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8 // indirect
+	github.com/xiang90/probing v0.0.0-20160813154853-07dd2e8dfe18 // indirect
+	go.uber.org/atomic v0.0.0-20181018215023-8dc6146f7569 // indirect
+	go.uber.org/multierr v0.0.0-20180122172545-ddea229ff1df // indirect
+	go.uber.org/zap v0.0.0-20180814183419-67bc79d13d15 // indirect
+	golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8
+	golang.org/x/net v0.0.0-20190812203447-cdfb69ac37fc
+	google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873 // indirect
+	google.golang.org/grpc v1.23.0
+	gopkg.in/natefinch/lumberjack.v2 v2.0.0
+	gopkg.in/square/go-jose.v2 v2.2.2
+	gopkg.in/yaml.v2 v2.2.2
+	gotest.tools v2.2.0+incompatible // indirect
+	k8s.io/api v0.0.0-20190918155943-95b840bb6a1f
+	k8s.io/apimachinery v0.0.0-20190913080033-27d36303b655
+	k8s.io/client-go v0.0.0-20190918160344-1fbdaa4c8d90
+	k8s.io/component-base v0.0.0-20190918160511-547f6c5d7090
+	k8s.io/klog v0.4.0
+	k8s.io/kube-openapi v0.0.0-20190816220812-743ec37842bf
+	k8s.io/utils v0.0.0-20190801114015-581e00157fb1
+	sigs.k8s.io/structured-merge-diff v0.0.0-20190817042607-6149e4549fca
+	sigs.k8s.io/yaml v1.1.0
+)
+
+replace (
+	golang.org/x/crypto => golang.org/x/crypto v0.0.0-20181025213731-e84da0312774
+	golang.org/x/lint => golang.org/x/lint v0.0.0-20181217174547-8f45f776aaf1
+	golang.org/x/oauth2 => golang.org/x/oauth2 v0.0.0-20190402181905-9f3314589c9a
+	golang.org/x/sync => golang.org/x/sync v0.0.0-20181108010431-42b317875d0f
+	golang.org/x/sys => golang.org/x/sys v0.0.0-20190209173611-3b5209105503
+	golang.org/x/text => golang.org/x/text v0.3.1-0.20181227161524-e6919f6577db
+	golang.org/x/time => golang.org/x/time v0.0.0-20161028155119-f51c12702a4d
+	k8s.io/api => k8s.io/api v0.0.0-20190918155943-95b840bb6a1f
+	k8s.io/apimachinery => k8s.io/apimachinery v0.0.0-20190913080033-27d36303b655
+	k8s.io/client-go => k8s.io/client-go v0.0.0-20190918160344-1fbdaa4c8d90
+	k8s.io/component-base => k8s.io/component-base v0.0.0-20190918160511-547f6c5d7090
+)
--- a/vendor/k8s.io/apiserver/go.sum
+++ b/vendor/k8s.io/apiserver/go.sum
@@ -0,0 +1,294 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
+github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78 h1:w+iIsaOQNcT7OZ575w+acHgRric5iCyQh+xv+KJ4HB8=
+github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
+github.com/Azure/go-autorest/autorest v0.9.0/go.mod h1:xyHB1BMZT0cuDHU7I0+g046+BFDTQ8rEZB0s4Yfa6bI=
+github.com/Azure/go-autorest/autorest/adal v0.5.0/go.mod h1:8Z9fGy2MpX0PvDjB1pEgQTmVqjGhiHBW7RJJEciWzS0=
+github.com/Azure/go-autorest/autorest/date v0.1.0/go.mod h1:plvfp3oPSKwf2DNjlBjWF/7vwR+cUD/ELuzDCXwHUVA=
+github.com/Azure/go-autorest/autorest/mocks v0.1.0/go.mod h1:OTyCOPRA2IgIlWxVYxBee2F5Gr4kF2zd2J5cFRaIDN0=
+github.com/Azure/go-autorest/autorest/mocks v0.2.0/go.mod h1:OTyCOPRA2IgIlWxVYxBee2F5Gr4kF2zd2J5cFRaIDN0=
+github.com/Azure/go-autorest/logger v0.1.0/go.mod h1:oExouG+K6PryycPJfVSxi/koC6LSNgds39diKLz7Vrc=
+github.com/Azure/go-autorest/tracing v0.5.0/go.mod h1:r/s2XiOKccPW3HrqB+W0TQzfbtp2fGCgRFtBroKn4Dk=
+github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46 h1:lsxEuwrXEAokXB9qhlbKWPpo3KMLZQ5WB5WLQRW1uq0=
+github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
+github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
+github.com/PuerkitoBio/purell v1.1.1 h1:WEQqlqaGbrPkxLJWfBwQmfEAE1Z7ONdDLqrN38tNFfI=
+github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
+github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
+github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 h1:d+Bc7a5rLufV/sSk/8dngufqelfh6jnri85riMAaF/M=
+github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
+github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973 h1:xJ4a3vCFaGF/jqvzLMYoU8P317H5OQ+Via4RmuPwCS0=
+github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
+github.com/blang/semver v3.5.0+incompatible h1:CGxCgetQ64DKk7rdZ++Vfnb1+ogGNnB17OJKJXD2Cfs=
+github.com/blang/semver v3.5.0+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/coreos/bbolt v1.3.1-coreos.6 h1:uTXKg9gY70s9jMAKdfljFQcuh4e/BXOM+V+d00KFj3A=
+github.com/coreos/bbolt v1.3.1-coreos.6/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
+github.com/coreos/etcd v3.3.15+incompatible h1:+9RjdC18gMxNQVvSiXvObLu29mOFmkgdsB4cRTlV+EE=
+github.com/coreos/etcd v3.3.15+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
+github.com/coreos/go-oidc v2.1.0+incompatible h1:sdJrfw8akMnCuUlaZU3tE/uYXFgfqom8DBE9so9EBsM=
+github.com/coreos/go-oidc v2.1.0+incompatible/go.mod h1:CgnwVTmzoESiwO9qyAFEMiHoZ1nMCKZlZ9V6mm3/LKc=
+github.com/coreos/go-semver v0.3.0 h1:wkHLiw0WNATZnSG7epLsujiMCgPAc9xhjJ4tgnAxmfM=
+github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
+github.com/coreos/go-systemd v0.0.0-20180511133405-39ca1b05acc7 h1:u9SHYsPQNyt5tgDm3YN7+9dYrpK96E5wFilTFWIDZOM=
+github.com/coreos/go-systemd v0.0.0-20180511133405-39ca1b05acc7/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/coreos/pkg v0.0.0-20180108230652-97fdf19511ea h1:n2Ltr3SrfQlf/9nOna1DoGKxLx3qTSI8Ttl6Xrqp6mw=
+github.com/coreos/pkg v0.0.0-20180108230652-97fdf19511ea/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
+github.com/davecgh/go-spew v0.0.0-20151105211317-5215b55f46b2/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
+github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
+github.com/docker/docker v0.7.3-0.20190327010347-be7ac8be2ae0 h1:w3NnFcKR5241cfmQU5ZZAsf0xcpId6mWOupTvJlUX2U=
+github.com/docker/docker v0.7.3-0.20190327010347-be7ac8be2ae0/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
+github.com/elazarl/goproxy v0.0.0-20170405201442-c4fc26588b6e/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
+github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
+github.com/emicklei/go-restful v2.9.5+incompatible h1:spTtZBk5DYEvbxMVutUuTyh1Ao2r4iyvLdACqsl/Ljk=
+github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
+github.com/evanphx/json-patch v4.2.0+incompatible h1:fUDGZCv/7iAN7u0puUVhvKCcsR6vRfwrJatElLBEf0I=
+github.com/evanphx/json-patch v4.2.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/fsnotify/fsnotify v1.4.7 h1:IXs+QLmnXW2CcXuY+8Mzv/fWEsPGWxqefPtCP5CnV9I=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
+github.com/go-openapi/jsonpointer v0.0.0-20160704185906-46af16f9f7b1/go.mod h1:+35s3my2LFTysnkMfxsJBAMHj/DoqoB9knIWoYG/Vk0=
+github.com/go-openapi/jsonpointer v0.19.2 h1:A9+F4Dc/MCNB5jibxf6rRvOvR/iFgQdyNx9eIhnGqq0=
+github.com/go-openapi/jsonpointer v0.19.2/go.mod h1:3akKfEdA7DF1sugOqz1dVQHBcuDBPKZGEoHC/NkiQRg=
+github.com/go-openapi/jsonreference v0.0.0-20160704190145-13c6e3589ad9/go.mod h1:W3Z9FmVs9qj+KR4zFKmDPGiLdk1D9Rlm7cyMvf57TTg=
+github.com/go-openapi/jsonreference v0.19.2 h1:o20suLFB4Ri0tuzpWtyHlh7E7HnkqTNLq6aR6WVNS1w=
+github.com/go-openapi/jsonreference v0.19.2/go.mod h1:jMjeRr2HHw6nAVajTXJ4eiUwohSTlpa0o73RUL1owJc=
+github.com/go-openapi/spec v0.0.0-20160808142527-6aced65f8501/go.mod h1:J8+jY1nAiCcj+friV/PDoE1/3eeccG9LYBs0tYvLOWc=
+github.com/go-openapi/spec v0.19.2 h1:SStNd1jRcYtfKCN7R0laGNs80WYYvn5CbBjM2sOmCrE=
+github.com/go-openapi/spec v0.19.2/go.mod h1:sCxk3jxKgioEJikev4fgkNmwS+3kuYdJtcsZsD5zxMY=
+github.com/go-openapi/swag v0.0.0-20160704191624-1d0bd113de87/go.mod h1:DXUve3Dpr1UfpPtxFw+EFuQ41HhCWZfha5jSVRG7C7I=
+github.com/go-openapi/swag v0.19.2 h1:jvO6bCMBEilGwMfHhrd61zIID4oIFdwb76V17SM88dE=
+github.com/go-openapi/swag v0.19.2/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
+github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d h1:3PaI8p3seN09VjbTYC/QWlUZdZ1qS1zGjy7LH2Wt07I=
+github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903 h1:LbsanbbD6LieFkXbj9YNNBupiGHJgFeLpO0j0Fza1h8=
+github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/protobuf v0.0.0-20161109072736-4bd1920723d7/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.2.0 h1:P3YflyNX/ehuJFLhxviNdFxQPkGK5cDcApsge1SqnvM=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.1 h1:YF8+flBXS5eO826T4nzqPrxfhQThhXl0YzfuUPu4SBg=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c h1:964Od4U6p2jUkFxvCydnIczKteheJEzHRToSGK3Bnlw=
+github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-cmp v0.3.0 h1:crn/baboCvb5fXaQ0IJ1SGTsTVrWpDsCWC8EGETZijY=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/gofuzz v0.0.0-20161122191042-44d81051d367/go.mod h1:HP5RmnzzSNb993RKQDq4+1A4ia9nllfqcQFTQJedwGI=
+github.com/google/gofuzz v1.0.0 h1:A8PeW59pxE9IoFRqBp37U+mSNaQoZ46F1f0f863XSXw=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
+github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
+github.com/google/uuid v1.0.0 h1:b4Gk+7WdP/d3HZH8EJsZpvV7EtDOgaZLtnaNGIu1adA=
+github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY=
+github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
+github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d h1:7XGaL1e6bYS1yIonGp9761ExpPPV1ui0SAC59Yube9k=
+github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
+github.com/gophercloud/gophercloud v0.1.0/go.mod h1:vxM41WHh5uqHVBMZHzuwNOHh8XEoIEcSTewFxm1c5g8=
+github.com/gorilla/websocket v1.4.0 h1:WDFjx/TMzVgy9VdMMQi2K2Emtwi2QcUQsztZ/zLaH/Q=
+github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
+github.com/gregjones/httpcache v0.0.0-20170728041850-787624de3eb7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
+github.com/grpc-ecosystem/go-grpc-middleware v0.0.0-20190222133341-cfaf5686ec79 h1:lR9ssWAqp9qL0bALxqEEkuudiP1eweOdv9jsRK3e7lE=
+github.com/grpc-ecosystem/go-grpc-middleware v0.0.0-20190222133341-cfaf5686ec79/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
+github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 h1:Ovs26xHkKqVztRpIrF/92BcuyuQ/YW4NSIpoGtfXNho=
+github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
+github.com/grpc-ecosystem/grpc-gateway v1.3.0 h1:HJtP6RRwj2EpPCD/mhAWzSvLL/dFTdPm1UrWwanoFos=
+github.com/grpc-ecosystem/grpc-gateway v1.3.0/go.mod h1:RSKVYQBd5MCa4OVpNdGskqpgL2+G+NZTnrVHpWWfpdw=
+github.com/hashicorp/golang-lru v0.5.0 h1:CL2msUPvZTLb5O648aiLNJw3hnBxN2+1Jq8rCOH9wdo=
+github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru v0.5.1 h1:0hERBMJE1eitiLkihrMvRVBYAkpHzc/J3QdDN+dAcgU=
+github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI=
+github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
+github.com/imdario/mergo v0.3.5 h1:JboBksRwiiAJWvIYJVo46AfV+IAIKZpfrSzVKj42R4Q=
+github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
+github.com/jonboulle/clockwork v0.1.0 h1:VKV+ZcuP6l3yW9doeqz6ziZGgcynBVQO+obU0+0hcPo=
+github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
+github.com/json-iterator/go v0.0.0-20180612202835-f2b4162afba3/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
+github.com/json-iterator/go v1.1.6 h1:MrUvLMLTMxbqFJ9kzlvat/rYZqZnW3u4wkLzWTaFwKs=
+github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
+github.com/json-iterator/go v1.1.7 h1:KfgG9LzI+pYjr4xvmz/5H4FXjokeP+rlHLhv3iH62Fo=
+github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
+github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1 h1:mweAR1A6xJ3oS2pRaGiHgQ4OO8tzTaLawm8vnODuwDk=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/pty v1.1.5/go.mod h1:9r2w37qlBe7rQ6e1fg1S/9xpWHSnaqNdHD3WcMdbPDA=
+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63 h1:nTT4s92Dgz2HlrB2NaMgvlfqHH39OgMhA7z3PK7PGD4=
+github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
+github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v0.0.0-20180320133207-05fbef0ca5da/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.1 h1:9f412s+6RmYXLWZSEzVVgPGK7C2PphHj5RJrvfx9AWI=
+github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d h1:7PxY7LVfSZm7PEeBTyK1rj1gABdCO2mbri6GKO1cMDs=
+github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
+github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.6.0 h1:Ix8l273rp3QzYgXSR+c8d1fTG7UPgYkOSELPhiY/YGw=
+github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.8.0 h1:VkHVNpR4iVnU8XQR6DBm8BqYjN7CRzw+xKUbVVbbW9w=
+github.com/onsi/ginkgo v1.8.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
+github.com/onsi/gomega v1.5.0 h1:izbySO9zDPmjJ8rDjLvkA2zJHIo+HkYXHnf7eN7SSyo=
+github.com/onsi/gomega v1.5.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
+github.com/pborman/uuid v1.2.0 h1:J7Q5mO4ysT1dv8hyrUGHb9+ooztCXu1D8MY8DZYsu3g=
+github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
+github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
+github.com/pkg/errors v0.8.0 h1:WdK/asTD0HN+q6hsWO3/vpuAkAr+tw6aNJNDFFf0+qw=
+github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v0.0.0-20151028094244-d8ed2627bdf0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pquerna/cachecontrol v0.0.0-20171018203845-0dec1b30a021 h1:0XM1XL/OFFJjXsYXlG30spTkV/E9+gmd5GD1w2HE8xM=
+github.com/pquerna/cachecontrol v0.0.0-20171018203845-0dec1b30a021/go.mod h1:prYjPmNq4d1NPVmpShWobRqXY3q7Vp+80DqgxxUrUIA=
+github.com/prometheus/client_golang v0.9.2 h1:awm861/B8OKDd2I/6o1dy3ra4BamzKhYOiGItCeZ740=
+github.com/prometheus/client_golang v0.9.2/go.mod h1:OsXs2jCmiKlQ1lTBmv21f2mNfw4xf/QclQDMrYNZzcM=
+github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910 h1:idejC8f05m9MGOsuEi1ATq9shN03HrxNkD/luQvxCv8=
+github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
+github.com/prometheus/common v0.0.0-20181126121408-4724e9255275 h1:PnBWHBf+6L0jOqq0gIVUe6Yk0/QMZ640k6NvkxcBf+8=
+github.com/prometheus/common v0.0.0-20181126121408-4724e9255275/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
+github.com/prometheus/procfs v0.0.0-20181204211112-1dc9a6cbc91a h1:9a8MnZMP0X2nLJdBg+pBmGgkJlSaKC2KaQmTCk1XDtE=
+github.com/prometheus/procfs v0.0.0-20181204211112-1dc9a6cbc91a/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/sirupsen/logrus v1.4.2 h1:SPIRibHv4MatM3XXNO2BJeFLZwZ2LvZgfQ5+UNI2im4=
+github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
+github.com/soheilhy/cmux v0.1.3 h1:09wy7WZk4AqO03yH85Ex1X+Uo3vDsil3Fa9AgF8Emss=
+github.com/soheilhy/cmux v0.1.3/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
+github.com/spf13/afero v1.2.2 h1:5jhuqJyZCZf2JRofRvN/nIFgIWNzPa3/Vz8mYylgbWc=
+github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
+github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/pflag v1.0.3 h1:zPAT6CGy6wXeQ7NtTnaTerfKOsV6V6F8agHXFiazDkg=
+github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
+github.com/stretchr/testify v0.0.0-20151208002404-e3a8ff8ce365/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.2.2 h1:bSDNvY7ZPG5RlJ8otE/7V6gMiyenm9RtJ7IUVIAoJ1w=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8 h1:ndzgwNDnKIqyCvHTXaCqh9KlOWKvBry6nuXMJmonVsE=
+github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
+github.com/xiang90/probing v0.0.0-20160813154853-07dd2e8dfe18 h1:MPPkRncZLN9Kh4MEFmbnK4h3BD7AUmskWv2+EeZJCCs=
+github.com/xiang90/probing v0.0.0-20160813154853-07dd2e8dfe18/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
+go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
+go.uber.org/atomic v0.0.0-20181018215023-8dc6146f7569 h1:nSQar3Y0E3VQF/VdZ8PTAilaXpER+d7ypdABCrpwMdg=
+go.uber.org/atomic v0.0.0-20181018215023-8dc6146f7569/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/multierr v0.0.0-20180122172545-ddea229ff1df h1:shvkWr0NAZkg4nPuE3XrKP0VuBPijjk3TfX6Y6acFNg=
+go.uber.org/multierr v0.0.0-20180122172545-ddea229ff1df/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
+go.uber.org/zap v0.0.0-20180814183419-67bc79d13d15 h1:Z2sc4+v0JHV6Mn4kX1f2a5nruNjmV+Th32sugE8zwz8=
+go.uber.org/zap v0.0.0-20180814183419-67bc79d13d15/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
+golang.org/x/crypto v0.0.0-20181025213731-e84da0312774 h1:a4tQYYYuK9QdeO/+kEvNYyuR21S+7ve5EANok6hABhI=
+golang.org/x/crypto v0.0.0-20181025213731-e84da0312774/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/lint v0.0.0-20181217174547-8f45f776aaf1/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181201002055-351d144fa1fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190812203447-cdfb69ac37fc h1:gkKoSkUmnU6bpS/VhkuO27bzQeSA51uaEfbOW5dNb68=
+golang.org/x/net v0.0.0-20190812203447-cdfb69ac37fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/oauth2 v0.0.0-20190402181905-9f3314589c9a h1:tImsplftrFpALCYumobsd0K86vlAs/eXGFms2txfJfA=
+golang.org/x/oauth2 v0.0.0-20190402181905-9f3314589c9a/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f h1:Bl/8QSvNqXvPGPGXa2z5xUTmV7VDcZyvRZ+QQXkXTZQ=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20190209173611-3b5209105503 h1:5SvYFrOM3W8Mexn9/oA44Ji7vhXAZQ9hiP+1Q/DMrWg=
+golang.org/x/sys v0.0.0-20190209173611-3b5209105503/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/text v0.3.1-0.20181227161524-e6919f6577db h1:6/JqlYfC1CCaLnGceQTI+sDGhC9UBSPAsBqI0Gun6kU=
+golang.org/x/text v0.3.1-0.20181227161524-e6919f6577db/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/time v0.0.0-20161028155119-f51c12702a4d h1:TnM+PKb3ylGmZvyPXmo9m/wktg7Jn/a/fNmr33HSj8g=
+golang.org/x/time v0.0.0-20161028155119-f51c12702a4d/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20181011042414-1f849cf54d09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190614205625-5aca471b1d59/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.5.0 h1:KxkO13IPW4Lslp2bz+KHP2E3gtFlrIGNThxkZQ3g+4c=
+google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8 h1:Nw54tB0rB7hY/N0NQvRW8DG4Yk3Q6T9cu9RcFQDu1tc=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873 h1:nfPFGzJkUDX6uBmpN/pSw7MbOAWegH5QDQuoXFHedLg=
+google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.23.0 h1:AzbTB6ux+okLTzP8Ru1Xs41C303zdcfEht7MQnYJt5A=
+google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4=
+gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/inf.v0 v0.9.0 h1:3zYtXIO92bvsdS3ggAdA8Gb4Azj0YU+TVY1uGYNFA8o=
+gopkg.in/inf.v0 v0.9.0/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/natefinch/lumberjack.v2 v2.0.0 h1:1Lc07Kr7qY4U2YPouBjpCLxpiyxIVoxqXgkXLknAOE8=
+gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
+gopkg.in/square/go-jose.v2 v2.2.2 h1:orlkJ3myw8CN1nVQHBFfloD+L3egixIa4FvUP6RosSA=
+gopkg.in/square/go-jose.v2 v2.2.2/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/yaml.v2 v2.2.1 h1:mUhvW9EsL+naU5Q3cakzfE91YhliOondGd6ZrsDBHQE=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
+gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+k8s.io/api v0.0.0-20190918155943-95b840bb6a1f/go.mod h1:uWuOHnjmNrtQomJrvEBg0c0HRNyQ+8KTEERVsK0PW48=
+k8s.io/apimachinery v0.0.0-20190913080033-27d36303b655/go.mod h1:nL6pwRT8NgfF8TT68DBI8uEePRt89cSvoXUVqbkWHq4=
+k8s.io/client-go v0.0.0-20190918160344-1fbdaa4c8d90/go.mod h1:J69/JveO6XESwVgG53q3Uz5OSfgsv4uxpScmmyYOOlk=
+k8s.io/component-base v0.0.0-20190918160511-547f6c5d7090/go.mod h1:933PBGtQFJky3TEwYx4aEPZ4IxqhWh3R6DCmzqIn1hA=
+k8s.io/gengo v0.0.0-20190128074634-0689ccc1d7d6/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
+k8s.io/klog v0.0.0-20181102134211-b9b56d5dfc92/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
+k8s.io/klog v0.3.0/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
+k8s.io/klog v0.4.0 h1:lCJCxf/LIowc2IGS9TPjWDyXY4nOmdGdfcwwDQCOURQ=
+k8s.io/klog v0.4.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I=
+k8s.io/kube-openapi v0.0.0-20190816220812-743ec37842bf h1:EYm5AW/UUDbnmnI+gK0TJDVK9qPLhM+sRHYanNKw0EQ=
+k8s.io/kube-openapi v0.0.0-20190816220812-743ec37842bf/go.mod h1:1TqjTSzOxsLGIKfj0lK8EeCP7K1iUG65v09OM0/WG5E=
+k8s.io/utils v0.0.0-20190801114015-581e00157fb1 h1:+ySTxfHnfzZb9ys375PXNlLhkJPLKgHajBU0N62BDvE=
+k8s.io/utils v0.0.0-20190801114015-581e00157fb1/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
+sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e h1:4Z09Hglb792X0kfOBBJUPFEyvVfQWrYT/l8h5EKA6JQ=
+sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e/go.mod h1:wWxsB5ozmmv/SG7nM11ayaAW51xMvak/t1r0CSlcokI=
+sigs.k8s.io/structured-merge-diff v0.0.0-20190817042607-6149e4549fca h1:6dsH6AYQWbyZmtttJNe8Gq1cXOeS1BdV3eW37zHilAQ=
+sigs.k8s.io/structured-merge-diff v0.0.0-20190817042607-6149e4549fca/go.mod h1:IIgPezJWb76P0hotTxzDbWsMYB8APh18qZnxkomBpxA=
+sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
+sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
--- a/vendor/k8s.io/apiserver/hack/godep-deps.sh
+++ b/vendor/k8s.io/apiserver/hack/godep-deps.sh
@@ -1,78 +0,0 @@
-#!/bin/bash
-
-# Copyright 2017 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-# overall flow
-# 1. make a clean gopath
-# 2. godep restore based on k8s.io/kuberentes provided manifest
-# 3. go get anything unlisted.  This handles deps from k8s.io/*
-# 4. remove old vendoring data
-# 5. vendor packages we need
-# 6. remove anything vendored from k8s.io/* from vendor, but not manifest.
-#    This allows go get to work and still be able to flatten dependencies.
-# 6. copy new vendored packages and save them
-
-set -o errexit
-set -o nounset
-set -o pipefail
-
-goPath=$(mktemp -d "${TMPDIR:-/tmp/}$(basename 0).XXXXXXXXXXXX")
-echo ${goPath}
-
-export GOPATH=${goPath}
-
-mkdir -p ${goPath}/src/k8s.io/apiserver
-cp -R . ${goPath}/src/k8s.io/apiserver
-
-pushd ${goPath}/src/k8s.io/apiserver
-rm -rf vendor || true
-
-# restore what we have in our new manifest that we've sync
-godep restore
-
-# we have to some crazy schenanigans for client-go until it can keep its syncs up to date
-# we have to restore its old/bad deps
-go get -d k8s.io/client-go/... || true
-pushd ${goPath}/src/k8s.io/client-go
-godep restore
-rm -rf ${goPath}/src/k8s.io/apimachinery
-popd 
-
-# the manifest doesn't include any levels of k8s.io dependencies so load them using the go get
-# assume you sync all the repos at the same time, the leves you get will be correct
-go get -d ./... || true
-
-
-# save the new levels of dependencies
-rm -rf vendor || true
-rm -rf Godeps || true
-godep save ./...
-
-# remove the vendored k8s.io/* go files
-rm -rf vendor/k8s.io
-popd
-
-# remove the vendor dir we have and move the one we just made
-rm -rf vendor || true
-rm -rf Godeps || true
-git rm -rf vendor || true
-git rm -rf Godeps || true
-mv ${goPath}/src/k8s.io/apiserver/vendor .
-mv ${goPath}/src/k8s.io/apiserver/Godeps .
-git add vendor
-git add Godeps
-git commit -m "sync: resync vendor folder"
-
--- a/vendor/k8s.io/apiserver/hack/sync-from-kubernetes.sh
+++ b/vendor/k8s.io/apiserver/hack/sync-from-kubernetes.sh
@@ -1,73 +0,0 @@
-#!/bin/bash
-
-# Copyright 2017 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-# overall flow
-# 1. fetch the current level of k8s.io/kubernetes
-# 2. check out the k8s.io/kubernetes HEAD into a separate branch
-# 3. rewrite the history on that branch to *only* include staging/src/k8s.io/apiserver
-# 4. locate all commits between the last time we sync'ed and now
-# 5. switch back to the starting branch
-# 6. for each commit, cherry-pick it (which will keep authorship) into current branch
-# 7. update metadata files indicating which commits we've sync'ed to
-
-set -e
-
-ROOT=$(dirname "${BASH_SOURCE}")/..
-dir=$(mktemp -d "${TMPDIR:-/tmp/}$(basename 0).XXXXXXXXXXXX")
-
-git remote add upstream-kube git@github.com:kubernetes/kubernetes.git  || true
-git fetch upstream-kube
-
-currBranch=$(git rev-parse --abbrev-ref HEAD)
-previousKubeSHA=$(cat kubernetes-sha)
-previousBranchSHA=$(cat filter-branch-sha)
-
-git branch -D kube-sync || true
-git checkout upstream-kube/master -b kube-sync
-git reset --hard upstream-kube/master
-newKubeSHA=$(git log --oneline --format='%H' kube-sync -1)
-
-# this command rewrite git history to *only* include staging/src/k8s.io/apiserver
-git filter-branch -f --subdirectory-filter staging/src/k8s.io/apiserver HEAD
-
-newBranchSHA=$(git log --oneline --format='%H' kube-sync -1)
-git log --no-merges --format='%H' --reverse ${previousBranchSHA}..HEAD > ${dir}/commits
-
-git checkout ${currBranch}
-
-# we must reset Godeps.json to what it looked like BEFORE the last vendor sync so that any
-# new Godep.json changes from k8s.io/kubernetes will apply cleanly.  Since its always auto-generated
-# it doesn't matter that we're removing it
-lastResyncCommit=$(git rev-list -n 1 --grep "sync: resync vendor folder" HEAD)
-cleanGodepJsonCommit=$(git rev-list -n 1 ${lastResyncCommit}^)
-git checkout ${cleanGodepJsonCommit} Godeps/Godeps.json
-git commit -m "sync: reset Godeps.json" -- Godeps/Godeps.json
-
-while read commitSHA; do
-	echo "working ${commitSHA}"
-	git cherry-pick ${commitSHA}
-done <${dir}/commits
-
-# update the vendored godeps
-${ROOT}/hack/godep-deps.sh
-
-# track the k8s.io/kubernetes commit SHA so we can always determine which level of kube this repo matches
-# track the filtered branch commit SHA so that we can determine which commits need to be picked
-echo ${newKubeSHA} > kubernetes-sha
-echo ${newBranchSHA} > filter-branch-sha
-git commit -m "sync(k8s.io/kubernetes): ${newKubeSHA}" -- kubernetes-sha filter-branch-sha
-
--- a/vendor/k8s.io/apiserver/pkg/admission/BUILD
+++ b/vendor/k8s.io/apiserver/pkg/admission/BUILD
@@ -1,84 +0,0 @@
-package(default_visibility = ["//visibility:public"])
-
-load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_library",
-    "go_test",
-)
-
-go_test(
-    name = "go_default_test",
-    srcs = [
-        "chain_test.go",
-        "config_test.go",
-        "errors_test.go",
-        "handler_test.go",
-    ],
-    importpath = "k8s.io/apiserver/pkg/admission",
-    library = ":go_default_library",
-    deps = [
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/apis/apiserver:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/apis/apiserver/v1alpha1:go_default_library",
-    ],
-)
-
-go_library(
-    name = "go_default_library",
-    srcs = [
-        "attributes.go",
-        "chain.go",
-        "config.go",
-        "errors.go",
-        "handler.go",
-        "interfaces.go",
-        "plugins.go",
-    ],
-    importpath = "k8s.io/apiserver/pkg/admission",
-    deps = [
-        "//vendor/github.com/ghodss/yaml:go_default_library",
-        "//vendor/github.com/golang/glog:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/api/meta:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime/serializer:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/errors:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/sets:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/apis/apiserver:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/apis/apiserver/v1alpha1:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/authentication/user:go_default_library",
-    ],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [
-        ":package-srcs",
-        "//staging/src/k8s.io/apiserver/pkg/admission/configuration:all-srcs",
-        "//staging/src/k8s.io/apiserver/pkg/admission/initializer:all-srcs",
-        "//staging/src/k8s.io/apiserver/pkg/admission/metrics:all-srcs",
-        "//staging/src/k8s.io/apiserver/pkg/admission/plugin/initialization:all-srcs",
-        "//staging/src/k8s.io/apiserver/pkg/admission/plugin/namespace/lifecycle:all-srcs",
-        "//staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/config:all-srcs",
-        "//staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/errors:all-srcs",
-        "//staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/initializer:all-srcs",
-        "//staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/mutating:all-srcs",
-        "//staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/namespace:all-srcs",
-        "//staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/request:all-srcs",
-        "//staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/rules:all-srcs",
-        "//staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/testcerts:all-srcs",
-        "//staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/validating:all-srcs",
-        "//staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/versioned:all-srcs",
-    ],
-    tags = ["automanaged"],
-)
--- a/vendor/k8s.io/apiserver/pkg/admission/attributes.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/attributes.go
@@ -17,8 +17,14 @@ limitations under the License.
 package admission

 import (
+	"fmt"
+	"strings"
+	"sync"
+
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/validation"
+	auditinternal "k8s.io/apiserver/pkg/apis/audit"
 	"k8s.io/apiserver/pkg/authentication/user"
 )

@@ -29,22 +35,39 @@ type attributesRecord struct {
 	resource    schema.GroupVersionResource
 	subresource string
 	operation   Operation
+	options     runtime.Object
+	dryRun      bool
 	object      runtime.Object
 	oldObject   runtime.Object
 	userInfo    user.Info
+
+	// other elements are always accessed in single goroutine.
+	// But ValidatingAdmissionWebhook add annotations concurrently.
+	annotations     map[string]annotation
+	annotationsLock sync.RWMutex
+
+	reinvocationContext ReinvocationContext
 }

-func NewAttributesRecord(object runtime.Object, oldObject runtime.Object, kind schema.GroupVersionKind, namespace, name string, resource schema.GroupVersionResource, subresource string, operation Operation, userInfo user.Info) Attributes {
+type annotation struct {
+	level auditinternal.Level
+	value string
+}
+
+func NewAttributesRecord(object runtime.Object, oldObject runtime.Object, kind schema.GroupVersionKind, namespace, name string, resource schema.GroupVersionResource, subresource string, operation Operation, operationOptions runtime.Object, dryRun bool, userInfo user.Info) Attributes {
 	return &attributesRecord{
-		kind:        kind,
-		namespace:   namespace,
-		name:        name,
-		resource:    resource,
-		subresource: subresource,
-		operation:   operation,
-		object:      object,
-		oldObject:   oldObject,
-		userInfo:    userInfo,
+		kind:                kind,
+		namespace:           namespace,
+		name:                name,
+		resource:            resource,
+		subresource:         subresource,
+		operation:           operation,
+		options:             operationOptions,
+		dryRun:              dryRun,
+		object:              object,
+		oldObject:           oldObject,
+		userInfo:            userInfo,
+		reinvocationContext: &reinvocationContext{},
 	}
 }

@@ -72,6 +95,14 @@ func (record *attributesRecord) GetOperation() Operation {
 	return record.operation
 }

+func (record *attributesRecord) GetOperationOptions() runtime.Object {
+	return record.options
+}
+
+func (record *attributesRecord) IsDryRun() bool {
+	return record.dryRun
+}
+
 func (record *attributesRecord) GetObject() runtime.Object {
 	return record.object
 }
@@ -83,3 +114,98 @@ func (record *attributesRecord) GetOldObject() runtime.Object {
 func (record *attributesRecord) GetUserInfo() user.Info {
 	return record.userInfo
 }
+
+// getAnnotations implements privateAnnotationsGetter.It's a private method used
+// by WithAudit decorator.
+func (record *attributesRecord) getAnnotations(maxLevel auditinternal.Level) map[string]string {
+	record.annotationsLock.RLock()
+	defer record.annotationsLock.RUnlock()
+
+	if record.annotations == nil {
+		return nil
+	}
+	cp := make(map[string]string, len(record.annotations))
+	for key, value := range record.annotations {
+		if value.level.Less(maxLevel) || value.level == maxLevel {
+			cp[key] = value.value
+		}
+	}
+	return cp
+}
+
+// AddAnnotation adds an annotation to attributesRecord with Metadata audit level
+func (record *attributesRecord) AddAnnotation(key, value string) error {
+	return record.AddAnnotationWithLevel(key, value, auditinternal.LevelMetadata)
+}
+
+func (record *attributesRecord) AddAnnotationWithLevel(key, value string, level auditinternal.Level) error {
+	if err := checkKeyFormat(key); err != nil {
+		return err
+	}
+	if level.Less(auditinternal.LevelMetadata) {
+		return fmt.Errorf("admission annotations are not allowed to be set at audit level lower than Metadata, key: %q, level: %s", key, level)
+	}
+	record.annotationsLock.Lock()
+	defer record.annotationsLock.Unlock()
+
+	if record.annotations == nil {
+		record.annotations = make(map[string]annotation)
+	}
+	annotation := annotation{level: level, value: value}
+	if v, ok := record.annotations[key]; ok && v != annotation {
+		return fmt.Errorf("admission annotations are not allowd to be overwritten, key:%q, old value: %v, new value: %v", key, record.annotations[key], annotation)
+	}
+	record.annotations[key] = annotation
+	return nil
+}
+
+func (record *attributesRecord) GetReinvocationContext() ReinvocationContext {
+	return record.reinvocationContext
+}
+
+type reinvocationContext struct {
+	// isReinvoke is true when admission plugins are being reinvoked
+	isReinvoke bool
+	// reinvokeRequested is true when an admission plugin requested a re-invocation of the chain
+	reinvokeRequested bool
+	// values stores reinvoke context values per plugin.
+	values map[string]interface{}
+}
+
+func (rc *reinvocationContext) IsReinvoke() bool {
+	return rc.isReinvoke
+}
+
+func (rc *reinvocationContext) SetIsReinvoke() {
+	rc.isReinvoke = true
+}
+
+func (rc *reinvocationContext) ShouldReinvoke() bool {
+	return rc.reinvokeRequested
+}
+
+func (rc *reinvocationContext) SetShouldReinvoke() {
+	rc.reinvokeRequested = true
+}
+
+func (rc *reinvocationContext) SetValue(plugin string, v interface{}) {
+	if rc.values == nil {
+		rc.values = map[string]interface{}{}
+	}
+	rc.values[plugin] = v
+}
+
+func (rc *reinvocationContext) Value(plugin string) interface{} {
+	return rc.values[plugin]
+}
+
+func checkKeyFormat(key string) error {
+	parts := strings.Split(key, "/")
+	if len(parts) != 2 {
+		return fmt.Errorf("annotation key has invalid format, the right format is a DNS subdomain prefix and '/' and key name. (e.g. 'podsecuritypolicy.admission.k8s.io/admit-policy')")
+	}
+	if msgs := validation.IsQualifiedName(key); len(msgs) != 0 {
+		return fmt.Errorf("annotation key has invalid format %s. A qualified name like 'podsecuritypolicy.admission.k8s.io/admit-policy' is required.", strings.Join(msgs, ","))
+	}
+	return nil
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/attributes_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/attributes_test.go
@@ -0,0 +1,65 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package admission
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	auditinternal "k8s.io/apiserver/pkg/apis/audit"
+)
+
+func TestAddAnnotation(t *testing.T) {
+	attr := &attributesRecord{}
+
+	// test AddAnnotation
+	attr.AddAnnotation("podsecuritypolicy.admission.k8s.io/validate-policy", "privileged")
+	attr.AddAnnotation("podsecuritypolicy.admission.k8s.io/admit-policy", "privileged")
+	annotations := attr.getAnnotations(auditinternal.LevelMetadata)
+	assert.Equal(t, annotations["podsecuritypolicy.admission.k8s.io/validate-policy"], "privileged")
+
+	// test overwrite
+	assert.Error(t, attr.AddAnnotation("podsecuritypolicy.admission.k8s.io/validate-policy", "privileged-overwrite"),
+		"admission annotations should not be allowd to be overwritten")
+	annotations = attr.getAnnotations(auditinternal.LevelMetadata)
+	assert.Equal(t, annotations["podsecuritypolicy.admission.k8s.io/validate-policy"], "privileged", "admission annotations should not be overwritten")
+
+	// test invalid plugin names
+	var testCases map[string]string = map[string]string{
+		"invalid dns subdomain": "INVALID-DNS-Subdomain/policy",
+		"no plugin name":        "policy",
+		"no key name":           "podsecuritypolicy.admission.k8s.io",
+		"empty key":             "",
+	}
+	for name, invalidKey := range testCases {
+		err := attr.AddAnnotation(invalidKey, "value-foo")
+		assert.Error(t, err)
+		annotations = attr.getAnnotations(auditinternal.LevelMetadata)
+		assert.Equal(t, annotations[invalidKey], "", name+": invalid pluginName is not allowed ")
+	}
+
+	// test all saved annotations
+	assert.Equal(
+		t,
+		annotations,
+		map[string]string{
+			"podsecuritypolicy.admission.k8s.io/validate-policy": "privileged",
+			"podsecuritypolicy.admission.k8s.io/admit-policy":    "privileged",
+		},
+		"unexpected final annotations",
+	)
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/audit.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/audit.go
@@ -0,0 +1,103 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package admission
+
+import (
+	"context"
+	"fmt"
+
+	auditinternal "k8s.io/apiserver/pkg/apis/audit"
+	"k8s.io/apiserver/pkg/audit"
+)
+
+// auditHandler logs annotations set by other admission handlers
+type auditHandler struct {
+	Interface
+	ae *auditinternal.Event
+}
+
+var _ Interface = &auditHandler{}
+var _ MutationInterface = &auditHandler{}
+var _ ValidationInterface = &auditHandler{}
+
+// WithAudit is a decorator for a admission phase. It saves annotations
+// of attribute into the audit event. Attributes passed to the Admit and
+// Validate function must be instance of privateAnnotationsGetter or
+// AnnotationsGetter, otherwise an error is returned.
+func WithAudit(i Interface, ae *auditinternal.Event) Interface {
+	if i == nil {
+		return i
+	}
+	return &auditHandler{i, ae}
+}
+
+func (handler auditHandler) Admit(ctx context.Context, a Attributes, o ObjectInterfaces) error {
+	if !handler.Interface.Handles(a.GetOperation()) {
+		return nil
+	}
+	if err := ensureAnnotationGetter(a); err != nil {
+		return err
+	}
+	var err error
+	if mutator, ok := handler.Interface.(MutationInterface); ok {
+		err = mutator.Admit(ctx, a, o)
+		handler.logAnnotations(a)
+	}
+	return err
+}
+
+func (handler auditHandler) Validate(ctx context.Context, a Attributes, o ObjectInterfaces) error {
+	if !handler.Interface.Handles(a.GetOperation()) {
+		return nil
+	}
+	if err := ensureAnnotationGetter(a); err != nil {
+		return err
+	}
+	var err error
+	if validator, ok := handler.Interface.(ValidationInterface); ok {
+		err = validator.Validate(ctx, a, o)
+		handler.logAnnotations(a)
+	}
+	return err
+}
+
+func ensureAnnotationGetter(a Attributes) error {
+	_, okPrivate := a.(privateAnnotationsGetter)
+	_, okPublic := a.(AnnotationsGetter)
+	if okPrivate || okPublic {
+		return nil
+	}
+	return fmt.Errorf("attributes must be an instance of privateAnnotationsGetter or AnnotationsGetter")
+}
+
+func (handler auditHandler) logAnnotations(a Attributes) {
+	if handler.ae == nil {
+		return
+	}
+	switch a := a.(type) {
+	case privateAnnotationsGetter:
+		for key, value := range a.getAnnotations(handler.ae.Level) {
+			audit.LogAnnotation(handler.ae, key, value)
+		}
+	case AnnotationsGetter:
+		for key, value := range a.GetAnnotations(handler.ae.Level) {
+			audit.LogAnnotation(handler.ae, key, value)
+		}
+	default:
+		// this will never happen, because we have already checked it in ensureAnnotationGetter
+	}
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/audit_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/audit_test.go
@@ -0,0 +1,174 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package admission
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	auditinternal "k8s.io/apiserver/pkg/apis/audit"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// fakeHandler implements Interface
+type fakeHandler struct {
+	// return value of Admit()
+	admit error
+	// annotations add to attributesRecord during Admit() phase
+	admitAnnotations map[string]string
+	// return value of Validate()
+	validate error
+	// annotations add to attributesRecord during Validate() phase
+	validateAnnotations map[string]string
+	// return value of Handles()
+	handles bool
+}
+
+var _ Interface = &fakeHandler{}
+var _ MutationInterface = &fakeHandler{}
+var _ ValidationInterface = &fakeHandler{}
+
+func (h fakeHandler) Admit(ctx context.Context, a Attributes, o ObjectInterfaces) error {
+	for k, v := range h.admitAnnotations {
+		a.AddAnnotation(k, v)
+	}
+	return h.admit
+}
+
+func (h fakeHandler) Validate(ctx context.Context, a Attributes, o ObjectInterfaces) error {
+	for k, v := range h.validateAnnotations {
+		a.AddAnnotation(k, v)
+	}
+	return h.validate
+}
+
+func (h fakeHandler) Handles(o Operation) bool {
+	return h.handles
+}
+
+func attributes() Attributes {
+	return NewAttributesRecord(nil, nil, schema.GroupVersionKind{}, "", "", schema.GroupVersionResource{}, "", "", nil, false, nil)
+}
+
+func TestWithAudit(t *testing.T) {
+	var testCases = map[string]struct {
+		admit               error
+		admitAnnotations    map[string]string
+		validate            error
+		validateAnnotations map[string]string
+		handles             bool
+	}{
+		"not handle": {
+			nil,
+			nil,
+			nil,
+			nil,
+			false,
+		},
+		"allow": {
+			nil,
+			nil,
+			nil,
+			nil,
+			true,
+		},
+		"allow with annotations": {
+			nil,
+			map[string]string{
+				"plugin.example.com/foo": "bar",
+			},
+			nil,
+			nil,
+			true,
+		},
+		"allow with annotations overwrite": {
+			nil,
+			map[string]string{
+				"plugin.example.com/foo": "bar",
+			},
+			nil,
+			map[string]string{
+				"plugin.example.com/foo": "bar",
+			},
+			true,
+		},
+		"forbidden error": {
+			NewForbidden(attributes(), fmt.Errorf("quota exceeded")),
+			nil,
+			NewForbidden(attributes(), fmt.Errorf("quota exceeded")),
+			nil,
+			true,
+		},
+		"forbidden error with annotations": {
+			NewForbidden(attributes(), fmt.Errorf("quota exceeded")),
+			nil,
+			NewForbidden(attributes(), fmt.Errorf("quota exceeded")),
+			map[string]string{
+				"plugin.example.com/foo": "bar",
+			},
+			true,
+		},
+		"forbidden error with annotations overwrite": {
+			NewForbidden(attributes(), fmt.Errorf("quota exceeded")),
+			map[string]string{
+				"plugin.example.com/foo": "bar",
+			},
+			NewForbidden(attributes(), fmt.Errorf("quota exceeded")),
+			map[string]string{
+				"plugin.example.com/foo": "bar",
+			},
+			true,
+		},
+	}
+	for tcName, tc := range testCases {
+		var handler Interface = fakeHandler{tc.admit, tc.admitAnnotations, tc.validate, tc.validateAnnotations, tc.handles}
+		ae := &auditinternal.Event{Level: auditinternal.LevelMetadata}
+		auditHandler := WithAudit(handler, ae)
+		a := attributes()
+
+		assert.Equal(t, handler.Handles(Create), auditHandler.Handles(Create), tcName+": WithAudit decorator should not effect the return value")
+
+		mutator, ok := handler.(MutationInterface)
+		require.True(t, ok)
+		auditMutator, ok := auditHandler.(MutationInterface)
+		require.True(t, ok)
+		assert.Equal(t, mutator.Admit(context.TODO(), a, nil), auditMutator.Admit(context.TODO(), a, nil), tcName+": WithAudit decorator should not effect the return value")
+
+		validator, ok := handler.(ValidationInterface)
+		require.True(t, ok)
+		auditValidator, ok := auditHandler.(ValidationInterface)
+		require.True(t, ok)
+		assert.Equal(t, validator.Validate(context.TODO(), a, nil), auditValidator.Validate(context.TODO(), a, nil), tcName+": WithAudit decorator should not effect the return value")
+
+		annotations := make(map[string]string, len(tc.admitAnnotations)+len(tc.validateAnnotations))
+		for k, v := range tc.admitAnnotations {
+			annotations[k] = v
+		}
+		for k, v := range tc.validateAnnotations {
+			annotations[k] = v
+		}
+		if len(annotations) == 0 {
+			assert.Nil(t, ae.Annotations, tcName+": unexptected annotations set in audit event")
+		} else {
+			assert.Equal(t, annotations, ae.Annotations, tcName+": unexptected annotations set in audit event")
+		}
+	}
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/chain.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/chain.go
@@ -16,6 +16,8 @@ limitations under the License.

 package admission

+import "context"
+
 // chainAdmissionHandler is an instance of admission.NamedHandler that performs admission control using
 // a chain of admission handlers
 type chainAdmissionHandler []Interface
@@ -26,13 +28,13 @@ func NewChainHandler(handlers ...Interface) chainAdmissionHandler {
 }

 // Admit performs an admission control check using a chain of handlers, and returns immediately on first error
-func (admissionHandler chainAdmissionHandler) Admit(a Attributes) error {
+func (admissionHandler chainAdmissionHandler) Admit(ctx context.Context, a Attributes, o ObjectInterfaces) error {
 	for _, handler := range admissionHandler {
 		if !handler.Handles(a.GetOperation()) {
 			continue
 		}
 		if mutator, ok := handler.(MutationInterface); ok {
-			err := mutator.Admit(a)
+			err := mutator.Admit(ctx, a, o)
 			if err != nil {
 				return err
 			}
@@ -42,13 +44,13 @@ func (admissionHandler chainAdmissionHandler) Admit(a Attributes) error {
 }

 // Validate performs an admission control check using a chain of handlers, and returns immediately on first error
-func (admissionHandler chainAdmissionHandler) Validate(a Attributes) error {
+func (admissionHandler chainAdmissionHandler) Validate(ctx context.Context, a Attributes, o ObjectInterfaces) error {
 	for _, handler := range admissionHandler {
 		if !handler.Handles(a.GetOperation()) {
 			continue
 		}
 		if validator, ok := handler.(ValidationInterface); ok {
-			err := validator.Validate(a)
+			err := validator.Validate(ctx, a, o)
 			if err != nil {
 				return err
 			}
--- a/vendor/k8s.io/apiserver/pkg/admission/chain_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/chain_test.go
@@ -17,10 +17,12 @@ limitations under the License.
 package admission

 import (
+	"context"
 	"fmt"
 	"testing"

 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 )

@@ -31,7 +33,7 @@ type FakeHandler struct {
 	validate, validateCalled bool
 }

-func (h *FakeHandler) Admit(a Attributes) (err error) {
+func (h *FakeHandler) Admit(ctx context.Context, a Attributes, o ObjectInterfaces) (err error) {
 	h.admitCalled = true
 	if h.admit {
 		return nil
@@ -39,7 +41,7 @@ func (h *FakeHandler) Admit(a Attributes) (err error) {
 	return fmt.Errorf("Don't admit")
 }

-func (h *FakeHandler) Validate(a Attributes) (err error) {
+func (h *FakeHandler) Validate(ctx context.Context, a Attributes, o ObjectInterfaces) (err error) {
 	h.validateCalled = true
 	if h.validate {
 		return nil
@@ -63,6 +65,7 @@ func TestAdmitAndValidate(t *testing.T) {
 		name      string
 		ns        string
 		operation Operation
+		options   runtime.Object
 		chain     chainAdmissionHandler
 		accept    bool
 		calls     map[string]bool
@@ -71,6 +74,7 @@ func TestAdmitAndValidate(t *testing.T) {
 			name:      "all accept",
 			ns:        sysns,
 			operation: Create,
+			options:   &metav1.CreateOptions{},
 			chain: []Interface{
 				makeHandler("a", true, Update, Delete, Create),
 				makeHandler("b", true, Delete, Create),
@@ -83,6 +87,7 @@ func TestAdmitAndValidate(t *testing.T) {
 			name:      "ignore handler",
 			ns:        otherns,
 			operation: Create,
+			options:   &metav1.CreateOptions{},
 			chain: []Interface{
 				makeHandler("a", true, Update, Delete, Create),
 				makeHandler("b", false, Delete),
@@ -95,6 +100,7 @@ func TestAdmitAndValidate(t *testing.T) {
 			name:      "ignore all",
 			ns:        sysns,
 			operation: Connect,
+			options:   nil,
 			chain: []Interface{
 				makeHandler("a", true, Update, Delete, Create),
 				makeHandler("b", false, Delete),
@@ -107,6 +113,7 @@ func TestAdmitAndValidate(t *testing.T) {
 			name:      "reject one",
 			ns:        otherns,
 			operation: Delete,
+			options:   &metav1.DeleteOptions{},
 			chain: []Interface{
 				makeHandler("a", true, Update, Delete, Create),
 				makeHandler("b", false, Delete),
@@ -119,7 +126,7 @@ func TestAdmitAndValidate(t *testing.T) {
 	for _, test := range tests {
 		t.Logf("testcase = %s", test.name)
 		// call admit and check that validate was not called at all
-		err := test.chain.Admit(NewAttributesRecord(nil, nil, schema.GroupVersionKind{}, test.ns, "", schema.GroupVersionResource{}, "", test.operation, nil))
+		err := test.chain.Admit(context.TODO(), NewAttributesRecord(nil, nil, schema.GroupVersionKind{}, test.ns, "", schema.GroupVersionResource{}, "", test.operation, test.options, false, nil), nil)
 		accepted := (err == nil)
 		if accepted != test.accept {
 			t.Errorf("unexpected result of admit call: %v", accepted)
@@ -140,7 +147,7 @@ func TestAdmitAndValidate(t *testing.T) {
 		}

 		// call validate and check that admit was not called at all
-		err = test.chain.Validate(NewAttributesRecord(nil, nil, schema.GroupVersionKind{}, test.ns, "", schema.GroupVersionResource{}, "", test.operation, nil))
+		err = test.chain.Validate(context.TODO(), NewAttributesRecord(nil, nil, schema.GroupVersionKind{}, test.ns, "", schema.GroupVersionResource{}, "", test.operation, test.options, false, nil), nil)
 		accepted = (err == nil)
 		if accepted != test.accept {
 			t.Errorf("unexpected result of validate call: %v\n", accepted)
--- a/vendor/k8s.io/apiserver/pkg/admission/config.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/config.go
@@ -17,6 +17,7 @@ limitations under the License.
 package admission

 import (
+	"bytes"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -24,13 +25,10 @@ import (
 	"path"
 	"path/filepath"

-	"github.com/ghodss/yaml"
-	"github.com/golang/glog"
-
-	"bytes"
+	"k8s.io/klog"
+	"sigs.k8s.io/yaml"

 	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/runtime/serializer"
 	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/apiserver/pkg/apis/apiserver"
@@ -89,13 +87,24 @@ func ReadAdmissionConfiguration(pluginNames []string, configFilePath string, con
 		}
 		return configProvider{
 			config: decodedConfig,
-			scheme: configScheme,
 		}, nil
 	}
 	// we got an error where the decode wasn't related to a missing type
 	if !(runtime.IsMissingVersion(err) || runtime.IsMissingKind(err) || runtime.IsNotRegisteredError(err)) {
 		return nil, err
 	}
+
+	// Only tolerate load errors if the file appears to be one of the two legacy plugin configs
+	unstructuredData := map[string]interface{}{}
+	if err2 := yaml.Unmarshal(data, &unstructuredData); err2 != nil {
+		return nil, err
+	}
+	_, isLegacyImagePolicy := unstructuredData["imagePolicy"]
+	_, isLegacyPodNodeSelector := unstructuredData["podNodeSelectorPluginConfig"]
+	if !isLegacyImagePolicy && !isLegacyPodNodeSelector {
+		return nil, err
+	}
+
 	// convert the legacy format to the new admission control format
 	// in order to preserve backwards compatibility, we set plugins that
 	// previously read input from a non-versioned file configuration to the
@@ -117,32 +126,24 @@ func ReadAdmissionConfiguration(pluginNames []string, configFilePath string, con
 	}
 	return configProvider{
 		config: internalConfig,
-		scheme: configScheme,
 	}, nil
 }

 type configProvider struct {
 	config *apiserver.AdmissionConfiguration
-	scheme *runtime.Scheme
 }

 // GetAdmissionPluginConfigurationFor returns a reader that holds the admission plugin configuration.
-func GetAdmissionPluginConfigurationFor(pluginCfg apiserver.AdmissionPluginConfiguration, scheme *runtime.Scheme) (io.Reader, error) {
-	// if there is nothing nested in the object, we return the named location
-	obj := pluginCfg.Configuration
-	if obj != nil {
-		// serialize the configuration and build a reader for it
-		content, err := writeYAML(obj, scheme)
-		if err != nil {
-			return nil, err
-		}
-		return bytes.NewBuffer(content), nil
+func GetAdmissionPluginConfigurationFor(pluginCfg apiserver.AdmissionPluginConfiguration) (io.Reader, error) {
+	// if there is a nest object, return it directly
+	if pluginCfg.Configuration != nil {
+		return bytes.NewBuffer(pluginCfg.Configuration.Raw), nil
 	}
 	// there is nothing nested, so we delegate to path
 	if pluginCfg.Path != "" {
 		content, err := ioutil.ReadFile(pluginCfg.Path)
 		if err != nil {
-			glog.Fatalf("Couldn't open admission plugin configuration %s: %#v", pluginCfg.Path, err)
+			klog.Fatalf("Couldn't open admission plugin configuration %s: %#v", pluginCfg.Path, err)
 			return nil, err
 		}
 		return bytes.NewBuffer(content), nil
@@ -151,8 +152,8 @@ func GetAdmissionPluginConfigurationFor(pluginCfg apiserver.AdmissionPluginConfi
 	return nil, nil
 }

-// GetAdmissionPluginConfiguration takes the admission configuration and returns a reader
-// for the specified plugin.  If no specific configuration is present, we return a nil reader.
+// ConfigFor returns a reader for the specified plugin.
+// If no specific configuration is present, we return a nil reader.
 func (p configProvider) ConfigFor(pluginName string) (io.Reader, error) {
 	// there is no config, so there is no potential config
 	if p.config == nil {
@@ -163,7 +164,7 @@ func (p configProvider) ConfigFor(pluginName string) (io.Reader, error) {
 		if pluginName != pluginCfg.Name {
 			continue
 		}
-		pluginConfig, err := GetAdmissionPluginConfigurationFor(pluginCfg, p.scheme)
+		pluginConfig, err := GetAdmissionPluginConfigurationFor(pluginCfg)
 		if err != nil {
 			return nil, err
 		}
@@ -172,26 +173,3 @@ func (p configProvider) ConfigFor(pluginName string) (io.Reader, error) {
 	// there is no registered config that matches on plugin name.
 	return nil, nil
 }
-
-// writeYAML writes the specified object to a byte array as yaml.
-func writeYAML(obj runtime.Object, scheme *runtime.Scheme) ([]byte, error) {
-	gvks, _, err := scheme.ObjectKinds(obj)
-	if err != nil {
-		return nil, err
-	}
-	gvs := []schema.GroupVersion{}
-	for _, gvk := range gvks {
-		gvs = append(gvs, gvk.GroupVersion())
-	}
-	codecs := serializer.NewCodecFactory(scheme)
-	json, err := runtime.Encode(codecs.LegacyCodec(gvs...), obj)
-	if err != nil {
-		return nil, err
-	}
-
-	content, err := yaml.JSONToYAML(json)
-	if err != nil {
-		return nil, err
-	}
-	return content, err
-}
--- a/vendor/k8s.io/apiserver/pkg/admission/config_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/config_test.go
@@ -22,9 +22,11 @@ import (
 	"reflect"
 	"testing"

+	"github.com/stretchr/testify/require"
+
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/json"
 	"k8s.io/apiserver/pkg/apis/apiserver"
-	apiserverapi "k8s.io/apiserver/pkg/apis/apiserver"
 	apiserverapiv1alpha1 "k8s.io/apiserver/pkg/apis/apiserver/v1alpha1"
 )

@@ -49,7 +51,7 @@ func TestReadAdmissionConfiguration(t *testing.T) {
 		ExpectedAdmissionConfig *apiserver.AdmissionConfiguration
 		PluginNames             []string
 	}{
-		"v1Alpha1 configuration - path fixup": {
+		"v1alpha1 configuration - path fixup": {
 			ConfigBody: `{
 "apiVersion": "apiserver.k8s.io/v1alpha1",
 "kind": "AdmissionConfiguration",
@@ -70,7 +72,7 @@ func TestReadAdmissionConfiguration(t *testing.T) {
 			},
 			PluginNames: []string{},
 		},
-		"v1Alpha1 configuration - abspath": {
+		"v1alpha1 configuration - abspath": {
 			ConfigBody: `{
 "apiVersion": "apiserver.k8s.io/v1alpha1",
 "kind": "AdmissionConfiguration",
@@ -137,8 +139,8 @@ func TestReadAdmissionConfiguration(t *testing.T) {
 	}

 	scheme := runtime.NewScheme()
-	apiserverapi.AddToScheme(scheme)
-	apiserverapiv1alpha1.AddToScheme(scheme)
+	require.NoError(t, apiserver.AddToScheme(scheme))
+	require.NoError(t, apiserverapiv1alpha1.AddToScheme(scheme))

 	for testName, testCase := range testCases {
 		if err = ioutil.WriteFile(configFileName, []byte(testCase.ConfigBody), 0644); err != nil {
@@ -153,3 +155,98 @@ func TestReadAdmissionConfiguration(t *testing.T) {
 		}
 	}
 }
+
+func TestEmbeddedConfiguration(t *testing.T) {
+	// create a place holder file to hold per test config
+	configFile, err := ioutil.TempFile("", "admission-plugin-config")
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	if err = configFile.Close(); err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	configFileName := configFile.Name()
+
+	testCases := map[string]struct {
+		ConfigBody     string
+		ExpectedConfig string
+	}{
+		"versioned configuration": {
+			ConfigBody: `{
+				"apiVersion": "apiserver.k8s.io/v1alpha1",
+				"kind": "AdmissionConfiguration",
+				"plugins": [
+				  {
+					"name": "Foo",
+					"configuration": {
+					  "apiVersion": "foo.admission.k8s.io/v1alpha1",
+					  "kind": "Configuration",
+					  "foo": "bar"
+					}
+				  }
+				]}`,
+			ExpectedConfig: `{
+			  "apiVersion": "foo.admission.k8s.io/v1alpha1",
+			  "kind": "Configuration",
+			  "foo": "bar"
+			}`,
+		},
+		"legacy configuration": {
+			ConfigBody: `{
+				"apiVersion": "apiserver.k8s.io/v1alpha1",
+				"kind": "AdmissionConfiguration",
+				"plugins": [
+				  {
+					"name": "Foo",
+					"configuration": {
+					  "foo": "bar"
+					}
+				  }
+				]}`,
+			ExpectedConfig: `{
+			  "foo": "bar"
+			}`,
+		},
+	}
+
+	for desc, test := range testCases {
+		scheme := runtime.NewScheme()
+		require.NoError(t, apiserver.AddToScheme(scheme))
+		require.NoError(t, apiserverapiv1alpha1.AddToScheme(scheme))
+
+		if err = ioutil.WriteFile(configFileName, []byte(test.ConfigBody), 0644); err != nil {
+			t.Errorf("[%s] unexpected err writing temp file: %v", desc, err)
+			continue
+		}
+		config, err := ReadAdmissionConfiguration([]string{"Foo"}, configFileName, scheme)
+		if err != nil {
+			t.Errorf("[%s] unexpected err: %v", desc, err)
+			continue
+		}
+		r, err := config.ConfigFor("Foo")
+		if err != nil {
+			t.Errorf("[%s] Failed to get Foo config: %v", desc, err)
+			continue
+		}
+		bs, err := ioutil.ReadAll(r)
+		if err != nil {
+			t.Errorf("[%s] Failed to read Foo config data: %v", desc, err)
+			continue
+		}
+
+		if !equalJSON(test.ExpectedConfig, string(bs)) {
+			t.Errorf("Unexpected config: expected=%q got=%q", test.ExpectedConfig, string(bs))
+		}
+	}
+}
+
+func equalJSON(a, b string) bool {
+	var x, y interface{}
+	if err := json.Unmarshal([]byte(a), &x); err != nil {
+		return false
+	}
+	if err := json.Unmarshal([]byte(b), &y); err != nil {
+		return false
+	}
+	return reflect.DeepEqual(x, y)
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/configuration/BUILD
+++ b/vendor/k8s.io/apiserver/pkg/admission/configuration/BUILD
@@ -1,61 +0,0 @@
-package(default_visibility = ["//visibility:public"])
-
-load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_library",
-    "go_test",
-)
-
-go_test(
-    name = "go_default_test",
-    srcs = [
-        "configuration_manager_test.go",
-        "initializer_manager_test.go",
-        "mutating_webhook_manager_test.go",
-        "validating_webhook_manager_test.go",
-    ],
-    importpath = "k8s.io/apiserver/pkg/admission/configuration",
-    library = ":go_default_library",
-    deps = [
-        "//vendor/k8s.io/api/admissionregistration/v1alpha1:go_default_library",
-        "//vendor/k8s.io/api/admissionregistration/v1beta1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
-    ],
-)
-
-go_library(
-    name = "go_default_library",
-    srcs = [
-        "configuration_manager.go",
-        "initializer_manager.go",
-        "mutating_webhook_manager.go",
-        "validating_webhook_manager.go",
-    ],
-    importpath = "k8s.io/apiserver/pkg/admission/configuration",
-    deps = [
-        "//vendor/github.com/golang/glog:go_default_library",
-        "//vendor/k8s.io/api/admissionregistration/v1alpha1:go_default_library",
-        "//vendor/k8s.io/api/admissionregistration/v1beta1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
-    ],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-)
--- a/vendor/k8s.io/apiserver/pkg/admission/configuration/initializer_manager.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/configuration/initializer_manager.go
@@ -1,88 +0,0 @@
-/*
-Copyright 2017 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package configuration
-
-import (
-	"fmt"
-	"reflect"
-	"sort"
-
-	"github.com/golang/glog"
-
-	"k8s.io/api/admissionregistration/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-type InitializerConfigurationLister interface {
-	List(opts metav1.ListOptions) (*v1alpha1.InitializerConfigurationList, error)
-}
-
-type InitializerConfigurationManager struct {
-	*poller
-}
-
-func NewInitializerConfigurationManager(c InitializerConfigurationLister) *InitializerConfigurationManager {
-	getFn := func() (runtime.Object, error) {
-		list, err := c.List(metav1.ListOptions{})
-		if err != nil {
-			if errors.IsNotFound(err) || errors.IsForbidden(err) {
-				glog.V(5).Infof("Initializers are disabled due to an error: %v", err)
-				return nil, ErrDisabled
-			}
-			return nil, err
-		}
-		return mergeInitializerConfigurations(list), nil
-	}
-	return &InitializerConfigurationManager{
-		newPoller(getFn),
-	}
-}
-
-// Initializers returns the merged InitializerConfiguration.
-func (im *InitializerConfigurationManager) Initializers() (*v1alpha1.InitializerConfiguration, error) {
-	configuration, err := im.poller.configuration()
-	if err != nil {
-		return nil, err
-	}
-	initializerConfiguration, ok := configuration.(*v1alpha1.InitializerConfiguration)
-	if !ok {
-		return nil, fmt.Errorf("expected type %v, got type %v", reflect.TypeOf(initializerConfiguration), reflect.TypeOf(configuration))
-	}
-	return initializerConfiguration, nil
-}
-
-func (im *InitializerConfigurationManager) Run(stopCh <-chan struct{}) {
-	im.poller.Run(stopCh)
-}
-
-func mergeInitializerConfigurations(initializerConfigurationList *v1alpha1.InitializerConfigurationList) *v1alpha1.InitializerConfiguration {
-	configurations := initializerConfigurationList.Items
-	sort.SliceStable(configurations, InitializerConfigurationSorter(configurations).ByName)
-	var ret v1alpha1.InitializerConfiguration
-	for _, c := range configurations {
-		ret.Initializers = append(ret.Initializers, c.Initializers...)
-	}
-	return &ret
-}
-
-type InitializerConfigurationSorter []v1alpha1.InitializerConfiguration
-
-func (a InitializerConfigurationSorter) ByName(i, j int) bool {
-	return a[i].Name < a[j].Name
-}
--- a/vendor/k8s.io/apiserver/pkg/admission/configuration/initializer_manager_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/configuration/initializer_manager_test.go
@@ -1,182 +0,0 @@
-/*
-Copyright 2017 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package configuration
-
-import (
-	"fmt"
-	"reflect"
-	"testing"
-	"time"
-
-	"k8s.io/api/admissionregistration/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-)
-
-type mockLister struct {
-	invoked           int
-	successes         int
-	failures          int
-	configurationList v1alpha1.InitializerConfigurationList
-	t                 *testing.T
-}
-
-func newMockLister(successes, failures int, configurationList v1alpha1.InitializerConfigurationList, t *testing.T) *mockLister {
-	return &mockLister{
-		failures:          failures,
-		successes:         successes,
-		configurationList: configurationList,
-		t:                 t,
-	}
-}
-
-// The first List will be successful; the next m.failures List will
-// fail; the next m.successes List will be successful
-// List should only be called 1+m.failures+m.successes times.
-func (m *mockLister) List(options metav1.ListOptions) (*v1alpha1.InitializerConfigurationList, error) {
-	m.invoked++
-	if m.invoked == 1 {
-		return &m.configurationList, nil
-	}
-	if m.invoked <= 1+m.failures {
-		return nil, fmt.Errorf("some error")
-	}
-	if m.invoked <= 1+m.failures+m.successes {
-		return &m.configurationList, nil
-	}
-	m.t.Fatalf("unexpected call to List, should only be called %d times", 1+m.successes+m.failures)
-	return nil, nil
-}
-
-var _ InitializerConfigurationLister = &mockLister{}
-
-func TestConfiguration(t *testing.T) {
-	cases := []struct {
-		name     string
-		failures int
-		// note that the first call to mockLister is always a success.
-		successes   int
-		expectReady bool
-	}{
-		{
-			name:        "number of failures hasn't reached failureThreshold",
-			failures:    defaultFailureThreshold - 1,
-			expectReady: true,
-		},
-		{
-			name:        "number of failures just reaches failureThreshold",
-			failures:    defaultFailureThreshold,
-			expectReady: false,
-		},
-		{
-			name:        "number of failures exceeds failureThreshold",
-			failures:    defaultFailureThreshold + 1,
-			expectReady: false,
-		},
-		{
-			name:        "number of failures exceeds failureThreshold, but then get another success",
-			failures:    defaultFailureThreshold + 1,
-			successes:   1,
-			expectReady: true,
-		},
-	}
-	for _, c := range cases {
-		mock := newMockLister(c.successes, c.failures, v1alpha1.InitializerConfigurationList{}, t)
-		manager := NewInitializerConfigurationManager(mock)
-		manager.interval = 1 * time.Millisecond
-		for i := 0; i < 1+c.successes+c.failures; i++ {
-			manager.sync()
-		}
-		_, err := manager.Initializers()
-		if err != nil && c.expectReady {
-			t.Errorf("case %s, expect ready, got: %v", c.name, err)
-		}
-		if err == nil && !c.expectReady {
-			t.Errorf("case %s, expect not ready", c.name)
-		}
-	}
-}
-
-func TestMergeInitializerConfigurations(t *testing.T) {
-	configurationsList := v1alpha1.InitializerConfigurationList{
-		Items: []v1alpha1.InitializerConfiguration{
-			{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "provider_2",
-				},
-				Initializers: []v1alpha1.Initializer{
-					{
-						Name: "initializer_a",
-					},
-					{
-						Name: "initializer_b",
-					},
-				},
-			},
-			{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "provider_1",
-				},
-				Initializers: []v1alpha1.Initializer{
-					{
-						Name: "initializer_c",
-					},
-					{
-						Name: "initializer_d",
-					},
-				},
-			},
-		},
-	}
-
-	expected := &v1alpha1.InitializerConfiguration{
-		Initializers: []v1alpha1.Initializer{
-			{
-				Name: "initializer_c",
-			},
-			{
-				Name: "initializer_d",
-			},
-			{
-				Name: "initializer_a",
-			},
-			{
-				Name: "initializer_b",
-			},
-		},
-	}
-
-	got := mergeInitializerConfigurations(&configurationsList)
-	if !reflect.DeepEqual(got, expected) {
-		t.Errorf("expected: %#v, got: %#v", expected, got)
-	}
-}
-
-type disabledInitializerConfigLister struct{}
-
-func (l *disabledInitializerConfigLister) List(options metav1.ListOptions) (*v1alpha1.InitializerConfigurationList, error) {
-	return nil, errors.NewNotFound(schema.GroupResource{Group: "admissionregistration", Resource: "initializerConfigurations"}, "")
-}
-func TestInitializerConfigDisabled(t *testing.T) {
-	manager := NewInitializerConfigurationManager(&disabledInitializerConfigLister{})
-	manager.sync()
-	_, err := manager.Initializers()
-	if err.Error() != ErrDisabled.Error() {
-		t.Errorf("expected %v, got %v", ErrDisabled, err)
-	}
-}
--- a/vendor/k8s.io/apiserver/pkg/admission/configuration/mutating_webhook_manager.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/configuration/mutating_webhook_manager.go
@@ -18,84 +18,89 @@ package configuration

 import (
 	"fmt"
-	"reflect"
 	"sort"
-
-	"github.com/golang/glog"
+	"sync/atomic"

 	"k8s.io/api/admissionregistration/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/labels"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook/generic"
+	"k8s.io/client-go/informers"
+	admissionregistrationlisters "k8s.io/client-go/listers/admissionregistration/v1beta1"
+	"k8s.io/client-go/tools/cache"
 )

-type MutatingWebhookConfigurationLister interface {
-	List(opts metav1.ListOptions) (*v1beta1.MutatingWebhookConfigurationList, error)
+// mutatingWebhookConfigurationManager collects the mutating webhook objects so that they can be called.
+type mutatingWebhookConfigurationManager struct {
+	configuration *atomic.Value
+	lister        admissionregistrationlisters.MutatingWebhookConfigurationLister
+	hasSynced     func() bool
 }

-// MutatingWebhookConfigurationManager collects the mutating webhook objects so that they can be called.
-type MutatingWebhookConfigurationManager struct {
-	*poller
-}
+var _ generic.Source = &mutatingWebhookConfigurationManager{}

-func NewMutatingWebhookConfigurationManager(c MutatingWebhookConfigurationLister) *MutatingWebhookConfigurationManager {
-	getFn := func() (runtime.Object, error) {
-		list, err := c.List(metav1.ListOptions{})
-		if err != nil {
-			if errors.IsNotFound(err) || errors.IsForbidden(err) {
-				glog.V(5).Infof("MutatingWebhookConfiguration are disabled due to an error: %v", err)
-				return nil, ErrDisabled
-			}
-			return nil, err
-		}
-		return mergeMutatingWebhookConfigurations(list), nil
+func NewMutatingWebhookConfigurationManager(f informers.SharedInformerFactory) generic.Source {
+	informer := f.Admissionregistration().V1beta1().MutatingWebhookConfigurations()
+	manager := &mutatingWebhookConfigurationManager{
+		configuration: &atomic.Value{},
+		lister:        informer.Lister(),
+		hasSynced:     informer.Informer().HasSynced,
 	}

-	return &MutatingWebhookConfigurationManager{
-		newPoller(getFn),
-	}
+	// Start with an empty list
+	manager.configuration.Store([]webhook.WebhookAccessor{})
+
+	// On any change, rebuild the config
+	informer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc:    func(_ interface{}) { manager.updateConfiguration() },
+		UpdateFunc: func(_, _ interface{}) { manager.updateConfiguration() },
+		DeleteFunc: func(_ interface{}) { manager.updateConfiguration() },
+	})
+
+	return manager
 }

 // Webhooks returns the merged MutatingWebhookConfiguration.
-func (im *MutatingWebhookConfigurationManager) Webhooks() (*v1beta1.MutatingWebhookConfiguration, error) {
-	configuration, err := im.poller.configuration()
+func (m *mutatingWebhookConfigurationManager) Webhooks() []webhook.WebhookAccessor {
+	return m.configuration.Load().([]webhook.WebhookAccessor)
+}
+
+func (m *mutatingWebhookConfigurationManager) HasSynced() bool {
+	return m.hasSynced()
+}
+
+func (m *mutatingWebhookConfigurationManager) updateConfiguration() {
+	configurations, err := m.lister.List(labels.Everything())
 	if err != nil {
-		return nil, err
+		utilruntime.HandleError(fmt.Errorf("error updating configuration: %v", err))
+		return
 	}
-	mutatingWebhookConfiguration, ok := configuration.(*v1beta1.MutatingWebhookConfiguration)
-	if !ok {
-		return nil, fmt.Errorf("expected type %v, got type %v", reflect.TypeOf(mutatingWebhookConfiguration), reflect.TypeOf(configuration))
-	}
-	return mutatingWebhookConfiguration, nil
+	m.configuration.Store(mergeMutatingWebhookConfigurations(configurations))
 }

-func (im *MutatingWebhookConfigurationManager) Run(stopCh <-chan struct{}) {
-	im.poller.Run(stopCh)
-}
-
-func mergeMutatingWebhookConfigurations(
-	list *v1beta1.MutatingWebhookConfigurationList,
-) *v1beta1.MutatingWebhookConfiguration {
-	configurations := append([]v1beta1.MutatingWebhookConfiguration{}, list.Items...)
-	var ret v1beta1.MutatingWebhookConfiguration
+func mergeMutatingWebhookConfigurations(configurations []*v1beta1.MutatingWebhookConfiguration) []webhook.WebhookAccessor {
 	// The internal order of webhooks for each configuration is provided by the user
 	// but configurations themselves can be in any order. As we are going to run these
 	// webhooks in serial, they are sorted here to have a deterministic order.
-	sort.Sort(byName(configurations))
+	sort.SliceStable(configurations, MutatingWebhookConfigurationSorter(configurations).ByName)
+	accessors := []webhook.WebhookAccessor{}
 	for _, c := range configurations {
-		ret.Webhooks = append(ret.Webhooks, c.Webhooks...)
+		// webhook names are not validated for uniqueness, so we check for duplicates and
+		// add a int suffix to distinguish between them
+		names := map[string]int{}
+		for i := range c.Webhooks {
+			n := c.Webhooks[i].Name
+			uid := fmt.Sprintf("%s/%s/%d", c.Name, n, names[n])
+			names[n]++
+			accessors = append(accessors, webhook.NewMutatingWebhookAccessor(uid, c.Name, &c.Webhooks[i]))
+		}
 	}
-	return &ret
+	return accessors
 }

-// byName sorts MutatingWebhookConfiguration by name. These objects are all in
-// cluster namespace (aka no namespace) thus they all have unique names.
-type byName []v1beta1.MutatingWebhookConfiguration
+type MutatingWebhookConfigurationSorter []*v1beta1.MutatingWebhookConfiguration

-func (x byName) Len() int { return len(x) }
-
-func (x byName) Swap(i, j int) { x[i], x[j] = x[j], x[i] }
-
-func (x byName) Less(i, j int) bool {
-	return x[i].ObjectMeta.Name < x[j].ObjectMeta.Name
+func (a MutatingWebhookConfigurationSorter) ByName(i, j int) bool {
+	return a[i].Name < a[j].Name
 }
--- a/vendor/k8s.io/apiserver/pkg/admission/configuration/mutating_webhook_manager_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/configuration/mutating_webhook_manager_test.go
@@ -17,24 +17,54 @@ limitations under the License.
 package configuration

 import (
+	"reflect"
 	"testing"

 	"k8s.io/api/admissionregistration/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/informers"
+	"k8s.io/client-go/kubernetes/fake"
 )

-type disabledMutatingWebhookConfigLister struct{}
+func TestGetMutatingWebhookConfig(t *testing.T) {
+	// Build a test client that the admission plugin can use to look up the MutatingWebhookConfiguration
+	client := fake.NewSimpleClientset()
+	informerFactory := informers.NewSharedInformerFactory(client, 0)
+	stop := make(chan struct{})
+	defer close(stop)
+	informerFactory.Start(stop)
+	informerFactory.WaitForCacheSync(stop)

-func (l *disabledMutatingWebhookConfigLister) List(options metav1.ListOptions) (*v1beta1.MutatingWebhookConfigurationList, error) {
-	return nil, errors.NewNotFound(schema.GroupResource{Group: "admissionregistration", Resource: "MutatingWebhookConfigurations"}, "")
-}
-func TestMutatingWebhookConfigDisabled(t *testing.T) {
-	manager := NewMutatingWebhookConfigurationManager(&disabledMutatingWebhookConfigLister{})
-	manager.sync()
-	_, err := manager.Webhooks()
-	if err.Error() != ErrDisabled.Error() {
-		t.Errorf("expected %v, got %v", ErrDisabled, err)
+	configManager := NewMutatingWebhookConfigurationManager(informerFactory).(*mutatingWebhookConfigurationManager)
+	configManager.updateConfiguration()
+
+	// no configurations
+	if configurations := configManager.Webhooks(); len(configurations) != 0 {
+		t.Errorf("expected empty webhooks, but got %v", configurations)
+	}
+
+	webhookConfiguration := &v1beta1.MutatingWebhookConfiguration{
+		ObjectMeta: metav1.ObjectMeta{Name: "webhook1"},
+		Webhooks:   []v1beta1.MutatingWebhook{{Name: "webhook1.1"}},
+	}
+
+	mutatingInformer := informerFactory.Admissionregistration().V1beta1().MutatingWebhookConfigurations()
+	mutatingInformer.Informer().GetIndexer().Add(webhookConfiguration)
+	configManager.updateConfiguration()
+
+	// configuration populated
+	configurations := configManager.Webhooks()
+	if len(configurations) == 0 {
+		t.Errorf("expected non empty webhooks")
+	}
+	for i := range configurations {
+		h, ok := configurations[i].GetMutatingWebhook()
+		if !ok {
+			t.Errorf("Expected mutating webhook")
+			continue
+		}
+		if !reflect.DeepEqual(h, &webhookConfiguration.Webhooks[i]) {
+			t.Errorf("Expected\n%#v\ngot\n%#v", &webhookConfiguration.Webhooks[i], h)
+		}
 	}
 }
--- a/vendor/k8s.io/apiserver/pkg/admission/configuration/validating_webhook_manager.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/configuration/validating_webhook_manager.go
@@ -18,67 +18,87 @@ package configuration

 import (
 	"fmt"
-	"reflect"
-
-	"github.com/golang/glog"
+	"sort"
+	"sync/atomic"

 	"k8s.io/api/admissionregistration/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/labels"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook/generic"
+	"k8s.io/client-go/informers"
+	admissionregistrationlisters "k8s.io/client-go/listers/admissionregistration/v1beta1"
+	"k8s.io/client-go/tools/cache"
 )

-type ValidatingWebhookConfigurationLister interface {
-	List(opts metav1.ListOptions) (*v1beta1.ValidatingWebhookConfigurationList, error)
+// validatingWebhookConfigurationManager collects the validating webhook objects so that they can be called.
+type validatingWebhookConfigurationManager struct {
+	configuration *atomic.Value
+	lister        admissionregistrationlisters.ValidatingWebhookConfigurationLister
+	hasSynced     func() bool
 }

-// ValidatingWebhookConfigurationManager collects the validating webhook objects so that they can be called.
-type ValidatingWebhookConfigurationManager struct {
-	*poller
-}
+var _ generic.Source = &validatingWebhookConfigurationManager{}

-func NewValidatingWebhookConfigurationManager(c ValidatingWebhookConfigurationLister) *ValidatingWebhookConfigurationManager {
-	getFn := func() (runtime.Object, error) {
-		list, err := c.List(metav1.ListOptions{})
-		if err != nil {
-			if errors.IsNotFound(err) || errors.IsForbidden(err) {
-				glog.V(5).Infof("ValidatingWebhookConfiguration are disabled due to an error: %v", err)
-				return nil, ErrDisabled
-			}
-			return nil, err
-		}
-		return mergeValidatingWebhookConfigurations(list), nil
+func NewValidatingWebhookConfigurationManager(f informers.SharedInformerFactory) generic.Source {
+	informer := f.Admissionregistration().V1beta1().ValidatingWebhookConfigurations()
+	manager := &validatingWebhookConfigurationManager{
+		configuration: &atomic.Value{},
+		lister:        informer.Lister(),
+		hasSynced:     informer.Informer().HasSynced,
 	}

-	return &ValidatingWebhookConfigurationManager{
-		newPoller(getFn),
-	}
+	// Start with an empty list
+	manager.configuration.Store([]webhook.WebhookAccessor{})
+
+	// On any change, rebuild the config
+	informer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc:    func(_ interface{}) { manager.updateConfiguration() },
+		UpdateFunc: func(_, _ interface{}) { manager.updateConfiguration() },
+		DeleteFunc: func(_ interface{}) { manager.updateConfiguration() },
+	})
+
+	return manager
 }

 // Webhooks returns the merged ValidatingWebhookConfiguration.
-func (im *ValidatingWebhookConfigurationManager) Webhooks() (*v1beta1.ValidatingWebhookConfiguration, error) {
-	configuration, err := im.poller.configuration()
+func (v *validatingWebhookConfigurationManager) Webhooks() []webhook.WebhookAccessor {
+	return v.configuration.Load().([]webhook.WebhookAccessor)
+}
+
+// HasSynced returns true if the shared informers have synced.
+func (v *validatingWebhookConfigurationManager) HasSynced() bool {
+	return v.hasSynced()
+}
+
+func (v *validatingWebhookConfigurationManager) updateConfiguration() {
+	configurations, err := v.lister.List(labels.Everything())
 	if err != nil {
-		return nil, err
+		utilruntime.HandleError(fmt.Errorf("error updating configuration: %v", err))
+		return
 	}
-	validatingWebhookConfiguration, ok := configuration.(*v1beta1.ValidatingWebhookConfiguration)
-	if !ok {
-		return nil, fmt.Errorf("expected type %v, got type %v", reflect.TypeOf(validatingWebhookConfiguration), reflect.TypeOf(configuration))
-	}
-	return validatingWebhookConfiguration, nil
+	v.configuration.Store(mergeValidatingWebhookConfigurations(configurations))
 }

-func (im *ValidatingWebhookConfigurationManager) Run(stopCh <-chan struct{}) {
-	im.poller.Run(stopCh)
-}
-
-func mergeValidatingWebhookConfigurations(
-	list *v1beta1.ValidatingWebhookConfigurationList,
-) *v1beta1.ValidatingWebhookConfiguration {
-	configurations := list.Items
-	var ret v1beta1.ValidatingWebhookConfiguration
+func mergeValidatingWebhookConfigurations(configurations []*v1beta1.ValidatingWebhookConfiguration) []webhook.WebhookAccessor {
+	sort.SliceStable(configurations, ValidatingWebhookConfigurationSorter(configurations).ByName)
+	accessors := []webhook.WebhookAccessor{}
 	for _, c := range configurations {
-		ret.Webhooks = append(ret.Webhooks, c.Webhooks...)
+		// webhook names are not validated for uniqueness, so we check for duplicates and
+		// add a int suffix to distinguish between them
+		names := map[string]int{}
+		for i := range c.Webhooks {
+			n := c.Webhooks[i].Name
+			uid := fmt.Sprintf("%s/%s/%d", c.Name, n, names[n])
+			names[n]++
+			accessors = append(accessors, webhook.NewValidatingWebhookAccessor(uid, c.Name, &c.Webhooks[i]))
+		}
 	}
-	return &ret
+	return accessors
+}
+
+type ValidatingWebhookConfigurationSorter []*v1beta1.ValidatingWebhookConfiguration
+
+func (a ValidatingWebhookConfigurationSorter) ByName(i, j int) bool {
+	return a[i].Name < a[j].Name
 }
--- a/vendor/k8s.io/apiserver/pkg/admission/configuration/validating_webhook_manager_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/configuration/validating_webhook_manager_test.go
@@ -17,24 +17,56 @@ limitations under the License.
 package configuration

 import (
+	"reflect"
 	"testing"

 	"k8s.io/api/admissionregistration/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/informers"
+	"k8s.io/client-go/kubernetes/fake"
 )

-type disabledValidatingWebhookConfigLister struct{}
+func TestGetValidatingWebhookConfig(t *testing.T) {
+	// Build a test client that the admission plugin can use to look up the ValidatingWebhookConfiguration
+	client := fake.NewSimpleClientset()
+	informerFactory := informers.NewSharedInformerFactory(client, 0)
+	stop := make(chan struct{})
+	defer close(stop)
+	informerFactory.Start(stop)
+	informerFactory.WaitForCacheSync(stop)

-func (l *disabledValidatingWebhookConfigLister) List(options metav1.ListOptions) (*v1beta1.ValidatingWebhookConfigurationList, error) {
-	return nil, errors.NewNotFound(schema.GroupResource{Group: "admissionregistration", Resource: "ValidatingWebhookConfigurations"}, "")
-}
-func TestWebhookConfigDisabled(t *testing.T) {
-	manager := NewValidatingWebhookConfigurationManager(&disabledValidatingWebhookConfigLister{})
-	manager.sync()
-	_, err := manager.Webhooks()
-	if err.Error() != ErrDisabled.Error() {
-		t.Errorf("expected %v, got %v", ErrDisabled, err)
+	manager := NewValidatingWebhookConfigurationManager(informerFactory)
+	if validatingConfig, ok := manager.(*validatingWebhookConfigurationManager); ok {
+		validatingConfig.updateConfiguration()
+	}
+	// no configurations
+	if configurations := manager.Webhooks(); len(configurations) != 0 {
+		t.Errorf("expected empty webhooks, but got %v", configurations)
+	}
+
+	webhookConfiguration := &v1beta1.ValidatingWebhookConfiguration{
+		ObjectMeta: metav1.ObjectMeta{Name: "webhook1"},
+		Webhooks:   []v1beta1.ValidatingWebhook{{Name: "webhook1.1"}},
+	}
+
+	validatingInformer := informerFactory.Admissionregistration().V1beta1().ValidatingWebhookConfigurations()
+	validatingInformer.Informer().GetIndexer().Add(webhookConfiguration)
+	if validatingConfig, ok := manager.(*validatingWebhookConfigurationManager); ok {
+		validatingConfig.updateConfiguration()
+	}
+	// configuration populated
+	configurations := manager.Webhooks()
+	if len(configurations) == 0 {
+		t.Errorf("expected non empty webhooks")
+	}
+	for i := range configurations {
+		h, ok := configurations[i].GetValidatingWebhook()
+		if !ok {
+			t.Errorf("Expected validating webhook")
+			continue
+		}
+		if !reflect.DeepEqual(h, &webhookConfiguration.Webhooks[i]) {
+			t.Errorf("Expected\n%#v\ngot\n%#v", &webhookConfiguration.Webhooks[i], h)
+		}
 	}
 }
--- a/vendor/k8s.io/apiserver/pkg/admission/decorator.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/decorator.go
@@ -0,0 +1,39 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package admission
+
+type Decorator interface {
+	Decorate(handler Interface, name string) Interface
+}
+
+type DecoratorFunc func(handler Interface, name string) Interface
+
+func (d DecoratorFunc) Decorate(handler Interface, name string) Interface {
+	return d(handler, name)
+}
+
+type Decorators []Decorator
+
+// Decorate applies the decorator in inside-out order, i.e. the first decorator in the slice is first applied to the given handler.
+func (d Decorators) Decorate(handler Interface, name string) Interface {
+	result := handler
+	for _, d := range d {
+		result = d.Decorate(result, name)
+	}
+
+	return result
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/errors_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/errors_test.go
@@ -36,6 +36,8 @@ func TestNewForbidden(t *testing.T) {
 		schema.GroupVersionResource{Group: "foo", Version: "bar", Resource: "baz"},
 		"",
 		Create,
+		nil,
+		false,
 		nil)
 	err := errors.New("some error")
 	expectedErr := `baz.foo "Unknown/errorGettingName" is forbidden: some error`
--- a/vendor/k8s.io/apiserver/pkg/admission/initializer/BUILD
+++ b/vendor/k8s.io/apiserver/pkg/admission/initializer/BUILD
@@ -1,51 +0,0 @@
-package(default_visibility = ["//visibility:public"])
-
-load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_library",
-    "go_test",
-)
-
-go_library(
-    name = "go_default_library",
-    srcs = [
-        "initializer.go",
-        "interfaces.go",
-    ],
-    importpath = "k8s.io/apiserver/pkg/admission/initializer",
-    deps = [
-        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/authorization/authorizer:go_default_library",
-        "//vendor/k8s.io/client-go/informers:go_default_library",
-        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
-    ],
-)
-
-go_test(
-    name = "go_default_xtest",
-    srcs = ["initializer_test.go"],
-    importpath = "k8s.io/apiserver/pkg/admission/initializer_test",
-    deps = [
-        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/initializer:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/authorization/authorizer:go_default_library",
-        "//vendor/k8s.io/client-go/informers:go_default_library",
-        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
-        "//vendor/k8s.io/client-go/kubernetes/fake:go_default_library",
-    ],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-)
--- a/vendor/k8s.io/apiserver/pkg/admission/initializer/initializer.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/initializer/initializer.go
@@ -17,7 +17,6 @@ limitations under the License.
 package initializer

 import (
-	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apiserver/pkg/admission"
 	"k8s.io/apiserver/pkg/authorization/authorizer"
 	"k8s.io/client-go/informers"
@@ -28,7 +27,6 @@ type pluginInitializer struct {
 	externalClient    kubernetes.Interface
 	externalInformers informers.SharedInformerFactory
 	authorizer        authorizer.Authorizer
-	scheme            *runtime.Scheme
 }

 // New creates an instance of admission plugins initializer.
@@ -37,13 +35,11 @@ func New(
 	extClientset kubernetes.Interface,
 	extInformers informers.SharedInformerFactory,
 	authz authorizer.Authorizer,
-	scheme *runtime.Scheme,
 ) pluginInitializer {
 	return pluginInitializer{
 		externalClient:    extClientset,
 		externalInformers: extInformers,
 		authorizer:        authz,
-		scheme:            scheme,
 	}
 }

@@ -61,10 +57,6 @@ func (i pluginInitializer) Initialize(plugin admission.Interface) {
 	if wants, ok := plugin.(WantsAuthorizer); ok {
 		wants.SetAuthorizer(i.authorizer)
 	}
-
-	if wants, ok := plugin.(WantsScheme); ok {
-		wants.SetScheme(i.scheme)
-	}
 }

 var _ admission.PluginInitializer = pluginInitializer{}
--- a/vendor/k8s.io/apiserver/pkg/admission/initializer/initializer_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/initializer/initializer_test.go
@@ -17,10 +17,10 @@ limitations under the License.
 package initializer_test

 import (
+	"context"
 	"testing"
 	"time"

-	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apiserver/pkg/admission"
 	"k8s.io/apiserver/pkg/admission/initializer"
 	"k8s.io/apiserver/pkg/authorization/authorizer"
@@ -29,22 +29,10 @@ import (
 	"k8s.io/client-go/kubernetes/fake"
 )

-// TestWantsScheme ensures that the scheme is injected when
-// the WantsScheme interface is implemented by a plugin.
-func TestWantsScheme(t *testing.T) {
-	scheme := runtime.NewScheme()
-	target := initializer.New(nil, nil, nil, scheme)
-	wantSchemeAdmission := &WantSchemeAdmission{}
-	target.Initialize(wantSchemeAdmission)
-	if wantSchemeAdmission.scheme != scheme {
-		t.Errorf("expected scheme to be initialized")
-	}
-}
-
 // TestWantsAuthorizer ensures that the authorizer is injected
 // when the WantsAuthorizer interface is implemented by a plugin.
 func TestWantsAuthorizer(t *testing.T) {
-	target := initializer.New(nil, nil, &TestAuthorizer{}, nil)
+	target := initializer.New(nil, nil, &TestAuthorizer{})
 	wantAuthorizerAdmission := &WantAuthorizerAdmission{}
 	target.Initialize(wantAuthorizerAdmission)
 	if wantAuthorizerAdmission.auth == nil {
@@ -52,11 +40,11 @@ func TestWantsAuthorizer(t *testing.T) {
 	}
 }

-// TestWantsExternalKubeClientSet ensures that the clienset is injected
+// TestWantsExternalKubeClientSet ensures that the clientset is injected
 // when the WantsExternalKubeClientSet interface is implemented by a plugin.
 func TestWantsExternalKubeClientSet(t *testing.T) {
 	cs := &fake.Clientset{}
-	target := initializer.New(cs, nil, &TestAuthorizer{}, nil)
+	target := initializer.New(cs, nil, &TestAuthorizer{})
 	wantExternalKubeClientSet := &WantExternalKubeClientSet{}
 	target.Initialize(wantExternalKubeClientSet)
 	if wantExternalKubeClientSet.cs != cs {
@@ -69,7 +57,7 @@ func TestWantsExternalKubeClientSet(t *testing.T) {
 func TestWantsExternalKubeInformerFactory(t *testing.T) {
 	cs := &fake.Clientset{}
 	sf := informers.NewSharedInformerFactory(cs, time.Duration(1)*time.Second)
-	target := initializer.New(cs, sf, &TestAuthorizer{}, nil)
+	target := initializer.New(cs, sf, &TestAuthorizer{})
 	wantExternalKubeInformerFactory := &WantExternalKubeInformerFactory{}
 	target.Initialize(wantExternalKubeInformerFactory)
 	if wantExternalKubeInformerFactory.sf != sf {
@@ -85,7 +73,9 @@ type WantExternalKubeInformerFactory struct {
 func (self *WantExternalKubeInformerFactory) SetExternalKubeInformerFactory(sf informers.SharedInformerFactory) {
 	self.sf = sf
 }
-func (self *WantExternalKubeInformerFactory) Admit(a admission.Attributes) error { return nil }
+func (self *WantExternalKubeInformerFactory) Admit(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) error {
+	return nil
+}
 func (self *WantExternalKubeInformerFactory) Handles(o admission.Operation) bool { return false }
 func (self *WantExternalKubeInformerFactory) ValidateInitialization() error      { return nil }

@@ -98,9 +88,11 @@ type WantExternalKubeClientSet struct {
 }

 func (self *WantExternalKubeClientSet) SetExternalKubeClientSet(cs kubernetes.Interface) { self.cs = cs }
-func (self *WantExternalKubeClientSet) Admit(a admission.Attributes) error               { return nil }
-func (self *WantExternalKubeClientSet) Handles(o admission.Operation) bool               { return false }
-func (self *WantExternalKubeClientSet) ValidateInitialization() error                    { return nil }
+func (self *WantExternalKubeClientSet) Admit(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) error {
+	return nil
+}
+func (self *WantExternalKubeClientSet) Handles(o admission.Operation) bool { return false }
+func (self *WantExternalKubeClientSet) ValidateInitialization() error      { return nil }

 var _ admission.Interface = &WantExternalKubeClientSet{}
 var _ initializer.WantsExternalKubeClientSet = &WantExternalKubeClientSet{}
@@ -111,9 +103,11 @@ type WantAuthorizerAdmission struct {
 }

 func (self *WantAuthorizerAdmission) SetAuthorizer(a authorizer.Authorizer) { self.auth = a }
-func (self *WantAuthorizerAdmission) Admit(a admission.Attributes) error    { return nil }
-func (self *WantAuthorizerAdmission) Handles(o admission.Operation) bool    { return false }
-func (self *WantAuthorizerAdmission) ValidateInitialization() error         { return nil }
+func (self *WantAuthorizerAdmission) Admit(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) error {
+	return nil
+}
+func (self *WantAuthorizerAdmission) Handles(o admission.Operation) bool { return false }
+func (self *WantAuthorizerAdmission) ValidateInitialization() error      { return nil }

 var _ admission.Interface = &WantAuthorizerAdmission{}
 var _ initializer.WantsAuthorizer = &WantAuthorizerAdmission{}
@@ -130,20 +124,9 @@ type clientCertWanter struct {
 	gotCert, gotKey []byte
 }

-func (s *clientCertWanter) SetClientCert(cert, key []byte)     { s.gotCert, s.gotKey = cert, key }
-func (s *clientCertWanter) Admit(a admission.Attributes) error { return nil }
+func (s *clientCertWanter) SetClientCert(cert, key []byte) { s.gotCert, s.gotKey = cert, key }
+func (s *clientCertWanter) Admit(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) error {
+	return nil
+}
 func (s *clientCertWanter) Handles(o admission.Operation) bool { return false }
 func (s *clientCertWanter) ValidateInitialization() error      { return nil }
-
-// WantSchemeAdmission is a test stub that fulfills the WantsScheme interface.
-type WantSchemeAdmission struct {
-	scheme *runtime.Scheme
-}
-
-func (self *WantSchemeAdmission) SetScheme(s *runtime.Scheme)        { self.scheme = s }
-func (self *WantSchemeAdmission) Admit(a admission.Attributes) error { return nil }
-func (self *WantSchemeAdmission) Handles(o admission.Operation) bool { return false }
-func (self *WantSchemeAdmission) ValidateInitialization() error      { return nil }
-
-var _ admission.Interface = &WantSchemeAdmission{}
-var _ initializer.WantsScheme = &WantSchemeAdmission{}
--- a/vendor/k8s.io/apiserver/pkg/admission/initializer/interfaces.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/initializer/interfaces.go
@@ -17,7 +17,6 @@ limitations under the License.
 package initializer

 import (
-	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apiserver/pkg/admission"
 	"k8s.io/apiserver/pkg/authorization/authorizer"
 	"k8s.io/client-go/informers"
@@ -41,9 +40,3 @@ type WantsAuthorizer interface {
 	SetAuthorizer(authorizer.Authorizer)
 	admission.InitializationValidator
 }
-
-// WantsScheme defines a function that accepts runtime.Scheme for admission plugins that need it.
-type WantsScheme interface {
-	SetScheme(*runtime.Scheme)
-	admission.InitializationValidator
-}
--- a/vendor/k8s.io/apiserver/pkg/admission/interfaces.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/interfaces.go
@@ -17,10 +17,12 @@ limitations under the License.
 package admission

 import (
+	"context"
 	"io"

 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	auditinternal "k8s.io/apiserver/pkg/apis/audit"
 	"k8s.io/apiserver/pkg/authentication/user"
 )

@@ -41,6 +43,13 @@ type Attributes interface {
 	GetSubresource() string
 	// GetOperation is the operation being performed
 	GetOperation() Operation
+	// GetOperationOptions is the options for the operation being performed
+	GetOperationOptions() runtime.Object
+	// IsDryRun indicates that modifications will definitely not be persisted for this request. This is to prevent
+	// admission controllers with side effects and a method of reconciliation from being overwhelmed.
+	// However, a value of false for this does not mean that the modification will be persisted, because it
+	// could still be rejected by a subsequent validation step.
+	IsDryRun() bool
 	// GetObject is the object from the incoming request prior to default values being applied
 	GetObject() runtime.Object
 	// GetOldObject is the existing object. Only populated for UPDATE requests.
@@ -49,6 +58,65 @@ type Attributes interface {
 	GetKind() schema.GroupVersionKind
 	// GetUserInfo is information about the requesting user
 	GetUserInfo() user.Info
+
+	// AddAnnotation sets annotation according to key-value pair. The key should be qualified, e.g., podsecuritypolicy.admission.k8s.io/admit-policy, where
+	// "podsecuritypolicy" is the name of the plugin, "admission.k8s.io" is the name of the organization, "admit-policy" is the key name.
+	// An error is returned if the format of key is invalid. When trying to overwrite annotation with a new value, an error is returned.
+	// Both ValidationInterface and MutationInterface are allowed to add Annotations.
+	// By default, an annotation gets logged into audit event if the request's audit level is greater or
+	// equal to Metadata.
+	AddAnnotation(key, value string) error
+
+	// AddAnnotationWithLevel sets annotation according to key-value pair with additional intended audit level.
+	// An Annotation gets logged into audit event if the request's audit level is greater or equal to the
+	// intended audit level.
+	AddAnnotationWithLevel(key, value string, level auditinternal.Level) error
+
+	// GetReinvocationContext tracks the admission request information relevant to the re-invocation policy.
+	GetReinvocationContext() ReinvocationContext
+}
+
+// ObjectInterfaces is an interface used by AdmissionController to get object interfaces
+// such as Converter or Defaulter. These interfaces are normally coming from Request Scope
+// to handle special cases like CRDs.
+type ObjectInterfaces interface {
+	// GetObjectCreater is the ObjectCreator appropriate for the requested object.
+	GetObjectCreater() runtime.ObjectCreater
+	// GetObjectTyper is the ObjectTyper appropriate for the requested object.
+	GetObjectTyper() runtime.ObjectTyper
+	// GetObjectDefaulter is the ObjectDefaulter appropriate for the requested object.
+	GetObjectDefaulter() runtime.ObjectDefaulter
+	// GetObjectConvertor is the ObjectConvertor appropriate for the requested object.
+	GetObjectConvertor() runtime.ObjectConvertor
+	// GetEquivalentResourceMapper is the EquivalentResourceMapper appropriate for finding equivalent resources and expected kind for the requested object.
+	GetEquivalentResourceMapper() runtime.EquivalentResourceMapper
+}
+
+// privateAnnotationsGetter is a private interface which allows users to get annotations from Attributes.
+type privateAnnotationsGetter interface {
+	getAnnotations(maxLevel auditinternal.Level) map[string]string
+}
+
+// AnnotationsGetter allows users to get annotations from Attributes. An alternate Attribute should implement
+// this interface.
+type AnnotationsGetter interface {
+	GetAnnotations(maxLevel auditinternal.Level) map[string]string
+}
+
+// ReinvocationContext provides access to the admission related state required to implement the re-invocation policy.
+type ReinvocationContext interface {
+	// IsReinvoke returns true if the current admission check is a re-invocation.
+	IsReinvoke() bool
+	// SetIsReinvoke sets the current admission check as a re-invocation.
+	SetIsReinvoke()
+	// ShouldReinvoke returns true if any plugin has requested a re-invocation.
+	ShouldReinvoke() bool
+	// SetShouldReinvoke signals that a re-invocation is desired.
+	SetShouldReinvoke()
+	// AddValue set a value for a plugin name, possibly overriding a previous value.
+	SetValue(plugin string, v interface{})
+	// Value reads a value for a webhook.
+	Value(plugin string) interface{}
 }

 // Interface is an abstract, pluggable interface for Admission Control decisions.
@@ -61,8 +129,9 @@ type Interface interface {
 type MutationInterface interface {
 	Interface

-	// Admit makes an admission decision based on the request attributes
-	Admit(a Attributes) (err error)
+	// Admit makes an admission decision based on the request attributes.
+	// Context is used only for timeout/deadline/cancellation and tracing information.
+	Admit(ctx context.Context, a Attributes, o ObjectInterfaces) (err error)
 }

 // ValidationInterface is an abstract, pluggable interface for Admission Control decisions.
@@ -70,7 +139,8 @@ type ValidationInterface interface {
 	Interface

 	// Validate makes an admission decision based on the request attributes.  It is NOT allowed to mutate
-	Validate(a Attributes) (err error)
+	// Context is used only for timeout/deadline/cancellation and tracing information.
+	Validate(ctx context.Context, a Attributes, o ObjectInterfaces) (err error)
 }

 // Operation is the type of resource operation being checked for admission control
--- a/vendor/k8s.io/apiserver/pkg/admission/metrics/BUILD
+++ b/vendor/k8s.io/apiserver/pkg/admission/metrics/BUILD
@@ -1,42 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-
-go_library(
-    name = "go_default_library",
-    srcs = ["metrics.go"],
-    importpath = "k8s.io/apiserver/pkg/admission/metrics",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//vendor/github.com/prometheus/client_golang/prometheus:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
-    ],
-)
-
-go_test(
-    name = "go_default_test",
-    srcs = [
-        "metrics_test.go",
-        "testutil_test.go",
-    ],
-    importpath = "k8s.io/apiserver/pkg/admission/metrics",
-    library = ":go_default_library",
-    deps = [
-        "//vendor/github.com/prometheus/client_golang/prometheus:go_default_library",
-        "//vendor/github.com/prometheus/client_model/go:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
-    ],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-    visibility = ["//visibility:public"],
-)
--- a/vendor/k8s.io/apiserver/pkg/admission/metrics/metrics.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/metrics/metrics.go
@@ -17,23 +17,36 @@ limitations under the License.
 package metrics

 import (
+	"context"
 	"fmt"
 	"strconv"
 	"time"

-	"github.com/prometheus/client_golang/prometheus"
-
 	"k8s.io/apiserver/pkg/admission"
+	"k8s.io/component-base/metrics"
+	"k8s.io/component-base/metrics/legacyregistry"
 )

+// WebhookRejectionErrorType defines different error types that happen in a webhook rejection.
+type WebhookRejectionErrorType string
+
 const (
 	namespace = "apiserver"
 	subsystem = "admission"
+
+	// WebhookRejectionCallingWebhookError identifies a calling webhook error which causes
+	// a webhook admission to reject a request
+	WebhookRejectionCallingWebhookError WebhookRejectionErrorType = "calling_webhook_error"
+	// WebhookRejectionAPIServerInternalError identifies an apiserver internal error which
+	// causes a webhook admission to reject a request
+	WebhookRejectionAPIServerInternalError WebhookRejectionErrorType = "apiserver_internal_error"
+	// WebhookRejectionNoError identifies a webhook properly rejected a request
+	WebhookRejectionNoError WebhookRejectionErrorType = "no_error"
 )

 var (
-	// Use buckets ranging from 25 ms to ~2.5 seconds.
-	latencyBuckets       = prometheus.ExponentialBuckets(25000, 2.5, 5)
+	// Use buckets ranging from 5 ms to 2.5 seconds (admission webhooks timeout at 30 seconds by default).
+	latencyBuckets       = []float64{0.005, 0.025, 0.1, 0.5, 2.5}
 	latencySummaryMaxAge = 5 * time.Hour

 	// Metrics provides access to all admission metrics.
@@ -75,36 +88,37 @@ type pluginHandlerWithMetrics struct {
 }

 // Admit performs a mutating admission control check and emit metrics.
-func (p pluginHandlerWithMetrics) Admit(a admission.Attributes) error {
+func (p pluginHandlerWithMetrics) Admit(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) error {
 	mutatingHandler, ok := p.Interface.(admission.MutationInterface)
 	if !ok {
 		return nil
 	}

 	start := time.Now()
-	err := mutatingHandler.Admit(a)
+	err := mutatingHandler.Admit(ctx, a, o)
 	p.observer(time.Since(start), err != nil, a, stepAdmit, p.extraLabels...)
 	return err
 }

 // Validate performs a non-mutating admission control check and emits metrics.
-func (p pluginHandlerWithMetrics) Validate(a admission.Attributes) error {
+func (p pluginHandlerWithMetrics) Validate(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) error {
 	validatingHandler, ok := p.Interface.(admission.ValidationInterface)
 	if !ok {
 		return nil
 	}

 	start := time.Now()
-	err := validatingHandler.Validate(a)
+	err := validatingHandler.Validate(ctx, a, o)
 	p.observer(time.Since(start), err != nil, a, stepValidate, p.extraLabels...)
 	return err
 }

 // AdmissionMetrics instruments admission with prometheus metrics.
 type AdmissionMetrics struct {
-	step       *metricSet
-	controller *metricSet
-	webhook    *metricSet
+	step             *metricSet
+	controller       *metricSet
+	webhook          *metricSet
+	webhookRejection *metrics.CounterVec
 }

 // newAdmissionMetrics create a new AdmissionMetrics, configured with default metric names.
@@ -112,23 +126,34 @@ func newAdmissionMetrics() *AdmissionMetrics {
 	// Admission metrics for a step of the admission flow. The entire admission flow is broken down into a series of steps
 	// Each step is identified by a distinct type label value.
 	step := newMetricSet("step",
-		[]string{"type", "operation", "group", "version", "resource", "subresource", "rejected"},
+		[]string{"type", "operation", "rejected"},
 		"Admission sub-step %s, broken out for each operation and API resource and step type (validate or admit).", true)

 	// Built-in admission controller metrics. Each admission controller is identified by name.
 	controller := newMetricSet("controller",
-		[]string{"name", "type", "operation", "group", "version", "resource", "subresource", "rejected"},
+		[]string{"name", "type", "operation", "rejected"},
 		"Admission controller %s, identified by name and broken out for each operation and API resource and type (validate or admit).", false)

 	// Admission webhook metrics. Each webhook is identified by name.
 	webhook := newMetricSet("webhook",
-		[]string{"name", "type", "operation", "group", "version", "resource", "subresource", "rejected"},
+		[]string{"name", "type", "operation", "rejected"},
 		"Admission webhook %s, identified by name and broken out for each operation and API resource and type (validate or admit).", false)

+	webhookRejection := metrics.NewCounterVec(
+		&metrics.CounterOpts{
+			Namespace:      namespace,
+			Subsystem:      subsystem,
+			Name:           "webhook_rejection_count",
+			Help:           "Admission webhook rejection count, identified by name and broken out for each admission type (validating or admit) and operation. Additional labels specify an error type (calling_webhook_error or apiserver_internal_error if an error occurred; no_error otherwise) and optionally a non-zero rejection code if the webhook rejects the request with an HTTP status code (honored by the apiserver when the code is greater or equal to 400). Codes greater than 600 are truncated to 600, to keep the metrics cardinality bounded.",
+			StabilityLevel: metrics.ALPHA,
+		},
+		[]string{"name", "type", "operation", "error_type", "rejection_code"})
+
 	step.mustRegister()
 	controller.mustRegister()
 	webhook.mustRegister()
-	return &AdmissionMetrics{step: step, controller: controller, webhook: webhook}
+	legacyregistry.MustRegister(webhookRejection)
+	return &AdmissionMetrics{step: step, controller: controller, webhook: webhook, webhookRejection: webhookRejection}
 }

 func (m *AdmissionMetrics) reset() {
@@ -139,50 +164,59 @@ func (m *AdmissionMetrics) reset() {

 // ObserveAdmissionStep records admission related metrics for a admission step, identified by step type.
 func (m *AdmissionMetrics) ObserveAdmissionStep(elapsed time.Duration, rejected bool, attr admission.Attributes, stepType string, extraLabels ...string) {
-	gvr := attr.GetResource()
-	m.step.observe(elapsed, append(extraLabels, stepType, string(attr.GetOperation()), gvr.Group, gvr.Version, gvr.Resource, attr.GetSubresource(), strconv.FormatBool(rejected))...)
+	m.step.observe(elapsed, append(extraLabels, stepType, string(attr.GetOperation()), strconv.FormatBool(rejected))...)
 }

 // ObserveAdmissionController records admission related metrics for a built-in admission controller, identified by it's plugin handler name.
 func (m *AdmissionMetrics) ObserveAdmissionController(elapsed time.Duration, rejected bool, attr admission.Attributes, stepType string, extraLabels ...string) {
-	gvr := attr.GetResource()
-	m.controller.observe(elapsed, append(extraLabels, stepType, string(attr.GetOperation()), gvr.Group, gvr.Version, gvr.Resource, attr.GetSubresource(), strconv.FormatBool(rejected))...)
+	m.controller.observe(elapsed, append(extraLabels, stepType, string(attr.GetOperation()), strconv.FormatBool(rejected))...)
 }

 // ObserveWebhook records admission related metrics for a admission webhook.
 func (m *AdmissionMetrics) ObserveWebhook(elapsed time.Duration, rejected bool, attr admission.Attributes, stepType string, extraLabels ...string) {
-	gvr := attr.GetResource()
-	m.webhook.observe(elapsed, append(extraLabels, stepType, string(attr.GetOperation()), gvr.Group, gvr.Version, gvr.Resource, attr.GetSubresource(), strconv.FormatBool(rejected))...)
+	m.webhook.observe(elapsed, append(extraLabels, stepType, string(attr.GetOperation()), strconv.FormatBool(rejected))...)
+}
+
+// ObserveWebhookRejection records admission related metrics for an admission webhook rejection.
+func (m *AdmissionMetrics) ObserveWebhookRejection(name, stepType, operation string, errorType WebhookRejectionErrorType, rejectionCode int) {
+	// We truncate codes greater than 600 to keep the cardinality bounded.
+	// This should be rarely done by a malfunctioning webhook server.
+	if rejectionCode > 600 {
+		rejectionCode = 600
+	}
+	m.webhookRejection.WithLabelValues(name, stepType, operation, string(errorType), strconv.Itoa(rejectionCode)).Inc()
 }

 type metricSet struct {
-	latencies        *prometheus.HistogramVec
-	latenciesSummary *prometheus.SummaryVec
+	latencies        *metrics.HistogramVec
+	latenciesSummary *metrics.SummaryVec
 }

 func newMetricSet(name string, labels []string, helpTemplate string, hasSummary bool) *metricSet {
-	var summary *prometheus.SummaryVec
+	var summary *metrics.SummaryVec
 	if hasSummary {
-		summary = prometheus.NewSummaryVec(
-			prometheus.SummaryOpts{
-				Namespace: namespace,
-				Subsystem: subsystem,
-				Name:      fmt.Sprintf("%s_admission_latencies_seconds_summary", name),
-				Help:      fmt.Sprintf(helpTemplate, "latency summary"),
-				MaxAge:    latencySummaryMaxAge,
+		summary = metrics.NewSummaryVec(
+			&metrics.SummaryOpts{
+				Namespace:      namespace,
+				Subsystem:      subsystem,
+				Name:           fmt.Sprintf("%s_admission_duration_seconds_summary", name),
+				Help:           fmt.Sprintf(helpTemplate, "latency summary in seconds"),
+				MaxAge:         latencySummaryMaxAge,
+				StabilityLevel: metrics.ALPHA,
 			},
 			labels,
 		)
 	}

 	return &metricSet{
-		latencies: prometheus.NewHistogramVec(
-			prometheus.HistogramOpts{
-				Namespace: namespace,
-				Subsystem: subsystem,
-				Name:      fmt.Sprintf("%s_admission_latencies_seconds", name),
-				Help:      fmt.Sprintf(helpTemplate, "latency histogram"),
-				Buckets:   latencyBuckets,
+		latencies: metrics.NewHistogramVec(
+			&metrics.HistogramOpts{
+				Namespace:      namespace,
+				Subsystem:      subsystem,
+				Name:           fmt.Sprintf("%s_admission_duration_seconds", name),
+				Help:           fmt.Sprintf(helpTemplate, "latency histogram in seconds"),
+				Buckets:        latencyBuckets,
+				StabilityLevel: metrics.ALPHA,
 			},
 			labels,
 		),
@@ -193,9 +227,9 @@ func newMetricSet(name string, labels []string, helpTemplate string, hasSummary

 // MustRegister registers all the prometheus metrics in the metricSet.
 func (m *metricSet) mustRegister() {
-	prometheus.MustRegister(m.latencies)
+	legacyregistry.MustRegister(m.latencies)
 	if m.latenciesSummary != nil {
-		prometheus.MustRegister(m.latenciesSummary)
+		legacyregistry.MustRegister(m.latenciesSummary)
 	}
 }

@@ -209,9 +243,9 @@ func (m *metricSet) reset() {

 // Observe records an observed admission event to all metrics in the metricSet.
 func (m *metricSet) observe(elapsed time.Duration, labels ...string) {
-	elapsedMicroseconds := float64(elapsed / time.Microsecond)
-	m.latencies.WithLabelValues(labels...).Observe(elapsedMicroseconds)
+	elapsedSeconds := elapsed.Seconds()
+	m.latencies.WithLabelValues(labels...).Observe(elapsedSeconds)
 	if m.latenciesSummary != nil {
-		m.latenciesSummary.WithLabelValues(labels...).Observe(elapsedMicroseconds)
+		m.latenciesSummary.WithLabelValues(labels...).Observe(elapsedSeconds)
 	}
 }
--- a/vendor/k8s.io/apiserver/pkg/admission/metrics/metrics_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/metrics/metrics_test.go
@@ -17,10 +17,13 @@ limitations under the License.
 package metrics

 import (
+	"context"
 	"fmt"
 	"testing"
 	"time"

+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apiserver/pkg/admission"
 )
@@ -28,66 +31,85 @@ import (
 var (
 	kind     = schema.GroupVersionKind{Group: "kgroup", Version: "kversion", Kind: "kind"}
 	resource = schema.GroupVersionResource{Group: "rgroup", Version: "rversion", Resource: "resource"}
-	attr     = admission.NewAttributesRecord(nil, nil, kind, "ns", "name", resource, "subresource", admission.Create, nil)
+	attr     = admission.NewAttributesRecord(nil, nil, kind, "ns", "name", resource, "subresource", admission.Create, &metav1.CreateOptions{}, false, nil)
 )

 func TestObserveAdmissionStep(t *testing.T) {
 	Metrics.reset()
 	handler := WithStepMetrics(&mutatingAndValidatingFakeHandler{admission.NewHandler(admission.Create), true, true})
-	handler.(admission.MutationInterface).Admit(attr)
-	handler.(admission.ValidationInterface).Validate(attr)
+	handler.(admission.MutationInterface).Admit(context.TODO(), attr, nil)
+	handler.(admission.ValidationInterface).Validate(context.TODO(), attr, nil)
 	wantLabels := map[string]string{
-		"operation":   string(admission.Create),
-		"group":       resource.Group,
-		"version":     resource.Version,
-		"resource":    resource.Resource,
-		"subresource": "subresource",
-		"type":        "admit",
-		"rejected":    "false",
+		"operation": string(admission.Create),
+		"type":      "admit",
+		"rejected":  "false",
 	}
-	expectHistogramCountTotal(t, "apiserver_admission_step_admission_latencies_seconds", wantLabels, 1)
-	expectFindMetric(t, "apiserver_admission_step_admission_latencies_seconds_summary", wantLabels)
+	expectHistogramCountTotal(t, "apiserver_admission_step_admission_duration_seconds", wantLabels, 1)
+	expectFindMetric(t, "apiserver_admission_step_admission_duration_seconds_summary", wantLabels)

 	wantLabels["type"] = "validate"
-	expectHistogramCountTotal(t, "apiserver_admission_step_admission_latencies_seconds", wantLabels, 1)
-	expectFindMetric(t, "apiserver_admission_step_admission_latencies_seconds_summary", wantLabels)
+	expectHistogramCountTotal(t, "apiserver_admission_step_admission_duration_seconds", wantLabels, 1)
+	expectFindMetric(t, "apiserver_admission_step_admission_duration_seconds_summary", wantLabels)
 }

 func TestObserveAdmissionController(t *testing.T) {
 	Metrics.reset()
 	handler := WithControllerMetrics(&mutatingAndValidatingFakeHandler{admission.NewHandler(admission.Create), true, true}, "a")
-	handler.(admission.MutationInterface).Admit(attr)
-	handler.(admission.ValidationInterface).Validate(attr)
+	handler.(admission.MutationInterface).Admit(context.TODO(), attr, nil)
+	handler.(admission.ValidationInterface).Validate(context.TODO(), attr, nil)
 	wantLabels := map[string]string{
-		"name":        "a",
-		"operation":   string(admission.Create),
-		"group":       resource.Group,
-		"version":     resource.Version,
-		"resource":    resource.Resource,
-		"subresource": "subresource",
-		"type":        "validate",
-		"rejected":    "false",
+		"name":      "a",
+		"operation": string(admission.Create),
+		"type":      "admit",
+		"rejected":  "false",
 	}
-	expectHistogramCountTotal(t, "apiserver_admission_controller_admission_latencies_seconds", wantLabels, 1)
+	expectHistogramCountTotal(t, "apiserver_admission_controller_admission_duration_seconds", wantLabels, 1)

 	wantLabels["type"] = "validate"
-	expectHistogramCountTotal(t, "apiserver_admission_controller_admission_latencies_seconds", wantLabels, 1)
+	expectHistogramCountTotal(t, "apiserver_admission_controller_admission_duration_seconds", wantLabels, 1)
 }

 func TestObserveWebhook(t *testing.T) {
 	Metrics.reset()
 	Metrics.ObserveWebhook(2*time.Second, false, attr, stepAdmit, "x")
 	wantLabels := map[string]string{
-		"name":        "x",
-		"operation":   string(admission.Create),
-		"group":       resource.Group,
-		"version":     resource.Version,
-		"resource":    resource.Resource,
-		"subresource": "subresource",
-		"type":        "admit",
-		"rejected":    "false",
+		"name":      "x",
+		"operation": string(admission.Create),
+		"type":      "admit",
+		"rejected":  "false",
 	}
-	expectHistogramCountTotal(t, "apiserver_admission_webhook_admission_latencies_seconds", wantLabels, 1)
+	expectHistogramCountTotal(t, "apiserver_admission_webhook_admission_duration_seconds", wantLabels, 1)
+}
+
+func TestObserveWebhookRejection(t *testing.T) {
+	Metrics.reset()
+	Metrics.ObserveWebhookRejection("x", stepAdmit, string(admission.Create), WebhookRejectionNoError, 500)
+	Metrics.ObserveWebhookRejection("x", stepAdmit, string(admission.Create), WebhookRejectionNoError, 654)
+	Metrics.ObserveWebhookRejection("x", stepValidate, string(admission.Update), WebhookRejectionCallingWebhookError, 0)
+	wantLabels := map[string]string{
+		"name":           "x",
+		"operation":      string(admission.Create),
+		"type":           "admit",
+		"error_type":     "no_error",
+		"rejection_code": "500",
+	}
+	wantLabels600 := map[string]string{
+		"name":           "x",
+		"operation":      string(admission.Create),
+		"type":           "admit",
+		"error_type":     "no_error",
+		"rejection_code": "600",
+	}
+	wantLabelsCallingWebhookError := map[string]string{
+		"name":           "x",
+		"operation":      string(admission.Update),
+		"type":           "validate",
+		"error_type":     "calling_webhook_error",
+		"rejection_code": "0",
+	}
+	expectCounterValue(t, "apiserver_admission_webhook_rejection_count", wantLabels, 1)
+	expectCounterValue(t, "apiserver_admission_webhook_rejection_count", wantLabels600, 1)
+	expectCounterValue(t, "apiserver_admission_webhook_rejection_count", wantLabelsCallingWebhookError, 1)
 }

 func TestWithMetrics(t *testing.T) {
@@ -97,6 +119,7 @@ func TestWithMetrics(t *testing.T) {
 		name            string
 		ns              string
 		operation       admission.Operation
+		options         runtime.Object
 		handler         admission.Interface
 		admit, validate bool
 	}
@@ -105,6 +128,7 @@ func TestWithMetrics(t *testing.T) {
 			"both-interfaces-admit-and-validate",
 			"some-ns",
 			admission.Create,
+			&metav1.CreateOptions{},
 			&mutatingAndValidatingFakeHandler{admission.NewHandler(admission.Create, admission.Update), true, true},
 			true, true,
 		},
@@ -112,6 +136,7 @@ func TestWithMetrics(t *testing.T) {
 			"both-interfaces-dont-admit",
 			"some-ns",
 			admission.Create,
+			&metav1.CreateOptions{},
 			&mutatingAndValidatingFakeHandler{admission.NewHandler(admission.Create, admission.Update), false, true},
 			false, true,
 		},
@@ -119,6 +144,7 @@ func TestWithMetrics(t *testing.T) {
 			"both-interfaces-admit-dont-validate",
 			"some-ns",
 			admission.Create,
+			&metav1.CreateOptions{},
 			&mutatingAndValidatingFakeHandler{admission.NewHandler(admission.Create, admission.Update), true, false},
 			true, false,
 		},
@@ -126,6 +152,7 @@ func TestWithMetrics(t *testing.T) {
 			"validate-interfaces-validate",
 			"some-ns",
 			admission.Create,
+			&metav1.CreateOptions{},
 			&validatingFakeHandler{admission.NewHandler(admission.Create, admission.Update), true},
 			true, true,
 		},
@@ -133,13 +160,15 @@ func TestWithMetrics(t *testing.T) {
 			"validate-interfaces-dont-validate",
 			"some-ns",
 			admission.Create,
-			&validatingFakeHandler{admission.NewHandler(admission.Create, admission.Update), true},
+			&metav1.CreateOptions{},
+			&validatingFakeHandler{admission.NewHandler(admission.Create, admission.Update), false},
 			true, false,
 		},
 		{
 			"mutating-interfaces-admit",
 			"some-ns",
 			admission.Create,
+			&metav1.CreateOptions{},
 			&mutatingFakeHandler{admission.NewHandler(admission.Create, admission.Update), true},
 			true, true,
 		},
@@ -147,8 +176,9 @@ func TestWithMetrics(t *testing.T) {
 			"mutating-interfaces-dont-admit",
 			"some-ns",
 			admission.Create,
+			&metav1.CreateOptions{},
 			&mutatingFakeHandler{admission.NewHandler(admission.Create, admission.Update), false},
-			true, false,
+			false, true,
 		},
 	} {
 		Metrics.reset()
@@ -156,7 +186,7 @@ func TestWithMetrics(t *testing.T) {
 		h := WithMetrics(test.handler, Metrics.ObserveAdmissionController, test.name)

 		// test mutation
-		err := h.(admission.MutationInterface).Admit(admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{}, test.ns, "", schema.GroupVersionResource{}, "", test.operation, nil))
+		err := h.(admission.MutationInterface).Admit(context.TODO(), admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{}, test.ns, "", schema.GroupVersionResource{}, "", test.operation, test.options, false, nil), nil)
 		if test.admit && err != nil {
 			t.Errorf("expected admit to succeed, but failed: %v", err)
 			continue
@@ -165,23 +195,23 @@ func TestWithMetrics(t *testing.T) {
 			continue
 		}

-		filter := map[string]string{"rejected": "false"}
+		filter := map[string]string{"type": "admit", "rejected": "false"}
 		if !test.admit {
 			filter["rejected"] = "true"
 		}
 		if _, mutating := test.handler.(admission.MutationInterface); mutating {
-			expectHistogramCountTotal(t, "apiserver_admission_controller_admission_latencies_seconds", filter, 1)
+			expectHistogramCountTotal(t, "apiserver_admission_controller_admission_duration_seconds", filter, 1)
 		} else {
-			expectHistogramCountTotal(t, "apiserver_admission_controller_admission_latencies_seconds", filter, 0)
+			expectHistogramCountTotal(t, "apiserver_admission_controller_admission_duration_seconds", filter, 0)
 		}

-		if err == nil {
+		if err != nil {
 			// skip validation step if mutation failed
 			continue
 		}

 		// test validation
-		err = h.(admission.ValidationInterface).Validate(admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{}, test.ns, "", schema.GroupVersionResource{}, "", test.operation, nil))
+		err = h.(admission.ValidationInterface).Validate(context.TODO(), admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{}, test.ns, "", schema.GroupVersionResource{}, "", test.operation, test.options, false, nil), nil)
 		if test.validate && err != nil {
 			t.Errorf("expected admit to succeed, but failed: %v", err)
 			continue
@@ -190,14 +220,14 @@ func TestWithMetrics(t *testing.T) {
 			continue
 		}

-		filter = map[string]string{"rejected": "false"}
-		if !test.admit {
+		filter = map[string]string{"type": "validate", "rejected": "false"}
+		if !test.validate {
 			filter["rejected"] = "true"
 		}
 		if _, validating := test.handler.(admission.ValidationInterface); validating {
-			expectHistogramCountTotal(t, "apiserver_admission_controller_admission_latencies_seconds", filter, 1)
+			expectHistogramCountTotal(t, "apiserver_admission_controller_admission_duration_seconds", filter, 1)
 		} else {
-			expectHistogramCountTotal(t, "apiserver_admission_controller_admission_latencies_seconds", filter, 0)
+			expectHistogramCountTotal(t, "apiserver_admission_controller_admission_duration_seconds", filter, 0)
 		}
 	}
 }
@@ -208,14 +238,14 @@ type mutatingAndValidatingFakeHandler struct {
 	validate bool
 }

-func (h *mutatingAndValidatingFakeHandler) Admit(a admission.Attributes) (err error) {
+func (h *mutatingAndValidatingFakeHandler) Admit(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) (err error) {
 	if h.admit {
 		return nil
 	}
 	return fmt.Errorf("don't admit")
 }

-func (h *mutatingAndValidatingFakeHandler) Validate(a admission.Attributes) (err error) {
+func (h *mutatingAndValidatingFakeHandler) Validate(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) (err error) {
 	if h.validate {
 		return nil
 	}
@@ -227,7 +257,7 @@ type validatingFakeHandler struct {
 	validate bool
 }

-func (h *validatingFakeHandler) Validate(a admission.Attributes) (err error) {
+func (h *validatingFakeHandler) Validate(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) (err error) {
 	if h.validate {
 		return nil
 	}
@@ -239,7 +269,7 @@ type mutatingFakeHandler struct {
 	admit bool
 }

-func (h *mutatingFakeHandler) Amit(a admission.Attributes) (err error) {
+func (h *mutatingFakeHandler) Admit(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) (err error) {
 	if h.admit {
 		return nil
 	}
--- a/vendor/k8s.io/apiserver/pkg/admission/metrics/testutil_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/metrics/testutil_test.go
@@ -89,3 +89,35 @@ func expectHistogramCountTotal(t *testing.T, name string, labelFilter map[string
 		}
 	}
 }
+
+// expectCounterValue ensures that the counts of metrics matching the labelFilter is as
+// expected.
+func expectCounterValue(t *testing.T, name string, labelFilter map[string]string, wantCount int) {
+	metrics, err := prometheus.DefaultGatherer.Gather()
+	if err != nil {
+		t.Fatalf("Failed to gather metrics: %s", err)
+	}
+
+	counterSum := 0
+	for _, mf := range metrics {
+		if mf.GetName() != name {
+			continue // Ignore other metrics.
+		}
+		for _, metric := range mf.GetMetric() {
+			if !labelsMatch(metric, labelFilter) {
+				continue
+			}
+			counterSum += int(metric.GetCounter().GetValue())
+		}
+	}
+	if wantCount != counterSum {
+		t.Errorf("Wanted count %d, got %d for metric %s with labels %#+v", wantCount, counterSum, name, labelFilter)
+		for _, mf := range metrics {
+			if mf.GetName() == name {
+				for _, metric := range mf.GetMetric() {
+					t.Logf("\tnear match: %s", metric.String())
+				}
+			}
+		}
+	}
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/initialization/BUILD
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/initialization/BUILD
@@ -1,61 +0,0 @@
-package(default_visibility = ["//visibility:public"])
-
-load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_library",
-    "go_test",
-)
-
-go_library(
-    name = "go_default_library",
-    srcs = ["initialization.go"],
-    importpath = "k8s.io/apiserver/pkg/admission/plugin/initialization",
-    deps = [
-        "//vendor/github.com/golang/glog:go_default_library",
-        "//vendor/k8s.io/api/admissionregistration/v1alpha1:go_default_library",
-        "//vendor/k8s.io/api/core/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/api/meta:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/api/validation:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/validation/field:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/configuration:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/authorization/authorizer:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/features:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/util/feature:go_default_library",
-        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
-    ],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-)
-
-go_test(
-    name = "go_default_test",
-    srcs = ["initialization_test.go"],
-    importpath = "k8s.io/apiserver/pkg/admission/plugin/initialization",
-    library = ":go_default_library",
-    deps = [
-        "//vendor/k8s.io/api/admissionregistration/v1alpha1:go_default_library",
-        "//vendor/k8s.io/api/core/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/api/meta:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/authorization/authorizer:go_default_library",
-    ],
-)
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/initialization/initialization.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/initialization/initialization.go
@@ -1,368 +0,0 @@
-/*
-Copyright 2017 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package initialization
-
-import (
-	"fmt"
-	"io"
-	"strings"
-
-	"github.com/golang/glog"
-
-	"k8s.io/api/admissionregistration/v1alpha1"
-	"k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/api/meta"
-	"k8s.io/apimachinery/pkg/api/validation"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/util/validation/field"
-	"k8s.io/apimachinery/pkg/util/wait"
-	"k8s.io/apiserver/pkg/admission"
-	"k8s.io/apiserver/pkg/admission/configuration"
-	"k8s.io/apiserver/pkg/authorization/authorizer"
-	"k8s.io/apiserver/pkg/features"
-	utilfeature "k8s.io/apiserver/pkg/util/feature"
-	clientset "k8s.io/client-go/kubernetes"
-)
-
-const (
-	// Name of admission plug-in
-	PluginName = "Initializers"
-)
-
-// Register registers a plugin
-func Register(plugins *admission.Plugins) {
-	plugins.Register(PluginName, func(config io.Reader) (admission.Interface, error) {
-		return NewInitializer(), nil
-	})
-}
-
-type initializerOptions struct {
-	Initializers []string
-}
-
-type InitializationConfig interface {
-	Run(stopCh <-chan struct{})
-	Initializers() (*v1alpha1.InitializerConfiguration, error)
-}
-
-type initializer struct {
-	config     InitializationConfig
-	authorizer authorizer.Authorizer
-}
-
-// NewInitializer creates a new initializer plugin which assigns newly created resources initializers
-// based on configuration loaded from the admission API group.
-// FUTURE: this may be moved to the storage layer of the apiserver, but for now this is an alpha feature
-//   that can be disabled.
-func NewInitializer() admission.Interface {
-	return &initializer{}
-}
-
-// ValidateInitialization implements the InitializationValidator interface.
-func (i *initializer) ValidateInitialization() error {
-	if i.config == nil {
-		return fmt.Errorf("the Initializer admission plugin requires a Kubernetes client to be provided")
-	}
-	if i.authorizer == nil {
-		return fmt.Errorf("the Initializer admission plugin requires an authorizer to be provided")
-	}
-
-	if !utilfeature.DefaultFeatureGate.Enabled(features.Initializers) {
-		if err := utilfeature.DefaultFeatureGate.Set(string(features.Initializers) + "=true"); err != nil {
-			glog.Errorf("error enabling Initializers feature as part of admission plugin setup: %v", err)
-		} else {
-			glog.Infof("enabled Initializers feature as part of admission plugin setup")
-		}
-	}
-
-	i.config.Run(wait.NeverStop)
-	return nil
-}
-
-// SetExternalKubeClientSet implements the WantsExternalKubeClientSet interface.
-func (i *initializer) SetExternalKubeClientSet(client clientset.Interface) {
-	i.config = configuration.NewInitializerConfigurationManager(client.AdmissionregistrationV1alpha1().InitializerConfigurations())
-}
-
-// SetAuthorizer implements the WantsAuthorizer interface.
-func (i *initializer) SetAuthorizer(a authorizer.Authorizer) {
-	i.authorizer = a
-}
-
-var initializerFieldPath = field.NewPath("metadata", "initializers")
-
-// readConfig holds requests instead of failing them if the server is not yet initialized
-// or is unresponsive. It formats the returned error for client use if necessary.
-func (i *initializer) readConfig(a admission.Attributes) (*v1alpha1.InitializerConfiguration, error) {
-	// read initializers from config
-	config, err := i.config.Initializers()
-	if err == nil {
-		return config, nil
-	}
-
-	// if initializer configuration is disabled, fail open
-	if err == configuration.ErrDisabled {
-		return &v1alpha1.InitializerConfiguration{}, nil
-	}
-
-	e := errors.NewServerTimeout(a.GetResource().GroupResource(), "create", 1)
-	if err == configuration.ErrNotReady {
-		e.ErrStatus.Message = fmt.Sprintf("Waiting for initialization configuration to load: %v", err)
-		e.ErrStatus.Reason = "LoadingConfiguration"
-		e.ErrStatus.Details.Causes = append(e.ErrStatus.Details.Causes, metav1.StatusCause{
-			Type:    "InitializerConfigurationPending",
-			Message: "The server is waiting for the initializer configuration to be loaded.",
-		})
-	} else {
-		e.ErrStatus.Message = fmt.Sprintf("Unable to refresh the initializer configuration: %v", err)
-		e.ErrStatus.Reason = "LoadingConfiguration"
-		e.ErrStatus.Details.Causes = append(e.ErrStatus.Details.Causes, metav1.StatusCause{
-			Type:    "InitializerConfigurationFailure",
-			Message: "An error has occurred while refreshing the initializer configuration, no resources can be created until a refresh succeeds.",
-		})
-	}
-	return nil, e
-}
-
-// Admit checks for create requests to add initializers, or update request to enforce invariants.
-// The admission controller fails open if the object doesn't have ObjectMeta (can't be initialized).
-// A client with sufficient permission ("initialize" verb on resource) can specify its own initializers
-// or an empty initializers struct (which bypasses initialization). Only clients with the initialize verb
-// can update objects that have not completed initialization. Sub resources can still be modified on
-// resources that are undergoing initialization.
-// TODO: once this logic is ready for beta, move it into the REST storage layer.
-func (i *initializer) Admit(a admission.Attributes) (err error) {
-	switch a.GetOperation() {
-	case admission.Create, admission.Update:
-	default:
-		return nil
-	}
-
-	// TODO: should sub-resource action should be denied until the object is initialized?
-	if len(a.GetSubresource()) > 0 {
-		return nil
-	}
-
-	switch a.GetOperation() {
-	case admission.Create:
-		accessor, err := meta.Accessor(a.GetObject())
-		if err != nil {
-			// objects without meta accessor cannot be checked for initialization, and it is possible to make calls
-			// via our API that don't have ObjectMeta
-			return nil
-		}
-		existing := accessor.GetInitializers()
-		if existing != nil {
-			glog.V(5).Infof("Admin bypassing initialization for %s", a.GetResource())
-
-			// it must be possible for some users to bypass initialization - for now, check the initialize operation
-			if err := i.canInitialize(a, "create with initializers denied"); err != nil {
-				return err
-			}
-			// allow administrators to bypass initialization by setting an empty initializers struct
-			if len(existing.Pending) == 0 && existing.Result == nil {
-				accessor.SetInitializers(nil)
-				return nil
-			}
-		} else {
-			glog.V(5).Infof("Checking initialization for %s", a.GetResource())
-
-			config, err := i.readConfig(a)
-			if err != nil {
-				return err
-			}
-
-			// Mirror pods are exempt from initialization because they are created and initialized
-			// on the Kubelet before they appear in the API.
-			// TODO: once this moves to REST storage layer, this becomes a pod specific concern
-			if a.GetKind().GroupKind() == v1.SchemeGroupVersion.WithKind("Pod").GroupKind() {
-				accessor, err := meta.Accessor(a.GetObject())
-				if err != nil {
-					return err
-				}
-				annotations := accessor.GetAnnotations()
-				if _, isMirror := annotations[v1.MirrorPodAnnotationKey]; isMirror {
-					return nil
-				}
-			}
-
-			names := findInitializers(config, a.GetResource())
-			if len(names) == 0 {
-				glog.V(5).Infof("No initializers needed")
-				return nil
-			}
-
-			glog.V(5).Infof("Found initializers for %s: %v", a.GetResource(), names)
-			accessor.SetInitializers(newInitializers(names))
-		}
-
-	case admission.Update:
-		accessor, err := meta.Accessor(a.GetObject())
-		if err != nil {
-			// objects without meta accessor cannot be checked for initialization, and it is possible to make calls
-			// via our API that don't have ObjectMeta
-			return nil
-		}
-		updated := accessor.GetInitializers()
-
-		// controllers deployed with an empty initializers.pending have their initializers set to nil
-		// but should be able to update without changing their manifest
-		if updated != nil && len(updated.Pending) == 0 && updated.Result == nil {
-			accessor.SetInitializers(nil)
-			updated = nil
-		}
-
-		existingAccessor, err := meta.Accessor(a.GetOldObject())
-		if err != nil {
-			// if the old object does not have an accessor, but the new one does, error out
-			return fmt.Errorf("initialized resources must be able to set initializers (%T): %v", a.GetOldObject(), err)
-		}
-		existing := existingAccessor.GetInitializers()
-
-		// updates on initialized resources are allowed
-		if updated == nil && existing == nil {
-			return nil
-		}
-
-		glog.V(5).Infof("Modifying uninitialized resource %s", a.GetResource())
-
-		// because we are called before validation, we need to ensure the update transition is valid.
-		if errs := validation.ValidateInitializersUpdate(updated, existing, initializerFieldPath); len(errs) > 0 {
-			return errors.NewInvalid(a.GetKind().GroupKind(), a.GetName(), errs)
-		}
-
-		// caller must have the ability to mutate un-initialized resources
-		if err := i.canInitialize(a, "update to uninitialized resource denied"); err != nil {
-			return err
-		}
-
-		// TODO: restrict initialization list changes to specific clients?
-	}
-
-	return nil
-}
-
-func (i *initializer) canInitialize(a admission.Attributes, message string) error {
-	// caller must have the ability to mutate un-initialized resources
-	decision, reason, err := i.authorizer.Authorize(authorizer.AttributesRecord{
-		Name:            a.GetName(),
-		ResourceRequest: true,
-		User:            a.GetUserInfo(),
-		Verb:            "initialize",
-		Namespace:       a.GetNamespace(),
-		APIGroup:        a.GetResource().Group,
-		APIVersion:      a.GetResource().Version,
-		Resource:        a.GetResource().Resource,
-	})
-	if err != nil {
-		return err
-	}
-	if decision != authorizer.DecisionAllow {
-		return errors.NewForbidden(a.GetResource().GroupResource(), a.GetName(), fmt.Errorf("%s: %s", message, reason))
-	}
-	return nil
-}
-
-// Handles returns true if this admission controller can handle the given operation
-// where operation can be one of CREATE, UPDATE, DELETE, or CONNECT
-func (i *initializer) Handles(op admission.Operation) bool {
-	return op == admission.Create || op == admission.Update
-}
-
-// newInitializers populates an Initializers struct.
-func newInitializers(names []string) *metav1.Initializers {
-	if len(names) == 0 {
-		return nil
-	}
-	var init []metav1.Initializer
-	for _, name := range names {
-		init = append(init, metav1.Initializer{Name: name})
-	}
-	return &metav1.Initializers{
-		Pending: init,
-	}
-}
-
-// findInitializers returns the list of initializer names that apply to a config. It returns an empty list
-// if no initializers apply.
-func findInitializers(initializers *v1alpha1.InitializerConfiguration, gvr schema.GroupVersionResource) []string {
-	var names []string
-	for _, init := range initializers.Initializers {
-		if !matchRule(init.Rules, gvr) {
-			continue
-		}
-		names = append(names, init.Name)
-	}
-	return names
-}
-
-// matchRule returns true if any rule matches the provided group version resource.
-func matchRule(rules []v1alpha1.Rule, gvr schema.GroupVersionResource) bool {
-	for _, rule := range rules {
-		if !hasGroup(rule.APIGroups, gvr.Group) {
-			return false
-		}
-		if !hasVersion(rule.APIVersions, gvr.Version) {
-			return false
-		}
-		if !hasResource(rule.Resources, gvr.Resource) {
-			return false
-		}
-	}
-	return len(rules) > 0
-}
-
-func hasGroup(groups []string, group string) bool {
-	if groups[0] == "*" {
-		return true
-	}
-	for _, g := range groups {
-		if g == group {
-			return true
-		}
-	}
-	return false
-}
-
-func hasVersion(versions []string, version string) bool {
-	if versions[0] == "*" {
-		return true
-	}
-	for _, v := range versions {
-		if v == version {
-			return true
-		}
-	}
-	return false
-}
-
-func hasResource(resources []string, resource string) bool {
-	if resources[0] == "*" || resources[0] == "*/*" {
-		return true
-	}
-	for _, r := range resources {
-		if strings.Contains(r, "/") {
-			continue
-		}
-		if r == resource {
-			return true
-		}
-	}
-	return false
-}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/initialization/initialization_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/initialization/initialization_test.go
@@ -1,194 +0,0 @@
-/*
-Copyright 2017 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package initialization
-
-import (
-	"reflect"
-	"strings"
-	"testing"
-
-	"k8s.io/api/admissionregistration/v1alpha1"
-	"k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/meta"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apiserver/pkg/admission"
-	"k8s.io/apiserver/pkg/authorization/authorizer"
-)
-
-func newInitializer(name string, rules ...v1alpha1.Rule) *v1alpha1.InitializerConfiguration {
-	return addInitializer(&v1alpha1.InitializerConfiguration{}, name, rules...)
-}
-
-func addInitializer(base *v1alpha1.InitializerConfiguration, name string, rules ...v1alpha1.Rule) *v1alpha1.InitializerConfiguration {
-	base.Initializers = append(base.Initializers, v1alpha1.Initializer{
-		Name:  name,
-		Rules: rules,
-	})
-	return base
-}
-
-func TestFindInitializers(t *testing.T) {
-	type args struct {
-		initializers *v1alpha1.InitializerConfiguration
-		gvr          schema.GroupVersionResource
-	}
-	tests := []struct {
-		name string
-		args args
-		want []string
-	}{
-		{
-			name: "empty",
-			args: args{
-				gvr:          schema.GroupVersionResource{},
-				initializers: newInitializer("1"),
-			},
-		},
-		{
-			name: "everything",
-			args: args{
-				gvr:          schema.GroupVersionResource{},
-				initializers: newInitializer("1", v1alpha1.Rule{APIGroups: []string{"*"}, APIVersions: []string{"*"}, Resources: []string{"*"}}),
-			},
-			want: []string{"1"},
-		},
-		{
-			name: "empty group",
-			args: args{
-				gvr:          schema.GroupVersionResource{},
-				initializers: newInitializer("1", v1alpha1.Rule{APIGroups: []string{""}, APIVersions: []string{"*"}, Resources: []string{"*"}}),
-			},
-			want: []string{"1"},
-		},
-		{
-			name: "pod",
-			args: args{
-				gvr: schema.GroupVersionResource{Resource: "pods"},
-				initializers: addInitializer(
-					newInitializer("1", v1alpha1.Rule{APIGroups: []string{""}, APIVersions: []string{"*"}, Resources: []string{"pods"}}),
-					"2", v1alpha1.Rule{APIGroups: []string{""}, APIVersions: []string{"*"}, Resources: []string{"pods"}},
-				),
-			},
-			want: []string{"1", "2"},
-		},
-		{
-			name: "multiple matches",
-			args: args{
-				gvr:          schema.GroupVersionResource{Resource: "pods"},
-				initializers: newInitializer("1", v1alpha1.Rule{APIGroups: []string{""}, APIVersions: []string{"*"}, Resources: []string{"pods"}}),
-			},
-			want: []string{"1"},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := findInitializers(tt.args.initializers, tt.args.gvr); !reflect.DeepEqual(got, tt.want) {
-				t.Errorf("findInitializers() = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
-
-type fakeAuthorizer struct {
-	accept bool
-}
-
-func (f *fakeAuthorizer) Authorize(a authorizer.Attributes) (authorizer.Decision, string, error) {
-	if f.accept {
-		return authorizer.DecisionAllow, "", nil
-	}
-	return authorizer.DecisionNoOpinion, "denied", nil
-}
-
-func TestAdmitUpdate(t *testing.T) {
-	tests := []struct {
-		name             string
-		oldInitializers  *metav1.Initializers
-		newInitializers  *metav1.Initializers
-		verifyUpdatedObj func(runtime.Object) (pass bool, reason string)
-		err              string
-	}{
-		{
-			name:            "updates on initialized resources are allowed",
-			oldInitializers: nil,
-			newInitializers: nil,
-			err:             "",
-		},
-		{
-			name:            "updates on initialized resources are allowed",
-			oldInitializers: &metav1.Initializers{Pending: []metav1.Initializer{{Name: "init.k8s.io"}}},
-			newInitializers: &metav1.Initializers{},
-			verifyUpdatedObj: func(obj runtime.Object) (bool, string) {
-				accessor, err := meta.Accessor(obj)
-				if err != nil {
-					return false, "cannot get accessor"
-				}
-				if accessor.GetInitializers() != nil {
-					return false, "expect nil initializers"
-				}
-				return true, ""
-			},
-			err: "",
-		},
-		{
-			name:            "initializers may not be set once initialized",
-			oldInitializers: nil,
-			newInitializers: &metav1.Initializers{Pending: []metav1.Initializer{{Name: "init.k8s.io"}}},
-			err:             "field is immutable once initialization has completed",
-		},
-		{
-			name:            "empty initializer list is treated as nil initializer",
-			oldInitializers: nil,
-			newInitializers: &metav1.Initializers{},
-			verifyUpdatedObj: func(obj runtime.Object) (bool, string) {
-				accessor, err := meta.Accessor(obj)
-				if err != nil {
-					return false, "cannot get accessor"
-				}
-				if accessor.GetInitializers() != nil {
-					return false, "expect nil initializers"
-				}
-				return true, ""
-			},
-			err: "",
-		},
-	}
-
-	plugin := initializer{
-		config:     nil,
-		authorizer: &fakeAuthorizer{true},
-	}
-	for _, tc := range tests {
-		oldObj := &v1.Pod{}
-		oldObj.Initializers = tc.oldInitializers
-		newObj := &v1.Pod{}
-		newObj.Initializers = tc.newInitializers
-		a := admission.NewAttributesRecord(newObj, oldObj, schema.GroupVersionKind{}, "", "foo", schema.GroupVersionResource{}, "", admission.Update, nil)
-		err := plugin.Admit(a)
-		switch {
-		case tc.err == "" && err != nil:
-			t.Errorf("%q: unexpected error: %v", tc.name, err)
-		case tc.err != "" && err == nil:
-			t.Errorf("%q: unexpected no error, expected %s", tc.name, tc.err)
-		case tc.err != "" && err != nil && !strings.Contains(err.Error(), tc.err):
-			t.Errorf("%q: expected %s, got %v", tc.name, tc.err, err)
-		}
-	}
-
-}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/namespace/lifecycle/BUILD
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/namespace/lifecycle/BUILD
@@ -1,63 +0,0 @@
-package(default_visibility = ["//visibility:public"])
-
-load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_library",
-    "go_test",
-)
-
-go_library(
-    name = "go_default_library",
-    srcs = ["admission.go"],
-    importpath = "k8s.io/apiserver/pkg/admission/plugin/namespace/lifecycle",
-    deps = [
-        "//vendor/github.com/golang/glog:go_default_library",
-        "//vendor/k8s.io/api/core/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/cache:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/clock:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/sets:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/initializer:go_default_library",
-        "//vendor/k8s.io/client-go/informers:go_default_library",
-        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
-        "//vendor/k8s.io/client-go/listers/core/v1:go_default_library",
-    ],
-)
-
-go_test(
-    name = "go_default_test",
-    srcs = ["admission_test.go"],
-    importpath = "k8s.io/apiserver/pkg/admission/plugin/namespace/lifecycle",
-    library = ":go_default_library",
-    deps = [
-        "//vendor/k8s.io/api/core/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/clock:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/sets:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/initializer:go_default_library",
-        "//vendor/k8s.io/client-go/informers:go_default_library",
-        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
-        "//vendor/k8s.io/client-go/kubernetes/fake:go_default_library",
-        "//vendor/k8s.io/client-go/testing:go_default_library",
-    ],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-)
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/namespace/lifecycle/admission.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/namespace/lifecycle/admission.go
@@ -17,13 +17,14 @@ limitations under the License.
 package lifecycle

 import (
+	"context"
 	"fmt"
 	"io"
 	"time"

-	"github.com/golang/glog"
+	"k8s.io/klog"

-	"k8s.io/api/core/v1"
+	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
@@ -38,7 +39,7 @@ import (
 )

 const (
-	// Name of admission plug-in
+	// PluginName indicates the name of admission plug-in
 	PluginName = "NamespaceLifecycle"
 	// how long a namespace stays in the force live lookup cache before expiration.
 	forceLiveLookupTTL = 30 * time.Second
@@ -69,23 +70,11 @@ type Lifecycle struct {
 	forceLiveLookupCache *utilcache.LRUExpireCache
 }

-type forceLiveLookupEntry struct {
-	expiry time.Time
-}
-
 var _ = initializer.WantsExternalKubeInformerFactory(&Lifecycle{})
 var _ = initializer.WantsExternalKubeClientSet(&Lifecycle{})

-func makeNamespaceKey(namespace string) *v1.Namespace {
-	return &v1.Namespace{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      namespace,
-			Namespace: "",
-		},
-	}
-}
-
-func (l *Lifecycle) Admit(a admission.Attributes) error {
+// Admit makes an admission decision based on the request attributes
+func (l *Lifecycle) Admit(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) error {
 	// prevent deletion of immortal namespaces
 	if a.GetOperation() == admission.Delete && a.GetKind().GroupKind() == v1.SchemeGroupVersion.WithKind("Namespace").GroupKind() && l.immortalNamespaces.Has(a.GetName()) {
 		return errors.NewForbidden(a.GetResource().GroupResource(), a.GetName(), fmt.Errorf("this namespace may not be deleted"))
@@ -151,7 +140,7 @@ func (l *Lifecycle) Admit(a admission.Attributes) error {
 			exists = true
 		}
 		if exists {
-			glog.V(4).Infof("found %s in cache after waiting", a.GetNamespace())
+			klog.V(4).Infof("found %s in cache after waiting", a.GetNamespace())
 		}
 	}

@@ -172,7 +161,7 @@ func (l *Lifecycle) Admit(a admission.Attributes) error {
 		case err != nil:
 			return errors.NewInternalError(err)
 		}
-		glog.V(4).Infof("found %s via storage lookup", a.GetNamespace())
+		klog.V(4).Infof("found %s via storage lookup", a.GetNamespace())
 	}

 	// ensure that we're not trying to create objects in terminating namespaces
@@ -182,7 +171,7 @@ func (l *Lifecycle) Admit(a admission.Attributes) error {
 		}

 		// TODO: This should probably not be a 403
-		return admission.NewForbidden(a, fmt.Errorf("unable to create new content in namespace %s because it is being terminated.", a.GetNamespace()))
+		return admission.NewForbidden(a, fmt.Errorf("unable to create new content in namespace %s because it is being terminated", a.GetNamespace()))
 	}

 	return nil
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/namespace/lifecycle/admission_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/namespace/lifecycle/admission_test.go
@@ -17,11 +17,12 @@ limitations under the License.
 package lifecycle

 import (
+	"context"
 	"fmt"
 	"testing"
 	"time"

-	"k8s.io/api/core/v1"
+	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
@@ -48,7 +49,7 @@ func newHandlerForTestWithClock(c clientset.Interface, cacheClock clock.Clock) (
 	if err != nil {
 		return nil, f, err
 	}
-	pluginInitializer := kubeadmission.New(c, f, nil, nil)
+	pluginInitializer := kubeadmission.New(c, f, nil)
 	pluginInitializer.Initialize(handler)
 	err = admission.ValidateInitialization(handler)
 	return handler, f, err
@@ -104,7 +105,7 @@ func TestAccessReviewCheckOnMissingNamespace(t *testing.T) {
 	}
 	informerFactory.Start(wait.NeverStop)

-	err = handler.Admit(admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{Group: "authorization.k8s.io", Version: "v1", Kind: "LocalSubjectAccesReview"}, namespace, "", schema.GroupVersionResource{Group: "authorization.k8s.io", Version: "v1", Resource: "localsubjectaccessreviews"}, "", admission.Create, nil))
+	err = handler.Admit(context.TODO(), admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{Group: "authorization.k8s.io", Version: "v1", Kind: "LocalSubjectAccesReview"}, namespace, "", schema.GroupVersionResource{Group: "authorization.k8s.io", Version: "v1", Resource: "localsubjectaccessreviews"}, "", admission.Create, &metav1.CreateOptions{}, false, nil), nil)
 	if err != nil {
 		t.Error(err)
 	}
@@ -124,7 +125,7 @@ func TestAdmissionNamespaceDoesNotExist(t *testing.T) {
 	informerFactory.Start(wait.NeverStop)

 	pod := newPod(namespace)
-	err = handler.Admit(admission.NewAttributesRecord(&pod, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Create, nil))
+	err = handler.Admit(context.TODO(), admission.NewAttributesRecord(&pod, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Create, &metav1.CreateOptions{}, false, nil), nil)
 	if err == nil {
 		actions := ""
 		for _, action := range mockClient.Actions() {
@@ -134,19 +135,19 @@ func TestAdmissionNamespaceDoesNotExist(t *testing.T) {
 	}

 	// verify create operations in the namespace cause an error
-	err = handler.Admit(admission.NewAttributesRecord(&pod, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Create, nil))
+	err = handler.Admit(context.TODO(), admission.NewAttributesRecord(&pod, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Create, &metav1.CreateOptions{}, false, nil), nil)
 	if err == nil {
 		t.Errorf("Expected error rejecting creates in a namespace when it is missing")
 	}

 	// verify update operations in the namespace cause an error
-	err = handler.Admit(admission.NewAttributesRecord(&pod, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Update, nil))
+	err = handler.Admit(context.TODO(), admission.NewAttributesRecord(&pod, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Update, &metav1.UpdateOptions{}, false, nil), nil)
 	if err == nil {
 		t.Errorf("Expected error rejecting updates in a namespace when it is missing")
 	}

 	// verify delete operations in the namespace can proceed
-	err = handler.Admit(admission.NewAttributesRecord(nil, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Delete, nil))
+	err = handler.Admit(context.TODO(), admission.NewAttributesRecord(nil, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Delete, &metav1.DeleteOptions{}, false, nil), nil)
 	if err != nil {
 		t.Errorf("Unexpected error returned from admission handler: %v", err)
 	}
@@ -166,7 +167,7 @@ func TestAdmissionNamespaceActive(t *testing.T) {
 	informerFactory.Start(wait.NeverStop)

 	pod := newPod(namespace)
-	err = handler.Admit(admission.NewAttributesRecord(&pod, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Create, nil))
+	err = handler.Admit(context.TODO(), admission.NewAttributesRecord(&pod, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Create, &metav1.CreateOptions{}, false, nil), nil)
 	if err != nil {
 		t.Errorf("unexpected error returned from admission handler")
 	}
@@ -187,31 +188,31 @@ func TestAdmissionNamespaceTerminating(t *testing.T) {

 	pod := newPod(namespace)
 	// verify create operations in the namespace cause an error
-	err = handler.Admit(admission.NewAttributesRecord(&pod, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Create, nil))
+	err = handler.Admit(context.TODO(), admission.NewAttributesRecord(&pod, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Create, &metav1.CreateOptions{}, false, nil), nil)
 	if err == nil {
 		t.Errorf("Expected error rejecting creates in a namespace when it is terminating")
 	}

 	// verify update operations in the namespace can proceed
-	err = handler.Admit(admission.NewAttributesRecord(&pod, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Update, nil))
+	err = handler.Admit(context.TODO(), admission.NewAttributesRecord(&pod, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Update, &metav1.UpdateOptions{}, false, nil), nil)
 	if err != nil {
 		t.Errorf("Unexpected error returned from admission handler: %v", err)
 	}

 	// verify delete operations in the namespace can proceed
-	err = handler.Admit(admission.NewAttributesRecord(nil, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Delete, nil))
+	err = handler.Admit(context.TODO(), admission.NewAttributesRecord(nil, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Delete, &metav1.DeleteOptions{}, false, nil), nil)
 	if err != nil {
 		t.Errorf("Unexpected error returned from admission handler: %v", err)
 	}

 	// verify delete of namespace default can never proceed
-	err = handler.Admit(admission.NewAttributesRecord(nil, nil, v1.SchemeGroupVersion.WithKind("Namespace").GroupKind().WithVersion("version"), "", metav1.NamespaceDefault, v1.Resource("namespaces").WithVersion("version"), "", admission.Delete, nil))
+	err = handler.Admit(context.TODO(), admission.NewAttributesRecord(nil, nil, v1.SchemeGroupVersion.WithKind("Namespace").GroupKind().WithVersion("version"), "", metav1.NamespaceDefault, v1.Resource("namespaces").WithVersion("version"), "", admission.Delete, &metav1.DeleteOptions{}, false, nil), nil)
 	if err == nil {
 		t.Errorf("Expected an error that this namespace can never be deleted")
 	}

 	// verify delete of namespace other than default can proceed
-	err = handler.Admit(admission.NewAttributesRecord(nil, nil, v1.SchemeGroupVersion.WithKind("Namespace").GroupKind().WithVersion("version"), "", "other", v1.Resource("namespaces").WithVersion("version"), "", admission.Delete, nil))
+	err = handler.Admit(context.TODO(), admission.NewAttributesRecord(nil, nil, v1.SchemeGroupVersion.WithKind("Namespace").GroupKind().WithVersion("version"), "", "other", v1.Resource("namespaces").WithVersion("version"), "", admission.Delete, &metav1.DeleteOptions{}, false, nil), nil)
 	if err != nil {
 		t.Errorf("Did not expect an error %v", err)
 	}
@@ -238,7 +239,7 @@ func TestAdmissionNamespaceForceLiveLookup(t *testing.T) {

 	pod := newPod(namespace)
 	// verify create operations in the namespace is allowed
-	err = handler.Admit(admission.NewAttributesRecord(&pod, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Create, nil))
+	err = handler.Admit(context.TODO(), admission.NewAttributesRecord(&pod, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Create, &metav1.CreateOptions{}, false, nil), nil)
 	if err != nil {
 		t.Errorf("Unexpected error rejecting creates in an active namespace")
 	}
@@ -248,7 +249,7 @@ func TestAdmissionNamespaceForceLiveLookup(t *testing.T) {
 	getCalls = 0

 	// verify delete of namespace can proceed
-	err = handler.Admit(admission.NewAttributesRecord(nil, nil, v1.SchemeGroupVersion.WithKind("Namespace").GroupKind().WithVersion("version"), namespace, namespace, v1.Resource("namespaces").WithVersion("version"), "", admission.Delete, nil))
+	err = handler.Admit(context.TODO(), admission.NewAttributesRecord(nil, nil, v1.SchemeGroupVersion.WithKind("Namespace").GroupKind().WithVersion("version"), namespace, namespace, v1.Resource("namespaces").WithVersion("version"), "", admission.Delete, &metav1.DeleteOptions{}, false, nil), nil)
 	if err != nil {
 		t.Errorf("Expected namespace deletion to be allowed")
 	}
@@ -261,7 +262,7 @@ func TestAdmissionNamespaceForceLiveLookup(t *testing.T) {
 	phases[namespace] = v1.NamespaceTerminating

 	// verify create operations in the namespace cause an error
-	err = handler.Admit(admission.NewAttributesRecord(&pod, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Create, nil))
+	err = handler.Admit(context.TODO(), admission.NewAttributesRecord(&pod, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Create, &metav1.CreateOptions{}, false, nil), nil)
 	if err == nil {
 		t.Errorf("Expected error rejecting creates in a namespace right after deleting it")
 	}
@@ -274,7 +275,7 @@ func TestAdmissionNamespaceForceLiveLookup(t *testing.T) {
 	fakeClock.Step(forceLiveLookupTTL)

 	// verify create operations in the namespace cause an error
-	err = handler.Admit(admission.NewAttributesRecord(&pod, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Create, nil))
+	err = handler.Admit(context.TODO(), admission.NewAttributesRecord(&pod, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Create, &metav1.CreateOptions{}, false, nil), nil)
 	if err == nil {
 		t.Errorf("Expected error rejecting creates in a namespace right after deleting it")
 	}
@@ -287,7 +288,7 @@ func TestAdmissionNamespaceForceLiveLookup(t *testing.T) {
 	fakeClock.Step(time.Millisecond)

 	// verify create operations in the namespace don't force a live lookup after the timeout
-	handler.Admit(admission.NewAttributesRecord(&pod, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Create, nil))
+	handler.Admit(context.TODO(), admission.NewAttributesRecord(&pod, nil, v1.SchemeGroupVersion.WithKind("Pod").GroupKind().WithVersion("version"), pod.Namespace, pod.Name, v1.Resource("pods").WithVersion("version"), "", admission.Create, &metav1.CreateOptions{}, false, nil), nil)
 	if getCalls != 0 {
 		t.Errorf("Expected no live lookup of the namespace at t=forceLiveLookupTTL+1ms, got %d", getCalls)
 	}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/accessors.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/accessors.go
@@ -0,0 +1,297 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package webhook
+
+import (
+	"sync"
+
+	"k8s.io/api/admissionregistration/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	webhookutil "k8s.io/apiserver/pkg/util/webhook"
+	"k8s.io/client-go/rest"
+)
+
+// WebhookAccessor provides a common interface to both mutating and validating webhook types.
+type WebhookAccessor interface {
+	// GetUID gets a string that uniquely identifies the webhook.
+	GetUID() string
+
+	// GetConfigurationName gets the name of the webhook configuration that owns this webhook.
+	GetConfigurationName() string
+
+	// GetRESTClient gets the webhook client
+	GetRESTClient(clientManager *webhookutil.ClientManager) (*rest.RESTClient, error)
+	// GetParsedNamespaceSelector gets the webhook NamespaceSelector field.
+	GetParsedNamespaceSelector() (labels.Selector, error)
+	// GetParsedObjectSelector gets the webhook ObjectSelector field.
+	GetParsedObjectSelector() (labels.Selector, error)
+
+	// GetName gets the webhook Name field. Note that the name is scoped to the webhook
+	// configuration and does not provide a globally unique identity, if a unique identity is
+	// needed, use GetUID.
+	GetName() string
+	// GetClientConfig gets the webhook ClientConfig field.
+	GetClientConfig() v1beta1.WebhookClientConfig
+	// GetRules gets the webhook Rules field.
+	GetRules() []v1beta1.RuleWithOperations
+	// GetFailurePolicy gets the webhook FailurePolicy field.
+	GetFailurePolicy() *v1beta1.FailurePolicyType
+	// GetMatchPolicy gets the webhook MatchPolicy field.
+	GetMatchPolicy() *v1beta1.MatchPolicyType
+	// GetNamespaceSelector gets the webhook NamespaceSelector field.
+	GetNamespaceSelector() *metav1.LabelSelector
+	// GetObjectSelector gets the webhook ObjectSelector field.
+	GetObjectSelector() *metav1.LabelSelector
+	// GetSideEffects gets the webhook SideEffects field.
+	GetSideEffects() *v1beta1.SideEffectClass
+	// GetTimeoutSeconds gets the webhook TimeoutSeconds field.
+	GetTimeoutSeconds() *int32
+	// GetAdmissionReviewVersions gets the webhook AdmissionReviewVersions field.
+	GetAdmissionReviewVersions() []string
+
+	// GetMutatingWebhook if the accessor contains a MutatingWebhook, returns it and true, else returns false.
+	GetMutatingWebhook() (*v1beta1.MutatingWebhook, bool)
+	// GetValidatingWebhook if the accessor contains a ValidatingWebhook, returns it and true, else returns false.
+	GetValidatingWebhook() (*v1beta1.ValidatingWebhook, bool)
+}
+
+// NewMutatingWebhookAccessor creates an accessor for a MutatingWebhook.
+func NewMutatingWebhookAccessor(uid, configurationName string, h *v1beta1.MutatingWebhook) WebhookAccessor {
+	return &mutatingWebhookAccessor{uid: uid, configurationName: configurationName, MutatingWebhook: h}
+}
+
+type mutatingWebhookAccessor struct {
+	*v1beta1.MutatingWebhook
+	uid               string
+	configurationName string
+
+	initObjectSelector sync.Once
+	objectSelector     labels.Selector
+	objectSelectorErr  error
+
+	initNamespaceSelector sync.Once
+	namespaceSelector     labels.Selector
+	namespaceSelectorErr  error
+
+	initClient sync.Once
+	client     *rest.RESTClient
+	clientErr  error
+}
+
+func (m *mutatingWebhookAccessor) GetUID() string {
+	return m.uid
+}
+
+func (m *mutatingWebhookAccessor) GetConfigurationName() string {
+	return m.configurationName
+}
+
+func (m *mutatingWebhookAccessor) GetRESTClient(clientManager *webhookutil.ClientManager) (*rest.RESTClient, error) {
+	m.initClient.Do(func() {
+		m.client, m.clientErr = clientManager.HookClient(hookClientConfigForWebhook(m))
+	})
+	return m.client, m.clientErr
+}
+
+func (m *mutatingWebhookAccessor) GetParsedNamespaceSelector() (labels.Selector, error) {
+	m.initNamespaceSelector.Do(func() {
+		m.namespaceSelector, m.namespaceSelectorErr = metav1.LabelSelectorAsSelector(m.NamespaceSelector)
+	})
+	return m.namespaceSelector, m.namespaceSelectorErr
+}
+
+func (m *mutatingWebhookAccessor) GetParsedObjectSelector() (labels.Selector, error) {
+	m.initObjectSelector.Do(func() {
+		m.objectSelector, m.objectSelectorErr = metav1.LabelSelectorAsSelector(m.ObjectSelector)
+	})
+	return m.objectSelector, m.objectSelectorErr
+}
+
+func (m *mutatingWebhookAccessor) GetName() string {
+	return m.Name
+}
+
+func (m *mutatingWebhookAccessor) GetClientConfig() v1beta1.WebhookClientConfig {
+	return m.ClientConfig
+}
+
+func (m *mutatingWebhookAccessor) GetRules() []v1beta1.RuleWithOperations {
+	return m.Rules
+}
+
+func (m *mutatingWebhookAccessor) GetFailurePolicy() *v1beta1.FailurePolicyType {
+	return m.FailurePolicy
+}
+
+func (m *mutatingWebhookAccessor) GetMatchPolicy() *v1beta1.MatchPolicyType {
+	return m.MatchPolicy
+}
+
+func (m *mutatingWebhookAccessor) GetNamespaceSelector() *metav1.LabelSelector {
+	return m.NamespaceSelector
+}
+
+func (m *mutatingWebhookAccessor) GetObjectSelector() *metav1.LabelSelector {
+	return m.ObjectSelector
+}
+
+func (m *mutatingWebhookAccessor) GetSideEffects() *v1beta1.SideEffectClass {
+	return m.SideEffects
+}
+
+func (m *mutatingWebhookAccessor) GetTimeoutSeconds() *int32 {
+	return m.TimeoutSeconds
+}
+
+func (m *mutatingWebhookAccessor) GetAdmissionReviewVersions() []string {
+	return m.AdmissionReviewVersions
+}
+
+func (m *mutatingWebhookAccessor) GetMutatingWebhook() (*v1beta1.MutatingWebhook, bool) {
+	return m.MutatingWebhook, true
+}
+
+func (m *mutatingWebhookAccessor) GetValidatingWebhook() (*v1beta1.ValidatingWebhook, bool) {
+	return nil, false
+}
+
+// NewValidatingWebhookAccessor creates an accessor for a ValidatingWebhook.
+func NewValidatingWebhookAccessor(uid, configurationName string, h *v1beta1.ValidatingWebhook) WebhookAccessor {
+	return &validatingWebhookAccessor{uid: uid, configurationName: configurationName, ValidatingWebhook: h}
+}
+
+type validatingWebhookAccessor struct {
+	*v1beta1.ValidatingWebhook
+	uid               string
+	configurationName string
+
+	initObjectSelector sync.Once
+	objectSelector     labels.Selector
+	objectSelectorErr  error
+
+	initNamespaceSelector sync.Once
+	namespaceSelector     labels.Selector
+	namespaceSelectorErr  error
+
+	initClient sync.Once
+	client     *rest.RESTClient
+	clientErr  error
+}
+
+func (v *validatingWebhookAccessor) GetUID() string {
+	return v.uid
+}
+
+func (v *validatingWebhookAccessor) GetConfigurationName() string {
+	return v.configurationName
+}
+
+func (v *validatingWebhookAccessor) GetRESTClient(clientManager *webhookutil.ClientManager) (*rest.RESTClient, error) {
+	v.initClient.Do(func() {
+		v.client, v.clientErr = clientManager.HookClient(hookClientConfigForWebhook(v))
+	})
+	return v.client, v.clientErr
+}
+
+func (v *validatingWebhookAccessor) GetParsedNamespaceSelector() (labels.Selector, error) {
+	v.initNamespaceSelector.Do(func() {
+		v.namespaceSelector, v.namespaceSelectorErr = metav1.LabelSelectorAsSelector(v.NamespaceSelector)
+	})
+	return v.namespaceSelector, v.namespaceSelectorErr
+}
+
+func (v *validatingWebhookAccessor) GetParsedObjectSelector() (labels.Selector, error) {
+	v.initObjectSelector.Do(func() {
+		v.objectSelector, v.objectSelectorErr = metav1.LabelSelectorAsSelector(v.ObjectSelector)
+	})
+	return v.objectSelector, v.objectSelectorErr
+}
+
+func (v *validatingWebhookAccessor) GetName() string {
+	return v.Name
+}
+
+func (v *validatingWebhookAccessor) GetClientConfig() v1beta1.WebhookClientConfig {
+	return v.ClientConfig
+}
+
+func (v *validatingWebhookAccessor) GetRules() []v1beta1.RuleWithOperations {
+	return v.Rules
+}
+
+func (v *validatingWebhookAccessor) GetFailurePolicy() *v1beta1.FailurePolicyType {
+	return v.FailurePolicy
+}
+
+func (v *validatingWebhookAccessor) GetMatchPolicy() *v1beta1.MatchPolicyType {
+	return v.MatchPolicy
+}
+
+func (v *validatingWebhookAccessor) GetNamespaceSelector() *metav1.LabelSelector {
+	return v.NamespaceSelector
+}
+
+func (v *validatingWebhookAccessor) GetObjectSelector() *metav1.LabelSelector {
+	return v.ObjectSelector
+}
+
+func (v *validatingWebhookAccessor) GetSideEffects() *v1beta1.SideEffectClass {
+	return v.SideEffects
+}
+
+func (v *validatingWebhookAccessor) GetTimeoutSeconds() *int32 {
+	return v.TimeoutSeconds
+}
+
+func (v *validatingWebhookAccessor) GetAdmissionReviewVersions() []string {
+	return v.AdmissionReviewVersions
+}
+
+func (v *validatingWebhookAccessor) GetMutatingWebhook() (*v1beta1.MutatingWebhook, bool) {
+	return nil, false
+}
+
+func (v *validatingWebhookAccessor) GetValidatingWebhook() (*v1beta1.ValidatingWebhook, bool) {
+	return v.ValidatingWebhook, true
+}
+
+// hookClientConfigForWebhook construct a webhookutil.ClientConfig using a WebhookAccessor to access
+// v1beta1.MutatingWebhook and v1beta1.ValidatingWebhook API objects.  webhookutil.ClientConfig is used
+// to create a HookClient and the purpose of the config struct is to share that with other packages
+// that need to create a HookClient.
+func hookClientConfigForWebhook(w WebhookAccessor) webhookutil.ClientConfig {
+	ret := webhookutil.ClientConfig{Name: w.GetName(), CABundle: w.GetClientConfig().CABundle}
+	if w.GetClientConfig().URL != nil {
+		ret.URL = *w.GetClientConfig().URL
+	}
+	if w.GetClientConfig().Service != nil {
+		ret.Service = &webhookutil.ClientConfigService{
+			Name:      w.GetClientConfig().Service.Name,
+			Namespace: w.GetClientConfig().Service.Namespace,
+		}
+		if w.GetClientConfig().Service.Port != nil {
+			ret.Service.Port = *w.GetClientConfig().Service.Port
+		} else {
+			ret.Service.Port = 443
+		}
+		if w.GetClientConfig().Service.Path != nil {
+			ret.Service.Path = *w.GetClientConfig().Service.Path
+		}
+	}
+	return ret
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/accessors_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/accessors_test.go
@@ -0,0 +1,111 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package webhook
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+
+	fuzz "github.com/google/gofuzz"
+	"k8s.io/api/admissionregistration/v1beta1"
+	"k8s.io/apimachinery/pkg/util/diff"
+)
+
+func TestMutatingWebhookAccessor(t *testing.T) {
+	f := fuzz.New()
+	for i := 0; i < 100; i++ {
+		t.Run(fmt.Sprintf("Run %d/100", i), func(t *testing.T) {
+			orig := &v1beta1.MutatingWebhook{}
+			f.Fuzz(orig)
+
+			// zero out any accessor type specific fields not included in the accessor
+			orig.ReinvocationPolicy = nil
+
+			uid := fmt.Sprintf("test.configuration.admission/%s/0", orig.Name)
+			accessor := NewMutatingWebhookAccessor(uid, "test.configuration.admission", orig)
+			if uid != accessor.GetUID() {
+				t.Errorf("expected GetUID to return %s, but got %s", accessor.GetUID(), uid)
+			}
+			m, ok := accessor.GetMutatingWebhook()
+			if !ok {
+				t.Errorf("expected GetMutatingWebhook to return ok for mutating webhook accessor")
+			}
+			if !reflect.DeepEqual(orig, m) {
+				t.Errorf("expected GetMutatingWebhook to return original webhook, diff:\n%s", diff.ObjectReflectDiff(orig, m))
+			}
+			if _, ok := accessor.GetValidatingWebhook(); ok {
+				t.Errorf("expected GetValidatingWebhook to be nil for mutating webhook accessor")
+			}
+			copy := &v1beta1.MutatingWebhook{
+				Name:                    accessor.GetName(),
+				ClientConfig:            accessor.GetClientConfig(),
+				Rules:                   accessor.GetRules(),
+				FailurePolicy:           accessor.GetFailurePolicy(),
+				MatchPolicy:             accessor.GetMatchPolicy(),
+				NamespaceSelector:       accessor.GetNamespaceSelector(),
+				ObjectSelector:          accessor.GetObjectSelector(),
+				SideEffects:             accessor.GetSideEffects(),
+				TimeoutSeconds:          accessor.GetTimeoutSeconds(),
+				AdmissionReviewVersions: accessor.GetAdmissionReviewVersions(),
+			}
+			if !reflect.DeepEqual(orig, copy) {
+				t.Errorf("expected mutatingWebhook to round trip through WebhookAccessor, diff:\n%s", diff.ObjectReflectDiff(orig, copy))
+			}
+		})
+	}
+}
+
+func TestValidatingWebhookAccessor(t *testing.T) {
+	f := fuzz.New()
+	for i := 0; i < 100; i++ {
+		t.Run(fmt.Sprintf("Run %d/100", i), func(t *testing.T) {
+			orig := &v1beta1.ValidatingWebhook{}
+			f.Fuzz(orig)
+			uid := fmt.Sprintf("test.configuration.admission/%s/0", orig.Name)
+			accessor := NewValidatingWebhookAccessor(uid, "test.configuration.admission", orig)
+			if uid != accessor.GetUID() {
+				t.Errorf("expected GetUID to return %s, but got %s", accessor.GetUID(), uid)
+			}
+			m, ok := accessor.GetValidatingWebhook()
+			if !ok {
+				t.Errorf("expected GetValidatingWebhook to return ok for validating webhook accessor")
+			}
+			if !reflect.DeepEqual(orig, m) {
+				t.Errorf("expected GetValidatingWebhook to return original webhook, diff:\n%s", diff.ObjectReflectDiff(orig, m))
+			}
+			if _, ok := accessor.GetMutatingWebhook(); ok {
+				t.Errorf("expected GetMutatingWebhook to be nil for validating webhook accessor")
+			}
+			copy := &v1beta1.ValidatingWebhook{
+				Name:                    accessor.GetName(),
+				ClientConfig:            accessor.GetClientConfig(),
+				Rules:                   accessor.GetRules(),
+				FailurePolicy:           accessor.GetFailurePolicy(),
+				MatchPolicy:             accessor.GetMatchPolicy(),
+				NamespaceSelector:       accessor.GetNamespaceSelector(),
+				ObjectSelector:          accessor.GetObjectSelector(),
+				SideEffects:             accessor.GetSideEffects(),
+				TimeoutSeconds:          accessor.GetTimeoutSeconds(),
+				AdmissionReviewVersions: accessor.GetAdmissionReviewVersions(),
+			}
+			if !reflect.DeepEqual(orig, copy) {
+				t.Errorf("expected validatingWebhook to round trip through WebhookAccessor, diff:\n%s", diff.ObjectReflectDiff(orig, copy))
+			}
+		})
+	}
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/BUILD
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/BUILD
@@ -1,60 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-
-go_library(
-    name = "go_default_library",
-    srcs = [
-        "authentication.go",
-        "client.go",
-        "kubeconfig.go",
-        "serviceresolver.go",
-    ],
-    importpath = "k8s.io/apiserver/pkg/admission/plugin/webhook/config",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//vendor/github.com/hashicorp/golang-lru:go_default_library",
-        "//vendor/k8s.io/api/admissionregistration/v1beta1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime/serializer:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/errors:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/validation/field:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/v1alpha1:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/errors:go_default_library",
-        "//vendor/k8s.io/client-go/rest:go_default_library",
-        "//vendor/k8s.io/client-go/tools/clientcmd:go_default_library",
-        "//vendor/k8s.io/client-go/tools/clientcmd/api:go_default_library",
-    ],
-)
-
-go_test(
-    name = "go_default_test",
-    srcs = [
-        "authentication_test.go",
-        "serviceresolver_test.go",
-    ],
-    importpath = "k8s.io/apiserver/pkg/admission/plugin/webhook/config",
-    library = ":go_default_library",
-    deps = [
-        "//vendor/k8s.io/apimachinery/pkg/api/equality:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/diff:go_default_library",
-        "//vendor/k8s.io/client-go/rest:go_default_library",
-        "//vendor/k8s.io/client-go/tools/clientcmd/api:go_default_library",
-    ],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [
-        ":package-srcs",
-        "//staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission:all-srcs",
-    ],
-    tags = ["automanaged"],
-    visibility = ["//visibility:public"],
-)
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/BUILD
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/BUILD
@@ -1,36 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-
-go_library(
-    name = "go_default_library",
-    srcs = [
-        "doc.go",
-        "register.go",
-        "types.go",
-        "zz_generated.deepcopy.go",
-    ],
-    importpath = "k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
-    ],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [
-        ":package-srcs",
-        "//staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/install:all-srcs",
-        "//staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/v1alpha1:all-srcs",
-    ],
-    tags = ["automanaged"],
-    visibility = ["//visibility:public"],
-)
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/install/BUILD
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/install/BUILD
@@ -1,29 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-
-go_library(
-    name = "go_default_library",
-    srcs = ["install.go"],
-    importpath = "k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/install",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//vendor/k8s.io/apimachinery/pkg/apimachinery/announced:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/apimachinery/registered:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/v1alpha1:go_default_library",
-    ],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-    visibility = ["//visibility:public"],
-)
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/install/install.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/install/install.go
@@ -19,25 +19,15 @@ limitations under the License.
 package install

 import (
-	"k8s.io/apimachinery/pkg/apimachinery/announced"
-	"k8s.io/apimachinery/pkg/apimachinery/registered"
 	"k8s.io/apimachinery/pkg/runtime"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	"k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission"
 	"k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/v1alpha1"
 )

 // Install registers the API group and adds types to a scheme
-func Install(groupFactoryRegistry announced.APIGroupFactoryRegistry, registry *registered.APIRegistrationManager, scheme *runtime.Scheme) {
-	if err := announced.NewGroupMetaFactory(
-		&announced.GroupMetaFactoryArgs{
-			GroupName:                  webhookadmission.GroupName,
-			VersionPreferenceOrder:     []string{v1alpha1.SchemeGroupVersion.Version},
-			AddInternalObjectsToScheme: webhookadmission.AddToScheme,
-		},
-		announced.VersionToSchemeFunc{
-			v1alpha1.SchemeGroupVersion.Version: v1alpha1.AddToScheme,
-		},
-	).Announce(groupFactoryRegistry).RegisterAndEnable(registry, scheme); err != nil {
-		panic(err)
-	}
+func Install(scheme *runtime.Scheme) {
+	utilruntime.Must(webhookadmission.AddToScheme(scheme))
+	utilruntime.Must(v1alpha1.AddToScheme(scheme))
+	utilruntime.Must(scheme.SetVersionPriority(v1alpha1.SchemeGroupVersion))
 }
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/v1alpha1/BUILD
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/v1alpha1/BUILD
@@ -1,36 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-
-go_library(
-    name = "go_default_library",
-    srcs = [
-        "doc.go",
-        "register.go",
-        "types.go",
-        "zz_generated.conversion.go",
-        "zz_generated.deepcopy.go",
-        "zz_generated.defaults.go",
-    ],
-    importpath = "k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/v1alpha1",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/conversion:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission:go_default_library",
-    ],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-    visibility = ["//visibility:public"],
-)
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/v1alpha1/doc.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/v1alpha1/doc.go
@@ -17,7 +17,7 @@ limitations under the License.
 // +k8s:deepcopy-gen=package
 // +k8s:conversion-gen=k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission
 // +k8s:defaulter-gen=TypeMeta
+// +groupName=apiserver.config.k8s.io

 // Package v1alpha1 is the v1alpha1 version of the API.
-// +groupName=apiserver.config.k8s.io
 package v1alpha1
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/v1alpha1/zz_generated.conversion.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/v1alpha1/zz_generated.conversion.go
@@ -1,7 +1,7 @@
 // +build !ignore_autogenerated

 /*
-Copyright 2017 The Kubernetes Authors.
+Copyright The Kubernetes Authors.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-// This file was autogenerated by conversion-gen. Do not edit it manually!
+// Code generated by conversion-gen. DO NOT EDIT.

 package v1alpha1

@@ -32,11 +32,18 @@ func init() {

 // RegisterConversions adds conversion functions to the given scheme.
 // Public to allow building arbitrary schemes.
-func RegisterConversions(scheme *runtime.Scheme) error {
-	return scheme.AddGeneratedConversionFuncs(
-		Convert_v1alpha1_WebhookAdmission_To_webhookadmission_WebhookAdmission,
-		Convert_webhookadmission_WebhookAdmission_To_v1alpha1_WebhookAdmission,
-	)
+func RegisterConversions(s *runtime.Scheme) error {
+	if err := s.AddGeneratedConversionFunc((*WebhookAdmission)(nil), (*webhookadmission.WebhookAdmission)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1alpha1_WebhookAdmission_To_webhookadmission_WebhookAdmission(a.(*WebhookAdmission), b.(*webhookadmission.WebhookAdmission), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*webhookadmission.WebhookAdmission)(nil), (*WebhookAdmission)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_webhookadmission_WebhookAdmission_To_v1alpha1_WebhookAdmission(a.(*webhookadmission.WebhookAdmission), b.(*WebhookAdmission), scope)
+	}); err != nil {
+		return err
+	}
+	return nil
 }

 func autoConvert_v1alpha1_WebhookAdmission_To_webhookadmission_WebhookAdmission(in *WebhookAdmission, out *webhookadmission.WebhookAdmission, s conversion.Scope) error {
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/v1alpha1/zz_generated.deepcopy.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/v1alpha1/zz_generated.deepcopy.go
@@ -1,7 +1,7 @@
 // +build !ignore_autogenerated

 /*
-Copyright 2017 The Kubernetes Authors.
+Copyright The Kubernetes Authors.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-// This file was autogenerated by deepcopy-gen. Do not edit it manually!
+// Code generated by deepcopy-gen. DO NOT EDIT.

 package v1alpha1

@@ -45,7 +45,6 @@ func (in *WebhookAdmission) DeepCopy() *WebhookAdmission {
 func (in *WebhookAdmission) DeepCopyObject() runtime.Object {
 	if c := in.DeepCopy(); c != nil {
 		return c
-	} else {
-		return nil
 	}
+	return nil
 }
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/v1alpha1/zz_generated.defaults.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/v1alpha1/zz_generated.defaults.go
@@ -1,7 +1,7 @@
 // +build !ignore_autogenerated

 /*
-Copyright 2017 The Kubernetes Authors.
+Copyright The Kubernetes Authors.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-// This file was autogenerated by defaulter-gen. Do not edit it manually!
+// Code generated by defaulter-gen. DO NOT EDIT.

 package v1alpha1

--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/zz_generated.deepcopy.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/zz_generated.deepcopy.go
@@ -1,7 +1,7 @@
 // +build !ignore_autogenerated

 /*
-Copyright 2017 The Kubernetes Authors.
+Copyright The Kubernetes Authors.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-// This file was autogenerated by deepcopy-gen. Do not edit it manually!
+// Code generated by deepcopy-gen. DO NOT EDIT.

 package webhookadmission

@@ -45,7 +45,6 @@ func (in *WebhookAdmission) DeepCopy() *WebhookAdmission {
 func (in *WebhookAdmission) DeepCopyObject() runtime.Object {
 	if c := in.DeepCopy(); c != nil {
 		return c
-	} else {
-		return nil
 	}
+	return nil
 }
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/client.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/client.go
@@ -1,175 +0,0 @@
-/*
-Copyright 2017 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package config
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net"
-	"net/url"
-
-	lru "github.com/hashicorp/golang-lru"
-	"k8s.io/api/admissionregistration/v1beta1"
-	"k8s.io/apimachinery/pkg/runtime"
-	utilerrors "k8s.io/apimachinery/pkg/util/errors"
-	webhookerrors "k8s.io/apiserver/pkg/admission/plugin/webhook/errors"
-	"k8s.io/client-go/rest"
-)
-
-const (
-	defaultCacheSize = 200
-)
-
-var (
-	ErrNeedServiceOrURL = errors.New("webhook configuration must have either service or URL")
-)
-
-// ClientManager builds REST clients to talk to webhooks. It caches the clients
-// to avoid duplicate creation.
-type ClientManager struct {
-	authInfoResolver     AuthenticationInfoResolver
-	serviceResolver      ServiceResolver
-	negotiatedSerializer runtime.NegotiatedSerializer
-	cache                *lru.Cache
-}
-
-// NewClientManager creates a ClientManager.
-func NewClientManager() (ClientManager, error) {
-	cache, err := lru.New(defaultCacheSize)
-	if err != nil {
-		return ClientManager{}, err
-	}
-	return ClientManager{
-		cache: cache,
-	}, nil
-}
-
-// SetAuthenticationInfoResolverWrapper sets the
-// AuthenticationInfoResolverWrapper.
-func (cm *ClientManager) SetAuthenticationInfoResolverWrapper(wrapper AuthenticationInfoResolverWrapper) {
-	if wrapper != nil {
-		cm.authInfoResolver = wrapper(cm.authInfoResolver)
-	}
-}
-
-// SetAuthenticationInfoResolver sets the AuthenticationInfoResolver.
-func (cm *ClientManager) SetAuthenticationInfoResolver(resolver AuthenticationInfoResolver) {
-	cm.authInfoResolver = resolver
-}
-
-// SetServiceResolver sets the ServiceResolver.
-func (cm *ClientManager) SetServiceResolver(sr ServiceResolver) {
-	if sr != nil {
-		cm.serviceResolver = sr
-	}
-}
-
-// SetNegotiatedSerializer sets the NegotiatedSerializer.
-func (cm *ClientManager) SetNegotiatedSerializer(n runtime.NegotiatedSerializer) {
-	cm.negotiatedSerializer = n
-}
-
-// Validate checks if ClientManager is properly set up.
-func (cm *ClientManager) Validate() error {
-	var errs []error
-	if cm.negotiatedSerializer == nil {
-		errs = append(errs, fmt.Errorf("the ClientManager requires a negotiatedSerializer"))
-	}
-	if cm.serviceResolver == nil {
-		errs = append(errs, fmt.Errorf("the ClientManager requires a serviceResolver"))
-	}
-	if cm.authInfoResolver == nil {
-		errs = append(errs, fmt.Errorf("the ClientManager requires an authInfoResolver"))
-	}
-	return utilerrors.NewAggregate(errs)
-}
-
-// HookClient get a RESTClient from the cache, or constructs one based on the
-// webhook configuration.
-func (cm *ClientManager) HookClient(h *v1beta1.Webhook) (*rest.RESTClient, error) {
-	cacheKey, err := json.Marshal(h.ClientConfig)
-	if err != nil {
-		return nil, err
-	}
-	if client, ok := cm.cache.Get(string(cacheKey)); ok {
-		return client.(*rest.RESTClient), nil
-	}
-
-	complete := func(cfg *rest.Config) (*rest.RESTClient, error) {
-		cfg.TLSClientConfig.CAData = h.ClientConfig.CABundle
-		cfg.ContentConfig.NegotiatedSerializer = cm.negotiatedSerializer
-		cfg.ContentConfig.ContentType = runtime.ContentTypeJSON
-		client, err := rest.UnversionedRESTClientFor(cfg)
-		if err == nil {
-			cm.cache.Add(string(cacheKey), client)
-		}
-		return client, err
-	}
-
-	if svc := h.ClientConfig.Service; svc != nil {
-		serverName := svc.Name + "." + svc.Namespace + ".svc"
-		restConfig, err := cm.authInfoResolver.ClientConfigFor(serverName)
-		if err != nil {
-			return nil, err
-		}
-		cfg := rest.CopyConfig(restConfig)
-		host := serverName + ":443"
-		cfg.Host = "https://" + host
-		if svc.Path != nil {
-			cfg.APIPath = *svc.Path
-		}
-		cfg.TLSClientConfig.ServerName = serverName
-
-		delegateDialer := cfg.Dial
-		if delegateDialer == nil {
-			delegateDialer = net.Dial
-		}
-		cfg.Dial = func(network, addr string) (net.Conn, error) {
-			if addr == host {
-				u, err := cm.serviceResolver.ResolveEndpoint(svc.Namespace, svc.Name)
-				if err != nil {
-					return nil, err
-				}
-				addr = u.Host
-			}
-			return delegateDialer(network, addr)
-		}
-
-		return complete(cfg)
-	}
-
-	if h.ClientConfig.URL == nil {
-		return nil, &webhookerrors.ErrCallingWebhook{WebhookName: h.Name, Reason: ErrNeedServiceOrURL}
-	}
-
-	u, err := url.Parse(*h.ClientConfig.URL)
-	if err != nil {
-		return nil, &webhookerrors.ErrCallingWebhook{WebhookName: h.Name, Reason: fmt.Errorf("Unparsable URL: %v", err)}
-	}
-
-	restConfig, err := cm.authInfoResolver.ClientConfigFor(u.Host)
-	if err != nil {
-		return nil, err
-	}
-
-	cfg := rest.CopyConfig(restConfig)
-	cfg.Host = u.Host
-	cfg.APIPath = u.Path
-
-	return complete(cfg)
-}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/kubeconfig.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/kubeconfig.go
@@ -24,6 +24,7 @@ import (

 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	"k8s.io/apimachinery/pkg/util/validation/field"
 	"k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission"
 	"k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/v1alpha1"
@@ -35,8 +36,8 @@ var (
 )

 func init() {
-	webhookadmission.AddToScheme(scheme)
-	v1alpha1.AddToScheme(scheme)
+	utilruntime.Must(webhookadmission.AddToScheme(scheme))
+	utilruntime.Must(v1alpha1.AddToScheme(scheme))
 }

 // LoadConfig extract the KubeConfigFile from configFile
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/errors/BUILD
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/errors/BUILD
@@ -1,38 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-
-go_library(
-    name = "go_default_library",
-    srcs = [
-        "doc.go",
-        "errors.go",
-        "statuserror.go",
-    ],
-    importpath = "k8s.io/apiserver/pkg/admission/plugin/webhook/errors",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
-    ],
-)
-
-go_test(
-    name = "go_default_test",
-    srcs = ["statuserror_test.go"],
-    importpath = "k8s.io/apiserver/pkg/admission/plugin/webhook/errors",
-    library = ":go_default_library",
-    deps = ["//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library"],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-    visibility = ["//visibility:public"],
-)
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/errors/statuserror.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/errors/statuserror.go
@@ -18,6 +18,7 @@ package errors

 import (
 	"fmt"
+	"net/http"

 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -32,6 +33,15 @@ func ToStatusErr(webhookName string, result *metav1.Status) *apierrors.StatusErr
 		result = &metav1.Status{Status: metav1.StatusFailure}
 	}

+	// Make sure we don't return < 400 status codes along with a rejection
+	if result.Code < http.StatusBadRequest {
+		result.Code = http.StatusBadRequest
+	}
+	// Make sure we don't return "" or "Success" status along with a rejection
+	if result.Status == "" || result.Status == metav1.StatusSuccess {
+		result.Status = metav1.StatusFailure
+	}
+
 	switch {
 	case len(result.Message) > 0:
 		result.Message = fmt.Sprintf("%s: %s", deniedBy, result.Message)
@@ -45,3 +55,9 @@ func ToStatusErr(webhookName string, result *metav1.Status) *apierrors.StatusErr
 		ErrStatus: *result,
 	}
 }
+
+// NewDryRunUnsupportedErr returns a StatusError with information about the webhook plugin
+func NewDryRunUnsupportedErr(webhookName string) *apierrors.StatusError {
+	reason := fmt.Sprintf("admission webhook %q does not support dry run", webhookName)
+	return apierrors.NewBadRequest(reason)
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/errors/statuserror_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/errors/statuserror_test.go
@@ -27,14 +27,18 @@ func TestToStatusErr(t *testing.T) {
 	hookName := "foo"
 	deniedBy := fmt.Sprintf("admission webhook %q denied the request", hookName)
 	tests := []struct {
-		name          string
-		result        *metav1.Status
-		expectedError string
+		name           string
+		result         *metav1.Status
+		expectedError  string
+		expectedCode   int32
+		expectedStatus string
 	}{
 		{
 			"nil result",
 			nil,
 			deniedBy + " without explanation",
+			400,
+			metav1.StatusFailure,
 		},
 		{
 			"only message",
@@ -42,6 +46,8 @@ func TestToStatusErr(t *testing.T) {
 				Message: "you shall not pass",
 			},
 			deniedBy + ": you shall not pass",
+			400,
+			metav1.StatusFailure,
 		},
 		{
 			"only reason",
@@ -49,6 +55,8 @@ func TestToStatusErr(t *testing.T) {
 				Reason: metav1.StatusReasonForbidden,
 			},
 			deniedBy + ": Forbidden",
+			400,
+			metav1.StatusFailure,
 		},
 		{
 			"message and reason",
@@ -57,11 +65,78 @@ func TestToStatusErr(t *testing.T) {
 				Reason:  metav1.StatusReasonForbidden,
 			},
 			deniedBy + ": you shall not pass",
+			400,
+			metav1.StatusFailure,
 		},
 		{
 			"no message, no reason",
 			&metav1.Status{},
 			deniedBy + " without explanation",
+			400,
+			metav1.StatusFailure,
+		},
+		{
+			"custom 4xx status code",
+			&metav1.Status{Code: 401},
+			deniedBy + " without explanation",
+			401,
+			metav1.StatusFailure,
+		},
+		{
+			"custom 5xx status code",
+			&metav1.Status{Code: 500},
+			deniedBy + " without explanation",
+			500,
+			metav1.StatusFailure,
+		},
+		{
+			"200 status code",
+			&metav1.Status{Code: 200},
+			deniedBy + " without explanation",
+			400,
+			metav1.StatusFailure,
+		},
+		{
+			"300 status code",
+			&metav1.Status{Code: 300},
+			deniedBy + " without explanation",
+			400,
+			metav1.StatusFailure,
+		},
+		{
+			"399 status code",
+			&metav1.Status{Code: 399},
+			deniedBy + " without explanation",
+			400,
+			metav1.StatusFailure,
+		},
+		{
+			"missing status",
+			&metav1.Status{},
+			deniedBy + " without explanation",
+			400,
+			metav1.StatusFailure,
+		},
+		{
+			"success status overridden",
+			&metav1.Status{Status: metav1.StatusSuccess},
+			deniedBy + " without explanation",
+			400,
+			metav1.StatusFailure,
+		},
+		{
+			"failure status preserved",
+			&metav1.Status{Status: metav1.StatusFailure},
+			deniedBy + " without explanation",
+			400,
+			metav1.StatusFailure,
+		},
+		{
+			"custom status preserved",
+			&metav1.Status{Status: "custom"},
+			deniedBy + " without explanation",
+			400,
+			"custom",
 		},
 	}
 	for _, test := range tests {
@@ -69,5 +144,11 @@ func TestToStatusErr(t *testing.T) {
 		if err == nil || err.Error() != test.expectedError {
 			t.Errorf("%s: expected an error saying %q, but got %v", test.name, test.expectedError, err)
 		}
+		if err.ErrStatus.Code != test.expectedCode {
+			t.Errorf("%s: expected code %d, got %d", test.name, test.expectedCode, err.ErrStatus.Code)
+		}
+		if err.ErrStatus.Status != test.expectedStatus {
+			t.Errorf("%s: expected code %q, got %q", test.name, test.expectedStatus, err.ErrStatus.Status)
+		}
 	}
 }
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/generic/conversion.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/generic/conversion.go
@@ -0,0 +1,112 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generic
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apiserver/pkg/admission"
+)
+
+// ConvertToGVK converts object to the desired gvk.
+func ConvertToGVK(obj runtime.Object, gvk schema.GroupVersionKind, o admission.ObjectInterfaces) (runtime.Object, error) {
+	// Unlike other resources, custom resources do not have internal version, so
+	// if obj is a custom resource, it should not need conversion.
+	if obj.GetObjectKind().GroupVersionKind() == gvk {
+		return obj, nil
+	}
+	out, err := o.GetObjectCreater().New(gvk)
+	if err != nil {
+		return nil, err
+	}
+	err = o.GetObjectConvertor().Convert(obj, out, nil)
+	if err != nil {
+		return nil, err
+	}
+	// Explicitly set the GVK
+	out.GetObjectKind().SetGroupVersionKind(gvk)
+	return out, nil
+}
+
+// NewVersionedAttributes returns versioned attributes with the old and new object (if non-nil) converted to the requested kind
+func NewVersionedAttributes(attr admission.Attributes, gvk schema.GroupVersionKind, o admission.ObjectInterfaces) (*VersionedAttributes, error) {
+	// convert the old and new objects to the requested version
+	versionedAttr := &VersionedAttributes{
+		Attributes:    attr,
+		VersionedKind: gvk,
+	}
+	if oldObj := attr.GetOldObject(); oldObj != nil {
+		out, err := ConvertToGVK(oldObj, gvk, o)
+		if err != nil {
+			return nil, err
+		}
+		versionedAttr.VersionedOldObject = out
+	}
+	if obj := attr.GetObject(); obj != nil {
+		out, err := ConvertToGVK(obj, gvk, o)
+		if err != nil {
+			return nil, err
+		}
+		versionedAttr.VersionedObject = out
+	}
+	return versionedAttr, nil
+}
+
+// ConvertVersionedAttributes converts VersionedObject and VersionedOldObject to the specified kind, if needed.
+// If attr.VersionedKind already matches the requested kind, no conversion is performed.
+// If conversion is required:
+// * attr.VersionedObject is used as the source for the new object if Dirty=true (and is round-tripped through attr.Attributes.Object, clearing Dirty in the process)
+// * attr.Attributes.Object is used as the source for the new object if Dirty=false
+// * attr.Attributes.OldObject is used as the source for the old object
+func ConvertVersionedAttributes(attr *VersionedAttributes, gvk schema.GroupVersionKind, o admission.ObjectInterfaces) error {
+	// we already have the desired kind, we're done
+	if attr.VersionedKind == gvk {
+		return nil
+	}
+
+	// convert the original old object to the desired GVK
+	if oldObj := attr.Attributes.GetOldObject(); oldObj != nil {
+		out, err := ConvertToGVK(oldObj, gvk, o)
+		if err != nil {
+			return err
+		}
+		attr.VersionedOldObject = out
+	}
+
+	if attr.VersionedObject != nil {
+		// convert the existing versioned object to internal
+		if attr.Dirty {
+			err := o.GetObjectConvertor().Convert(attr.VersionedObject, attr.Attributes.GetObject(), nil)
+			if err != nil {
+				return err
+			}
+		}
+
+		// and back to external
+		out, err := ConvertToGVK(attr.Attributes.GetObject(), gvk, o)
+		if err != nil {
+			return err
+		}
+		attr.VersionedObject = out
+	}
+
+	// Remember we converted to this version
+	attr.VersionedKind = gvk
+	attr.Dirty = false
+
+	return nil
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/generic/conversion_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/generic/conversion_test.go
@@ -0,0 +1,364 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generic
+
+import (
+	"encoding/json"
+	"reflect"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/diff"
+	"k8s.io/apiserver/pkg/admission"
+	"k8s.io/apiserver/pkg/apis/example"
+	examplev1 "k8s.io/apiserver/pkg/apis/example/v1"
+	example2v1 "k8s.io/apiserver/pkg/apis/example2/v1"
+)
+
+func initiateScheme(t *testing.T) *runtime.Scheme {
+	s := runtime.NewScheme()
+	require.NoError(t, example.AddToScheme(s))
+	require.NoError(t, examplev1.AddToScheme(s))
+	require.NoError(t, example2v1.AddToScheme(s))
+	return s
+}
+
+func TestConvertToGVK(t *testing.T) {
+	scheme := initiateScheme(t)
+	o := admission.NewObjectInterfacesFromScheme(scheme)
+	table := map[string]struct {
+		obj         runtime.Object
+		gvk         schema.GroupVersionKind
+		expectedObj runtime.Object
+	}{
+		"convert example#Pod to example/v1#Pod": {
+			obj: &example.Pod{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "pod1",
+					Labels: map[string]string{
+						"key": "value",
+					},
+				},
+				Spec: example.PodSpec{
+					RestartPolicy: example.RestartPolicy("never"),
+				},
+			},
+			gvk: examplev1.SchemeGroupVersion.WithKind("Pod"),
+			expectedObj: &examplev1.Pod{
+				TypeMeta: metav1.TypeMeta{
+					APIVersion: "example.apiserver.k8s.io/v1",
+					Kind:       "Pod",
+				},
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "pod1",
+					Labels: map[string]string{
+						"key": "value",
+					},
+				},
+				Spec: examplev1.PodSpec{
+					RestartPolicy: examplev1.RestartPolicy("never"),
+				},
+			},
+		},
+		"convert example#replicaset to example2/v1#replicaset": {
+			obj: &example.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "rs1",
+					Labels: map[string]string{
+						"key": "value",
+					},
+				},
+				Spec: example.ReplicaSetSpec{
+					Replicas: 1,
+				},
+			},
+			gvk: example2v1.SchemeGroupVersion.WithKind("ReplicaSet"),
+			expectedObj: &example2v1.ReplicaSet{
+				TypeMeta: metav1.TypeMeta{
+					APIVersion: "example2.apiserver.k8s.io/v1",
+					Kind:       "ReplicaSet",
+				},
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "rs1",
+					Labels: map[string]string{
+						"key": "value",
+					},
+				},
+				Spec: example2v1.ReplicaSetSpec{
+					Replicas: func() *int32 { var i int32; i = 1; return &i }(),
+				},
+			},
+		},
+		"no conversion for Unstructured object whose gvk matches the desired gvk": {
+			obj: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "mygroup.k8s.io/v1",
+					"kind":       "Flunder",
+					"data": map[string]interface{}{
+						"Key": "Value",
+					},
+				},
+			},
+			gvk: schema.GroupVersionKind{Group: "mygroup.k8s.io", Version: "v1", Kind: "Flunder"},
+			expectedObj: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "mygroup.k8s.io/v1",
+					"kind":       "Flunder",
+					"data": map[string]interface{}{
+						"Key": "Value",
+					},
+				},
+			},
+		},
+	}
+
+	for name, test := range table {
+		t.Run(name, func(t *testing.T) {
+			actual, err := ConvertToGVK(test.obj, test.gvk, o)
+			if err != nil {
+				t.Error(err)
+			}
+			if !reflect.DeepEqual(actual, test.expectedObj) {
+				t.Errorf("\nexpected:\n%#v\ngot:\n %#v\n", test.expectedObj, actual)
+			}
+		})
+	}
+}
+
+// TestRuntimeSchemeConvert verifies that scheme.Convert(x, x, nil) for an unstructured x is a no-op.
+// This did not use to be like that and we had to wrap scheme.Convert before.
+func TestRuntimeSchemeConvert(t *testing.T) {
+	scheme := initiateScheme(t)
+	obj := &unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"foo": "bar",
+		},
+	}
+	clone := obj.DeepCopy()
+
+	if err := scheme.Convert(obj, obj, nil); err != nil {
+		t.Fatalf("unexpected convert error: %v", err)
+	}
+	if !reflect.DeepEqual(obj, clone) {
+		t.Errorf("unexpected mutation of self-converted Unstructured: obj=%#v, clone=%#v", obj, clone)
+	}
+}
+
+func TestConvertVersionedAttributes(t *testing.T) {
+	scheme := initiateScheme(t)
+	o := admission.NewObjectInterfacesFromScheme(scheme)
+
+	gvk := func(g, v, k string) schema.GroupVersionKind {
+		return schema.GroupVersionKind{g, v, k}
+	}
+	attrs := func(obj, oldObj runtime.Object) admission.Attributes {
+		return admission.NewAttributesRecord(obj, oldObj, schema.GroupVersionKind{}, "", "", schema.GroupVersionResource{}, "", "", nil, false, nil)
+	}
+	u := func(data string) *unstructured.Unstructured {
+		t.Helper()
+		m := map[string]interface{}{}
+		if err := json.Unmarshal([]byte(data), &m); err != nil {
+			t.Fatal(err)
+		}
+		return &unstructured.Unstructured{Object: m}
+	}
+	testcases := []struct {
+		Name          string
+		Attrs         *VersionedAttributes
+		GVK           schema.GroupVersionKind
+		ExpectedAttrs *VersionedAttributes
+	}{
+		{
+			Name: "noop",
+			Attrs: &VersionedAttributes{
+				Attributes: attrs(
+					&example.Pod{ObjectMeta: metav1.ObjectMeta{Name: "newpod"}},
+					&example.Pod{ObjectMeta: metav1.ObjectMeta{Name: "oldpod"}},
+				),
+				VersionedObject:    &examplev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "newpodversioned"}},
+				VersionedOldObject: &examplev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "oldpodversioned"}},
+				VersionedKind:      examplev1.SchemeGroupVersion.WithKind("Pod"),
+				Dirty:              true,
+			},
+			GVK: examplev1.SchemeGroupVersion.WithKind("Pod"),
+			ExpectedAttrs: &VersionedAttributes{
+				Attributes: attrs(
+					&example.Pod{ObjectMeta: metav1.ObjectMeta{Name: "newpod"}},
+					&example.Pod{ObjectMeta: metav1.ObjectMeta{Name: "oldpod"}},
+				),
+				VersionedObject:    &examplev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "newpodversioned"}},
+				VersionedOldObject: &examplev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "oldpodversioned"}},
+				VersionedKind:      examplev1.SchemeGroupVersion.WithKind("Pod"),
+				Dirty:              true,
+			},
+		},
+		{
+			Name: "clean, typed",
+			Attrs: &VersionedAttributes{
+				Attributes: attrs(
+					&example.Pod{ObjectMeta: metav1.ObjectMeta{Name: "newpod"}},
+					&example.Pod{ObjectMeta: metav1.ObjectMeta{Name: "oldpod"}},
+				),
+				VersionedObject:    &examplev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "newpodversioned"}},
+				VersionedOldObject: &examplev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "oldpodversioned"}},
+				VersionedKind:      gvk("g", "v", "k"),
+			},
+			GVK: examplev1.SchemeGroupVersion.WithKind("Pod"),
+			ExpectedAttrs: &VersionedAttributes{
+				Attributes: attrs(
+					&example.Pod{ObjectMeta: metav1.ObjectMeta{Name: "newpod"}},
+					&example.Pod{ObjectMeta: metav1.ObjectMeta{Name: "oldpod"}},
+				),
+				// name gets overwritten from converted attributes, type gets set explicitly
+				VersionedObject:    &examplev1.Pod{TypeMeta: metav1.TypeMeta{APIVersion: "example.apiserver.k8s.io/v1", Kind: "Pod"}, ObjectMeta: metav1.ObjectMeta{Name: "newpod"}},
+				VersionedOldObject: &examplev1.Pod{TypeMeta: metav1.TypeMeta{APIVersion: "example.apiserver.k8s.io/v1", Kind: "Pod"}, ObjectMeta: metav1.ObjectMeta{Name: "oldpod"}},
+				VersionedKind:      examplev1.SchemeGroupVersion.WithKind("Pod"),
+			},
+		},
+		{
+			Name: "clean, unstructured",
+			Attrs: &VersionedAttributes{
+				Attributes: attrs(
+					u(`{"apiVersion": "mygroup.k8s.io/v1","kind": "Flunder","metadata":{"name":"newobj"}}`),
+					u(`{"apiVersion": "mygroup.k8s.io/v1","kind": "Flunder","metadata":{"name":"oldobj"}}`),
+				),
+				VersionedObject:    u(`{"apiVersion": "mygroup.k8s.io/v1","kind": "Flunder","metadata":{"name":"newobjversioned"}}`),
+				VersionedOldObject: u(`{"apiVersion": "mygroup.k8s.io/v1","kind": "Flunder","metadata":{"name":"oldobjversioned"}}`),
+				VersionedKind:      gvk("g", "v", "k"), // claim a different current version to trigger conversion
+			},
+			GVK: gvk("mygroup.k8s.io", "v1", "Flunder"),
+			ExpectedAttrs: &VersionedAttributes{
+				Attributes: attrs(
+					u(`{"apiVersion": "mygroup.k8s.io/v1","kind": "Flunder","metadata":{"name":"newobj"}}`),
+					u(`{"apiVersion": "mygroup.k8s.io/v1","kind": "Flunder","metadata":{"name":"oldobj"}}`),
+				),
+				VersionedObject:    u(`{"apiVersion": "mygroup.k8s.io/v1","kind": "Flunder","metadata":{"name":"newobj"}}`),
+				VersionedOldObject: u(`{"apiVersion": "mygroup.k8s.io/v1","kind": "Flunder","metadata":{"name":"oldobj"}}`),
+				VersionedKind:      gvk("mygroup.k8s.io", "v1", "Flunder"),
+			},
+		},
+		{
+			Name: "dirty, typed",
+			Attrs: &VersionedAttributes{
+				Attributes: attrs(
+					&example.Pod{ObjectMeta: metav1.ObjectMeta{Name: "newpod"}},
+					&example.Pod{ObjectMeta: metav1.ObjectMeta{Name: "oldpod"}},
+				),
+				VersionedObject:    &examplev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "newpodversioned"}},
+				VersionedOldObject: &examplev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "oldpodversioned"}},
+				VersionedKind:      gvk("g", "v", "k"), // claim a different current version to trigger conversion
+				Dirty:              true,
+			},
+			GVK: examplev1.SchemeGroupVersion.WithKind("Pod"),
+			ExpectedAttrs: &VersionedAttributes{
+				Attributes: attrs(
+					&example.Pod{ObjectMeta: metav1.ObjectMeta{Name: "newpodversioned"}},
+					&example.Pod{ObjectMeta: metav1.ObjectMeta{Name: "oldpod"}},
+				),
+				// new name gets preserved from versioned object, type gets set explicitly
+				VersionedObject: &examplev1.Pod{TypeMeta: metav1.TypeMeta{APIVersion: "example.apiserver.k8s.io/v1", Kind: "Pod"}, ObjectMeta: metav1.ObjectMeta{Name: "newpodversioned"}},
+				// old name gets overwritten from converted attributes, type gets set explicitly
+				VersionedOldObject: &examplev1.Pod{TypeMeta: metav1.TypeMeta{APIVersion: "example.apiserver.k8s.io/v1", Kind: "Pod"}, ObjectMeta: metav1.ObjectMeta{Name: "oldpod"}},
+				VersionedKind:      examplev1.SchemeGroupVersion.WithKind("Pod"),
+				Dirty:              false,
+			},
+		},
+		{
+			Name: "dirty, unstructured",
+			Attrs: &VersionedAttributes{
+				Attributes: attrs(
+					u(`{"apiVersion": "mygroup.k8s.io/v1","kind": "Flunder","metadata":{"name":"newobj"}}`),
+					u(`{"apiVersion": "mygroup.k8s.io/v1","kind": "Flunder","metadata":{"name":"oldobj"}}`),
+				),
+				VersionedObject:    u(`{"apiVersion": "mygroup.k8s.io/v1","kind": "Flunder","metadata":{"name":"newobjversioned"}}`),
+				VersionedOldObject: u(`{"apiVersion": "mygroup.k8s.io/v1","kind": "Flunder","metadata":{"name":"oldobjversioned"}}`),
+				VersionedKind:      gvk("g", "v", "k"), // claim a different current version to trigger conversion
+				Dirty:              true,
+			},
+			GVK: gvk("mygroup.k8s.io", "v1", "Flunder"),
+			ExpectedAttrs: &VersionedAttributes{
+				Attributes: attrs(
+					u(`{"apiVersion": "mygroup.k8s.io/v1","kind": "Flunder","metadata":{"name":"newobjversioned"}}`),
+					u(`{"apiVersion": "mygroup.k8s.io/v1","kind": "Flunder","metadata":{"name":"oldobj"}}`),
+				),
+				// new name gets preserved from versioned object, type gets set explicitly
+				VersionedObject: u(`{"apiVersion": "mygroup.k8s.io/v1","kind": "Flunder","metadata":{"name":"newobjversioned"}}`),
+				// old name gets overwritten from converted attributes, type gets set explicitly
+				VersionedOldObject: u(`{"apiVersion": "mygroup.k8s.io/v1","kind": "Flunder","metadata":{"name":"oldobj"}}`),
+				VersionedKind:      gvk("mygroup.k8s.io", "v1", "Flunder"),
+				Dirty:              false,
+			},
+		},
+		{
+			Name: "nil old object",
+			Attrs: &VersionedAttributes{
+				Attributes: attrs(
+					&example.Pod{ObjectMeta: metav1.ObjectMeta{Name: "newpod"}},
+					nil,
+				),
+				VersionedObject:    &examplev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "newpodversioned"}},
+				VersionedOldObject: nil,
+				VersionedKind:      gvk("g", "v", "k"), // claim a different current version to trigger conversion
+				Dirty:              true,
+			},
+			GVK: examplev1.SchemeGroupVersion.WithKind("Pod"),
+			ExpectedAttrs: &VersionedAttributes{
+				Attributes: attrs(
+					&example.Pod{ObjectMeta: metav1.ObjectMeta{Name: "newpodversioned"}},
+					nil,
+				),
+				// new name gets preserved from versioned object, type gets set explicitly
+				VersionedObject:    &examplev1.Pod{TypeMeta: metav1.TypeMeta{APIVersion: "example.apiserver.k8s.io/v1", Kind: "Pod"}, ObjectMeta: metav1.ObjectMeta{Name: "newpodversioned"}},
+				VersionedOldObject: nil,
+				VersionedKind:      examplev1.SchemeGroupVersion.WithKind("Pod"),
+				Dirty:              false,
+			},
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.Name, func(t *testing.T) {
+			err := ConvertVersionedAttributes(tc.Attrs, tc.GVK, o)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if e, a := tc.ExpectedAttrs.Attributes.GetObject(), tc.Attrs.Attributes.GetObject(); !reflect.DeepEqual(e, a) {
+				t.Errorf("unexpected diff:\n%s", diff.ObjectReflectDiff(e, a))
+			}
+			if e, a := tc.ExpectedAttrs.Attributes.GetOldObject(), tc.Attrs.Attributes.GetOldObject(); !reflect.DeepEqual(e, a) {
+				t.Errorf("unexpected diff:\n%s", diff.ObjectReflectDiff(e, a))
+			}
+			if e, a := tc.ExpectedAttrs.VersionedKind, tc.Attrs.VersionedKind; !reflect.DeepEqual(e, a) {
+				t.Errorf("unexpected diff:\n%s", diff.ObjectReflectDiff(e, a))
+			}
+			if e, a := tc.ExpectedAttrs.VersionedObject, tc.Attrs.VersionedObject; !reflect.DeepEqual(e, a) {
+				t.Errorf("unexpected diff:\n%s", diff.ObjectReflectDiff(e, a))
+			}
+			if e, a := tc.ExpectedAttrs.VersionedOldObject, tc.Attrs.VersionedOldObject; !reflect.DeepEqual(e, a) {
+				t.Errorf("unexpected diff:\n%s", diff.ObjectReflectDiff(e, a))
+			}
+			if e, a := tc.ExpectedAttrs.Dirty, tc.Attrs.Dirty; !reflect.DeepEqual(e, a) {
+				t.Errorf("unexpected diff:\n%s", diff.ObjectReflectDiff(e, a))
+			}
+		})
+	}
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/generic/interfaces.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/generic/interfaces.go
@@ -0,0 +1,75 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generic
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apiserver/pkg/admission"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook"
+)
+
+// Source can list dynamic webhook plugins.
+type Source interface {
+	Webhooks() []webhook.WebhookAccessor
+	HasSynced() bool
+}
+
+// VersionedAttributes is a wrapper around the original admission attributes, adding versioned
+// variants of the object and old object.
+type VersionedAttributes struct {
+	// Attributes holds the original admission attributes
+	admission.Attributes
+	// VersionedOldObject holds Attributes.OldObject (if non-nil), converted to VersionedKind.
+	// It must never be mutated.
+	VersionedOldObject runtime.Object
+	// VersionedObject holds Attributes.Object (if non-nil), converted to VersionedKind.
+	// If mutated, Dirty must be set to true by the mutator.
+	VersionedObject runtime.Object
+	// VersionedKind holds the fully qualified kind
+	VersionedKind schema.GroupVersionKind
+	// Dirty indicates VersionedObject has been modified since being converted from Attributes.Object
+	Dirty bool
+}
+
+// GetObject overrides the Attributes.GetObject()
+func (v *VersionedAttributes) GetObject() runtime.Object {
+	if v.VersionedObject != nil {
+		return v.VersionedObject
+	}
+	return v.Attributes.GetObject()
+}
+
+// WebhookInvocation describes how to call a webhook, including the resource and subresource the webhook registered for,
+// and the kind that should be sent to the webhook.
+type WebhookInvocation struct {
+	Webhook     webhook.WebhookAccessor
+	Resource    schema.GroupVersionResource
+	Subresource string
+	Kind        schema.GroupVersionKind
+}
+
+// Dispatcher dispatches webhook call to a list of webhooks with admission attributes as argument.
+type Dispatcher interface {
+	// Dispatch a request to the webhooks. Dispatcher may choose not to
+	// call a hook, either because the rules of the hook does not match, or
+	// the namespaceSelector or the objectSelector of the hook does not
+	// match. A non-nil error means the request is rejected.
+	Dispatch(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces, hooks []webhook.WebhookAccessor) error
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/generic/webhook.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/generic/webhook.go
@@ -0,0 +1,223 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generic
+
+import (
+	"context"
+	"fmt"
+	"io"
+
+	admissionv1 "k8s.io/api/admission/v1"
+	admissionv1beta1 "k8s.io/api/admission/v1beta1"
+	"k8s.io/api/admissionregistration/v1beta1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apiserver/pkg/admission"
+	genericadmissioninit "k8s.io/apiserver/pkg/admission/initializer"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook/config"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook/namespace"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook/object"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook/rules"
+	webhookutil "k8s.io/apiserver/pkg/util/webhook"
+	"k8s.io/client-go/informers"
+	clientset "k8s.io/client-go/kubernetes"
+)
+
+// Webhook is an abstract admission plugin with all the infrastructure to define Admit or Validate on-top.
+type Webhook struct {
+	*admission.Handler
+
+	sourceFactory sourceFactory
+
+	hookSource       Source
+	clientManager    *webhookutil.ClientManager
+	namespaceMatcher *namespace.Matcher
+	objectMatcher    *object.Matcher
+	dispatcher       Dispatcher
+}
+
+var (
+	_ genericadmissioninit.WantsExternalKubeClientSet = &Webhook{}
+	_ admission.Interface                             = &Webhook{}
+)
+
+type sourceFactory func(f informers.SharedInformerFactory) Source
+type dispatcherFactory func(cm *webhookutil.ClientManager) Dispatcher
+
+// NewWebhook creates a new generic admission webhook.
+func NewWebhook(handler *admission.Handler, configFile io.Reader, sourceFactory sourceFactory, dispatcherFactory dispatcherFactory) (*Webhook, error) {
+	kubeconfigFile, err := config.LoadConfig(configFile)
+	if err != nil {
+		return nil, err
+	}
+
+	cm, err := webhookutil.NewClientManager(
+		[]schema.GroupVersion{
+			admissionv1beta1.SchemeGroupVersion,
+			admissionv1.SchemeGroupVersion,
+		},
+		admissionv1beta1.AddToScheme,
+		admissionv1.AddToScheme,
+	)
+	if err != nil {
+		return nil, err
+	}
+	authInfoResolver, err := webhookutil.NewDefaultAuthenticationInfoResolver(kubeconfigFile)
+	if err != nil {
+		return nil, err
+	}
+	// Set defaults which may be overridden later.
+	cm.SetAuthenticationInfoResolver(authInfoResolver)
+	cm.SetServiceResolver(webhookutil.NewDefaultServiceResolver())
+
+	return &Webhook{
+		Handler:          handler,
+		sourceFactory:    sourceFactory,
+		clientManager:    &cm,
+		namespaceMatcher: &namespace.Matcher{},
+		objectMatcher:    &object.Matcher{},
+		dispatcher:       dispatcherFactory(&cm),
+	}, nil
+}
+
+// SetAuthenticationInfoResolverWrapper sets the
+// AuthenticationInfoResolverWrapper.
+// TODO find a better way wire this, but keep this pull small for now.
+func (a *Webhook) SetAuthenticationInfoResolverWrapper(wrapper webhookutil.AuthenticationInfoResolverWrapper) {
+	a.clientManager.SetAuthenticationInfoResolverWrapper(wrapper)
+}
+
+// SetServiceResolver sets a service resolver for the webhook admission plugin.
+// Passing a nil resolver does not have an effect, instead a default one will be used.
+func (a *Webhook) SetServiceResolver(sr webhookutil.ServiceResolver) {
+	a.clientManager.SetServiceResolver(sr)
+}
+
+// SetExternalKubeClientSet implements the WantsExternalKubeInformerFactory interface.
+// It sets external ClientSet for admission plugins that need it
+func (a *Webhook) SetExternalKubeClientSet(client clientset.Interface) {
+	a.namespaceMatcher.Client = client
+}
+
+// SetExternalKubeInformerFactory implements the WantsExternalKubeInformerFactory interface.
+func (a *Webhook) SetExternalKubeInformerFactory(f informers.SharedInformerFactory) {
+	namespaceInformer := f.Core().V1().Namespaces()
+	a.namespaceMatcher.NamespaceLister = namespaceInformer.Lister()
+	a.hookSource = a.sourceFactory(f)
+	a.SetReadyFunc(func() bool {
+		return namespaceInformer.Informer().HasSynced() && a.hookSource.HasSynced()
+	})
+}
+
+// ValidateInitialization implements the InitializationValidator interface.
+func (a *Webhook) ValidateInitialization() error {
+	if a.hookSource == nil {
+		return fmt.Errorf("kubernetes client is not properly setup")
+	}
+	if err := a.namespaceMatcher.Validate(); err != nil {
+		return fmt.Errorf("namespaceMatcher is not properly setup: %v", err)
+	}
+	if err := a.clientManager.Validate(); err != nil {
+		return fmt.Errorf("clientManager is not properly setup: %v", err)
+	}
+	return nil
+}
+
+// ShouldCallHook returns invocation details if the webhook should be called, nil if the webhook should not be called,
+// or an error if an error was encountered during evaluation.
+func (a *Webhook) ShouldCallHook(h webhook.WebhookAccessor, attr admission.Attributes, o admission.ObjectInterfaces) (*WebhookInvocation, *apierrors.StatusError) {
+	var err *apierrors.StatusError
+	var invocation *WebhookInvocation
+	for _, r := range h.GetRules() {
+		m := rules.Matcher{Rule: r, Attr: attr}
+		if m.Matches() {
+			invocation = &WebhookInvocation{
+				Webhook:     h,
+				Resource:    attr.GetResource(),
+				Subresource: attr.GetSubresource(),
+				Kind:        attr.GetKind(),
+			}
+			break
+		}
+	}
+	if invocation == nil && h.GetMatchPolicy() != nil && *h.GetMatchPolicy() == v1beta1.Equivalent {
+		attrWithOverride := &attrWithResourceOverride{Attributes: attr}
+		equivalents := o.GetEquivalentResourceMapper().EquivalentResourcesFor(attr.GetResource(), attr.GetSubresource())
+		// honor earlier rules first
+	OuterLoop:
+		for _, r := range h.GetRules() {
+			// see if the rule matches any of the equivalent resources
+			for _, equivalent := range equivalents {
+				if equivalent == attr.GetResource() {
+					// exclude attr.GetResource(), which we already checked
+					continue
+				}
+				attrWithOverride.resource = equivalent
+				m := rules.Matcher{Rule: r, Attr: attrWithOverride}
+				if m.Matches() {
+					kind := o.GetEquivalentResourceMapper().KindFor(equivalent, attr.GetSubresource())
+					if kind.Empty() {
+						return nil, apierrors.NewInternalError(fmt.Errorf("unable to convert to %v: unknown kind", equivalent))
+					}
+					invocation = &WebhookInvocation{
+						Webhook:     h,
+						Resource:    equivalent,
+						Subresource: attr.GetSubresource(),
+						Kind:        kind,
+					}
+					break OuterLoop
+				}
+			}
+		}
+	}
+
+	if invocation == nil {
+		return nil, nil
+	}
+
+	matches, err := a.namespaceMatcher.MatchNamespaceSelector(h, attr)
+	if !matches || err != nil {
+		return nil, err
+	}
+
+	matches, err = a.objectMatcher.MatchObjectSelector(h, attr)
+	if !matches || err != nil {
+		return nil, err
+	}
+
+	return invocation, nil
+}
+
+type attrWithResourceOverride struct {
+	admission.Attributes
+	resource schema.GroupVersionResource
+}
+
+func (a *attrWithResourceOverride) GetResource() schema.GroupVersionResource { return a.resource }
+
+// Dispatch is called by the downstream Validate or Admit methods.
+func (a *Webhook) Dispatch(ctx context.Context, attr admission.Attributes, o admission.ObjectInterfaces) error {
+	if rules.IsWebhookConfigurationResource(attr) {
+		return nil
+	}
+	if !a.WaitForReady() {
+		return admission.NewForbidden(attr, fmt.Errorf("not yet ready to handle request"))
+	}
+	hooks := a.hookSource.Webhooks()
+	return a.dispatcher.Dispatch(ctx, attr, o, hooks)
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/generic/webhook_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/generic/webhook_test.go
@@ -0,0 +1,331 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generic
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"k8s.io/api/admissionregistration/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apiserver/pkg/admission"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook/namespace"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook/object"
+)
+
+func TestShouldCallHook(t *testing.T) {
+	a := &Webhook{namespaceMatcher: &namespace.Matcher{}, objectMatcher: &object.Matcher{}}
+
+	allScopes := v1beta1.AllScopes
+	exactMatch := v1beta1.Exact
+	equivalentMatch := v1beta1.Equivalent
+
+	mapper := runtime.NewEquivalentResourceRegistryWithIdentity(func(resource schema.GroupResource) string {
+		if resource.Resource == "deployments" {
+			// co-locate deployments in all API groups
+			return "/deployments"
+		}
+		return ""
+	})
+	mapper.RegisterKindFor(schema.GroupVersionResource{"extensions", "v1beta1", "deployments"}, "", schema.GroupVersionKind{"extensions", "v1beta1", "Deployment"})
+	mapper.RegisterKindFor(schema.GroupVersionResource{"apps", "v1", "deployments"}, "", schema.GroupVersionKind{"apps", "v1", "Deployment"})
+	mapper.RegisterKindFor(schema.GroupVersionResource{"apps", "v1beta1", "deployments"}, "", schema.GroupVersionKind{"apps", "v1beta1", "Deployment"})
+	mapper.RegisterKindFor(schema.GroupVersionResource{"apps", "v1alpha1", "deployments"}, "", schema.GroupVersionKind{"apps", "v1alpha1", "Deployment"})
+
+	mapper.RegisterKindFor(schema.GroupVersionResource{"extensions", "v1beta1", "deployments"}, "scale", schema.GroupVersionKind{"extensions", "v1beta1", "Scale"})
+	mapper.RegisterKindFor(schema.GroupVersionResource{"apps", "v1", "deployments"}, "scale", schema.GroupVersionKind{"autoscaling", "v1", "Scale"})
+	mapper.RegisterKindFor(schema.GroupVersionResource{"apps", "v1beta1", "deployments"}, "scale", schema.GroupVersionKind{"apps", "v1beta1", "Scale"})
+	mapper.RegisterKindFor(schema.GroupVersionResource{"apps", "v1alpha1", "deployments"}, "scale", schema.GroupVersionKind{"apps", "v1alpha1", "Scale"})
+
+	// register invalid kinds to trigger an error
+	mapper.RegisterKindFor(schema.GroupVersionResource{"example.com", "v1", "widgets"}, "", schema.GroupVersionKind{"", "", ""})
+	mapper.RegisterKindFor(schema.GroupVersionResource{"example.com", "v2", "widgets"}, "", schema.GroupVersionKind{"", "", ""})
+
+	interfaces := &admission.RuntimeObjectInterfaces{EquivalentResourceMapper: mapper}
+
+	testcases := []struct {
+		name string
+
+		webhook *v1beta1.ValidatingWebhook
+		attrs   admission.Attributes
+
+		expectCall            bool
+		expectErr             string
+		expectCallResource    schema.GroupVersionResource
+		expectCallSubresource string
+		expectCallKind        schema.GroupVersionKind
+	}{
+		{
+			name:       "no rules (just write)",
+			webhook:    &v1beta1.ValidatingWebhook{Rules: []v1beta1.RuleWithOperations{}},
+			attrs:      admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{"apps", "v1", "Deployment"}, "ns", "name", schema.GroupVersionResource{"apps", "v1", "deployments"}, "", admission.Create, &metav1.CreateOptions{}, false, nil),
+			expectCall: false,
+		},
+		{
+			name: "invalid kind lookup",
+			webhook: &v1beta1.ValidatingWebhook{
+				NamespaceSelector: &metav1.LabelSelector{},
+				ObjectSelector:    &metav1.LabelSelector{},
+				MatchPolicy:       &equivalentMatch,
+				Rules: []v1beta1.RuleWithOperations{{
+					Operations: []v1beta1.OperationType{"*"},
+					Rule:       v1beta1.Rule{APIGroups: []string{"example.com"}, APIVersions: []string{"v1"}, Resources: []string{"widgets"}, Scope: &allScopes},
+				}}},
+			attrs:      admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{"example.com", "v2", "Widget"}, "ns", "name", schema.GroupVersionResource{"example.com", "v2", "widgets"}, "", admission.Create, &metav1.CreateOptions{}, false, nil),
+			expectCall: false,
+			expectErr:  "unknown kind",
+		},
+		{
+			name: "wildcard rule, match as requested",
+			webhook: &v1beta1.ValidatingWebhook{
+				NamespaceSelector: &metav1.LabelSelector{},
+				ObjectSelector:    &metav1.LabelSelector{},
+				Rules: []v1beta1.RuleWithOperations{{
+					Operations: []v1beta1.OperationType{"*"},
+					Rule:       v1beta1.Rule{APIGroups: []string{"*"}, APIVersions: []string{"*"}, Resources: []string{"*"}, Scope: &allScopes},
+				}}},
+			attrs:                 admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{"apps", "v1", "Deployment"}, "ns", "name", schema.GroupVersionResource{"apps", "v1", "deployments"}, "", admission.Create, &metav1.CreateOptions{}, false, nil),
+			expectCall:            true,
+			expectCallKind:        schema.GroupVersionKind{"apps", "v1", "Deployment"},
+			expectCallResource:    schema.GroupVersionResource{"apps", "v1", "deployments"},
+			expectCallSubresource: "",
+		},
+		{
+			name: "specific rules, prefer exact match",
+			webhook: &v1beta1.ValidatingWebhook{
+				NamespaceSelector: &metav1.LabelSelector{},
+				ObjectSelector:    &metav1.LabelSelector{},
+				Rules: []v1beta1.RuleWithOperations{{
+					Operations: []v1beta1.OperationType{"*"},
+					Rule:       v1beta1.Rule{APIGroups: []string{"extensions"}, APIVersions: []string{"v1beta1"}, Resources: []string{"deployments"}, Scope: &allScopes},
+				}, {
+					Operations: []v1beta1.OperationType{"*"},
+					Rule:       v1beta1.Rule{APIGroups: []string{"apps"}, APIVersions: []string{"v1beta1"}, Resources: []string{"deployments"}, Scope: &allScopes},
+				}, {
+					Operations: []v1beta1.OperationType{"*"},
+					Rule:       v1beta1.Rule{APIGroups: []string{"apps"}, APIVersions: []string{"v1"}, Resources: []string{"deployments"}, Scope: &allScopes},
+				}}},
+			attrs:                 admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{"apps", "v1", "Deployment"}, "ns", "name", schema.GroupVersionResource{"apps", "v1", "deployments"}, "", admission.Create, &metav1.CreateOptions{}, false, nil),
+			expectCall:            true,
+			expectCallKind:        schema.GroupVersionKind{"apps", "v1", "Deployment"},
+			expectCallResource:    schema.GroupVersionResource{"apps", "v1", "deployments"},
+			expectCallSubresource: "",
+		},
+		{
+			name: "specific rules, match miss",
+			webhook: &v1beta1.ValidatingWebhook{
+				NamespaceSelector: &metav1.LabelSelector{},
+				ObjectSelector:    &metav1.LabelSelector{},
+				Rules: []v1beta1.RuleWithOperations{{
+					Operations: []v1beta1.OperationType{"*"},
+					Rule:       v1beta1.Rule{APIGroups: []string{"extensions"}, APIVersions: []string{"v1beta1"}, Resources: []string{"deployments"}, Scope: &allScopes},
+				}, {
+					Operations: []v1beta1.OperationType{"*"},
+					Rule:       v1beta1.Rule{APIGroups: []string{"apps"}, APIVersions: []string{"v1beta1"}, Resources: []string{"deployments"}, Scope: &allScopes},
+				}}},
+			attrs:      admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{"apps", "v1", "Deployment"}, "ns", "name", schema.GroupVersionResource{"apps", "v1", "deployments"}, "", admission.Create, &metav1.CreateOptions{}, false, nil),
+			expectCall: false,
+		},
+		{
+			name: "specific rules, exact match miss",
+			webhook: &v1beta1.ValidatingWebhook{
+				MatchPolicy:       &exactMatch,
+				NamespaceSelector: &metav1.LabelSelector{},
+				ObjectSelector:    &metav1.LabelSelector{},
+				Rules: []v1beta1.RuleWithOperations{{
+					Operations: []v1beta1.OperationType{"*"},
+					Rule:       v1beta1.Rule{APIGroups: []string{"extensions"}, APIVersions: []string{"v1beta1"}, Resources: []string{"deployments"}, Scope: &allScopes},
+				}, {
+					Operations: []v1beta1.OperationType{"*"},
+					Rule:       v1beta1.Rule{APIGroups: []string{"apps"}, APIVersions: []string{"v1beta1"}, Resources: []string{"deployments"}, Scope: &allScopes},
+				}}},
+			attrs:      admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{"apps", "v1", "Deployment"}, "ns", "name", schema.GroupVersionResource{"apps", "v1", "deployments"}, "", admission.Create, &metav1.CreateOptions{}, false, nil),
+			expectCall: false,
+		},
+		{
+			name: "specific rules, equivalent match, prefer extensions",
+			webhook: &v1beta1.ValidatingWebhook{
+				MatchPolicy:       &equivalentMatch,
+				NamespaceSelector: &metav1.LabelSelector{},
+				ObjectSelector:    &metav1.LabelSelector{},
+				Rules: []v1beta1.RuleWithOperations{{
+					Operations: []v1beta1.OperationType{"*"},
+					Rule:       v1beta1.Rule{APIGroups: []string{"extensions"}, APIVersions: []string{"v1beta1"}, Resources: []string{"deployments"}, Scope: &allScopes},
+				}, {
+					Operations: []v1beta1.OperationType{"*"},
+					Rule:       v1beta1.Rule{APIGroups: []string{"apps"}, APIVersions: []string{"v1beta1"}, Resources: []string{"deployments"}, Scope: &allScopes},
+				}}},
+			attrs:                 admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{"apps", "v1", "Deployment"}, "ns", "name", schema.GroupVersionResource{"apps", "v1", "deployments"}, "", admission.Create, &metav1.CreateOptions{}, false, nil),
+			expectCall:            true,
+			expectCallKind:        schema.GroupVersionKind{"extensions", "v1beta1", "Deployment"},
+			expectCallResource:    schema.GroupVersionResource{"extensions", "v1beta1", "deployments"},
+			expectCallSubresource: "",
+		},
+		{
+			name: "specific rules, equivalent match, prefer apps",
+			webhook: &v1beta1.ValidatingWebhook{
+				MatchPolicy:       &equivalentMatch,
+				NamespaceSelector: &metav1.LabelSelector{},
+				ObjectSelector:    &metav1.LabelSelector{},
+				Rules: []v1beta1.RuleWithOperations{{
+					Operations: []v1beta1.OperationType{"*"},
+					Rule:       v1beta1.Rule{APIGroups: []string{"apps"}, APIVersions: []string{"v1beta1"}, Resources: []string{"deployments"}, Scope: &allScopes},
+				}, {
+					Operations: []v1beta1.OperationType{"*"},
+					Rule:       v1beta1.Rule{APIGroups: []string{"extensions"}, APIVersions: []string{"v1beta1"}, Resources: []string{"deployments"}, Scope: &allScopes},
+				}}},
+			attrs:                 admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{"apps", "v1", "Deployment"}, "ns", "name", schema.GroupVersionResource{"apps", "v1", "deployments"}, "", admission.Create, &metav1.CreateOptions{}, false, nil),
+			expectCall:            true,
+			expectCallKind:        schema.GroupVersionKind{"apps", "v1beta1", "Deployment"},
+			expectCallResource:    schema.GroupVersionResource{"apps", "v1beta1", "deployments"},
+			expectCallSubresource: "",
+		},
+
+		{
+			name: "specific rules, subresource prefer exact match",
+			webhook: &v1beta1.ValidatingWebhook{
+				NamespaceSelector: &metav1.LabelSelector{},
+				ObjectSelector:    &metav1.LabelSelector{},
+				Rules: []v1beta1.RuleWithOperations{{
+					Operations: []v1beta1.OperationType{"*"},
+					Rule:       v1beta1.Rule{APIGroups: []string{"extensions"}, APIVersions: []string{"v1beta1"}, Resources: []string{"deployments", "deployments/scale"}, Scope: &allScopes},
+				}, {
+					Operations: []v1beta1.OperationType{"*"},
+					Rule:       v1beta1.Rule{APIGroups: []string{"apps"}, APIVersions: []string{"v1beta1"}, Resources: []string{"deployments", "deployments/scale"}, Scope: &allScopes},
+				}, {
+					Operations: []v1beta1.OperationType{"*"},
+					Rule:       v1beta1.Rule{APIGroups: []string{"apps"}, APIVersions: []string{"v1"}, Resources: []string{"deployments", "deployments/scale"}, Scope: &allScopes},
+				}}},
+			attrs:                 admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{"autoscaling", "v1", "Scale"}, "ns", "name", schema.GroupVersionResource{"apps", "v1", "deployments"}, "scale", admission.Create, &metav1.CreateOptions{}, false, nil),
+			expectCall:            true,
+			expectCallKind:        schema.GroupVersionKind{"autoscaling", "v1", "Scale"},
+			expectCallResource:    schema.GroupVersionResource{"apps", "v1", "deployments"},
+			expectCallSubresource: "scale",
+		},
+		{
+			name: "specific rules, subresource match miss",
+			webhook: &v1beta1.ValidatingWebhook{
+				NamespaceSelector: &metav1.LabelSelector{},
+				ObjectSelector:    &metav1.LabelSelector{},
+				Rules: []v1beta1.RuleWithOperations{{
+					Operations: []v1beta1.OperationType{"*"},
+					Rule:       v1beta1.Rule{APIGroups: []string{"extensions"}, APIVersions: []string{"v1beta1"}, Resources: []string{"deployments", "deployments/scale"}, Scope: &allScopes},
+				}, {
+					Operations: []v1beta1.OperationType{"*"},
+					Rule:       v1beta1.Rule{APIGroups: []string{"apps"}, APIVersions: []string{"v1beta1"}, Resources: []string{"deployments", "deployments/scale"}, Scope: &allScopes},
+				}}},
+			attrs:      admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{"autoscaling", "v1", "Scale"}, "ns", "name", schema.GroupVersionResource{"apps", "v1", "deployments"}, "scale", admission.Create, &metav1.CreateOptions{}, false, nil),
+			expectCall: false,
+		},
+		{
+			name: "specific rules, subresource exact match miss",
+			webhook: &v1beta1.ValidatingWebhook{
+				MatchPolicy:       &exactMatch,
+				NamespaceSelector: &metav1.LabelSelector{},
+				ObjectSelector:    &metav1.LabelSelector{},
+				Rules: []v1beta1.RuleWithOperations{{
+					Operations: []v1beta1.OperationType{"*"},
+					Rule:       v1beta1.Rule{APIGroups: []string{"extensions"}, APIVersions: []string{"v1beta1"}, Resources: []string{"deployments", "deployments/scale"}, Scope: &allScopes},
+				}, {
+					Operations: []v1beta1.OperationType{"*"},
+					Rule:       v1beta1.Rule{APIGroups: []string{"apps"}, APIVersions: []string{"v1beta1"}, Resources: []string{"deployments", "deployments/scale"}, Scope: &allScopes},
+				}}},
+			attrs:      admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{"autoscaling", "v1", "Scale"}, "ns", "name", schema.GroupVersionResource{"apps", "v1", "deployments"}, "scale", admission.Create, &metav1.CreateOptions{}, false, nil),
+			expectCall: false,
+		},
+		{
+			name: "specific rules, subresource equivalent match, prefer extensions",
+			webhook: &v1beta1.ValidatingWebhook{
+				MatchPolicy:       &equivalentMatch,
+				NamespaceSelector: &metav1.LabelSelector{},
+				ObjectSelector:    &metav1.LabelSelector{},
+				Rules: []v1beta1.RuleWithOperations{{
+					Operations: []v1beta1.OperationType{"*"},
+					Rule:       v1beta1.Rule{APIGroups: []string{"extensions"}, APIVersions: []string{"v1beta1"}, Resources: []string{"deployments", "deployments/scale"}, Scope: &allScopes},
+				}, {
+					Operations: []v1beta1.OperationType{"*"},
+					Rule:       v1beta1.Rule{APIGroups: []string{"apps"}, APIVersions: []string{"v1beta1"}, Resources: []string{"deployments", "deployments/scale"}, Scope: &allScopes},
+				}}},
+			attrs:                 admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{"autoscaling", "v1", "Scale"}, "ns", "name", schema.GroupVersionResource{"apps", "v1", "deployments"}, "scale", admission.Create, &metav1.CreateOptions{}, false, nil),
+			expectCall:            true,
+			expectCallKind:        schema.GroupVersionKind{"extensions", "v1beta1", "Scale"},
+			expectCallResource:    schema.GroupVersionResource{"extensions", "v1beta1", "deployments"},
+			expectCallSubresource: "scale",
+		},
+		{
+			name: "specific rules, subresource equivalent match, prefer apps",
+			webhook: &v1beta1.ValidatingWebhook{
+				MatchPolicy:       &equivalentMatch,
+				NamespaceSelector: &metav1.LabelSelector{},
+				ObjectSelector:    &metav1.LabelSelector{},
+				Rules: []v1beta1.RuleWithOperations{{
+					Operations: []v1beta1.OperationType{"*"},
+					Rule:       v1beta1.Rule{APIGroups: []string{"apps"}, APIVersions: []string{"v1beta1"}, Resources: []string{"deployments", "deployments/scale"}, Scope: &allScopes},
+				}, {
+					Operations: []v1beta1.OperationType{"*"},
+					Rule:       v1beta1.Rule{APIGroups: []string{"extensions"}, APIVersions: []string{"v1beta1"}, Resources: []string{"deployments", "deployments/scale"}, Scope: &allScopes},
+				}}},
+			attrs:                 admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{"autoscaling", "v1", "Scale"}, "ns", "name", schema.GroupVersionResource{"apps", "v1", "deployments"}, "scale", admission.Create, &metav1.CreateOptions{}, false, nil),
+			expectCall:            true,
+			expectCallKind:        schema.GroupVersionKind{"apps", "v1beta1", "Scale"},
+			expectCallResource:    schema.GroupVersionResource{"apps", "v1beta1", "deployments"},
+			expectCallSubresource: "scale",
+		},
+	}
+
+	for i, testcase := range testcases {
+		t.Run(testcase.name, func(t *testing.T) {
+			invocation, err := a.ShouldCallHook(webhook.NewValidatingWebhookAccessor(fmt.Sprintf("webhook-%d", i), fmt.Sprintf("webhook-cfg-%d", i), testcase.webhook), testcase.attrs, interfaces)
+			if err != nil {
+				if len(testcase.expectErr) == 0 {
+					t.Fatal(err)
+				}
+				if !strings.Contains(err.Error(), testcase.expectErr) {
+					t.Fatalf("expected error containing %q, got %s", testcase.expectErr, err.Error())
+				}
+				return
+			} else if len(testcase.expectErr) > 0 {
+				t.Fatalf("expected error %q, got no error and %#v", testcase.expectErr, invocation)
+			}
+
+			if invocation == nil {
+				if testcase.expectCall {
+					t.Fatal("expected invocation, got nil")
+				}
+				return
+			}
+
+			if !testcase.expectCall {
+				t.Fatal("unexpected invocation")
+			}
+
+			if invocation.Kind != testcase.expectCallKind {
+				t.Fatalf("expected %#v, got %#v", testcase.expectCallKind, invocation.Kind)
+			}
+			if invocation.Resource != testcase.expectCallResource {
+				t.Fatalf("expected %#v, got %#v", testcase.expectCallResource, invocation.Resource)
+			}
+			if invocation.Subresource != testcase.expectCallSubresource {
+				t.Fatalf("expected %#v, got %#v", testcase.expectCallSubresource, invocation.Subresource)
+			}
+		})
+	}
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/initializer/BUILD
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/initializer/BUILD
@@ -1,37 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-
-go_library(
-    name = "go_default_library",
-    srcs = ["initializer.go"],
-    importpath = "k8s.io/apiserver/pkg/admission/plugin/webhook/initializer",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config:go_default_library",
-    ],
-)
-
-go_test(
-    name = "go_default_test",
-    srcs = ["initializer_test.go"],
-    importpath = "k8s.io/apiserver/pkg/admission/plugin/webhook/initializer",
-    library = ":go_default_library",
-    deps = [
-        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config:go_default_library",
-    ],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-    visibility = ["//visibility:public"],
-)
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/initializer/initializer.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/initializer/initializer.go
@@ -20,40 +20,40 @@ import (
 	"net/url"

 	"k8s.io/apiserver/pkg/admission"
-	webhookconfig "k8s.io/apiserver/pkg/admission/plugin/webhook/config"
+	"k8s.io/apiserver/pkg/util/webhook"
 )

-// WantsServiceResolver defines a fuction that accepts a ServiceResolver for
+// WantsServiceResolver defines a function that accepts a ServiceResolver for
 // admission plugins that need to make calls to services.
 type WantsServiceResolver interface {
-	SetServiceResolver(webhookconfig.ServiceResolver)
+	SetServiceResolver(webhook.ServiceResolver)
 }

 // ServiceResolver knows how to convert a service reference into an actual
 // location.
 type ServiceResolver interface {
-	ResolveEndpoint(namespace, name string) (*url.URL, error)
+	ResolveEndpoint(namespace, name string, port int32) (*url.URL, error)
 }

 // WantsAuthenticationInfoResolverWrapper defines a function that wraps the standard AuthenticationInfoResolver
 // to allow the apiserver to control what is returned as auth info
 type WantsAuthenticationInfoResolverWrapper interface {
-	SetAuthenticationInfoResolverWrapper(webhookconfig.AuthenticationInfoResolverWrapper)
+	SetAuthenticationInfoResolverWrapper(wrapper webhook.AuthenticationInfoResolverWrapper)
 	admission.InitializationValidator
 }

 // PluginInitializer is used for initialization of the webhook admission plugin.
 type PluginInitializer struct {
-	serviceResolver                   webhookconfig.ServiceResolver
-	authenticationInfoResolverWrapper webhookconfig.AuthenticationInfoResolverWrapper
+	serviceResolver                   webhook.ServiceResolver
+	authenticationInfoResolverWrapper webhook.AuthenticationInfoResolverWrapper
 }

 var _ admission.PluginInitializer = &PluginInitializer{}

 // NewPluginInitializer constructs new instance of PluginInitializer
 func NewPluginInitializer(
-	authenticationInfoResolverWrapper webhookconfig.AuthenticationInfoResolverWrapper,
-	serviceResolver webhookconfig.ServiceResolver,
+	authenticationInfoResolverWrapper webhook.AuthenticationInfoResolverWrapper,
+	serviceResolver webhook.ServiceResolver,
 ) *PluginInitializer {
 	return &PluginInitializer{
 		authenticationInfoResolverWrapper: authenticationInfoResolverWrapper,
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/initializer/initializer_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/initializer/initializer_test.go
@@ -21,18 +21,16 @@ import (
 	"testing"

 	"k8s.io/apiserver/pkg/admission"
-	"k8s.io/apiserver/pkg/admission/plugin/webhook/config"
+	"k8s.io/apiserver/pkg/util/webhook"
 )

 type doNothingAdmission struct{}

-func (doNothingAdmission) Admit(a admission.Attributes) error { return nil }
 func (doNothingAdmission) Handles(o admission.Operation) bool { return false }
-func (doNothingAdmission) Validate() error                    { return nil }

 type fakeServiceResolver struct{}

-func (f *fakeServiceResolver) ResolveEndpoint(namespace, name string) (*url.URL, error) {
+func (f *fakeServiceResolver) ResolveEndpoint(namespace, name string, port int32) (*url.URL, error) {
 	return nil, nil
 }

@@ -41,7 +39,7 @@ type serviceWanter struct {
 	got ServiceResolver
 }

-func (s *serviceWanter) SetServiceResolver(sr config.ServiceResolver) { s.got = sr }
+func (s *serviceWanter) SetServiceResolver(sr webhook.ServiceResolver) { s.got = sr }

 func TestWantsServiceResolver(t *testing.T) {
 	sw := &serviceWanter{}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/mutating/BUILD
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/mutating/BUILD
@@ -1,71 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-
-go_library(
-    name = "go_default_library",
-    srcs = [
-        "admission.go",
-        "doc.go",
-    ],
-    importpath = "k8s.io/apiserver/pkg/admission/plugin/webhook/mutating",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//vendor/github.com/evanphx/json-patch:go_default_library",
-        "//vendor/github.com/golang/glog:go_default_library",
-        "//vendor/k8s.io/api/admission/v1beta1:go_default_library",
-        "//vendor/k8s.io/api/admissionregistration/v1beta1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime/serializer:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime/serializer/json:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/runtime:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/configuration:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/initializer:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/metrics:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/errors:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/namespace:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/request:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/rules:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/versioned:go_default_library",
-        "//vendor/k8s.io/client-go/informers:go_default_library",
-        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
-    ],
-)
-
-go_test(
-    name = "go_default_test",
-    srcs = ["admission_test.go"],
-    importpath = "k8s.io/apiserver/pkg/admission/plugin/webhook/mutating",
-    library = ":go_default_library",
-    deps = [
-        "//vendor/k8s.io/api/admission/v1beta1:go_default_library",
-        "//vendor/k8s.io/api/admissionregistration/v1beta1:go_default_library",
-        "//vendor/k8s.io/api/core/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/labels:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/testcerts:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/authentication/user:go_default_library",
-        "//vendor/k8s.io/client-go/rest:go_default_library",
-    ],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-    visibility = ["//visibility:public"],
-)
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/mutating/admission.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/mutating/admission.go
@@ -1,321 +0,0 @@
-/*
-Copyright 2017 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Package mutating delegates admission checks to dynamically configured
-// mutating webhooks.
-package mutating
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"time"
-
-	jsonpatch "github.com/evanphx/json-patch"
-	"github.com/golang/glog"
-
-	admissionv1beta1 "k8s.io/api/admission/v1beta1"
-	"k8s.io/api/admissionregistration/v1beta1"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/serializer"
-	"k8s.io/apimachinery/pkg/runtime/serializer/json"
-	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-	"k8s.io/apimachinery/pkg/util/wait"
-	"k8s.io/apiserver/pkg/admission"
-	"k8s.io/apiserver/pkg/admission/configuration"
-	genericadmissioninit "k8s.io/apiserver/pkg/admission/initializer"
-	admissionmetrics "k8s.io/apiserver/pkg/admission/metrics"
-	"k8s.io/apiserver/pkg/admission/plugin/webhook/config"
-	webhookerrors "k8s.io/apiserver/pkg/admission/plugin/webhook/errors"
-	"k8s.io/apiserver/pkg/admission/plugin/webhook/namespace"
-	"k8s.io/apiserver/pkg/admission/plugin/webhook/request"
-	"k8s.io/apiserver/pkg/admission/plugin/webhook/rules"
-	"k8s.io/apiserver/pkg/admission/plugin/webhook/versioned"
-	"k8s.io/client-go/informers"
-	clientset "k8s.io/client-go/kubernetes"
-)
-
-const (
-	// Name of admission plug-in
-	PluginName = "MutatingAdmissionWebhook"
-)
-
-// Register registers a plugin
-func Register(plugins *admission.Plugins) {
-	plugins.Register(PluginName, func(configFile io.Reader) (admission.Interface, error) {
-		plugin, err := NewMutatingWebhook(configFile)
-		if err != nil {
-			return nil, err
-		}
-
-		return plugin, nil
-	})
-}
-
-// WebhookSource can list dynamic webhook plugins.
-type WebhookSource interface {
-	Run(stopCh <-chan struct{})
-	Webhooks() (*v1beta1.MutatingWebhookConfiguration, error)
-}
-
-// NewMutatingWebhook returns a generic admission webhook plugin.
-func NewMutatingWebhook(configFile io.Reader) (*MutatingWebhook, error) {
-	kubeconfigFile, err := config.LoadConfig(configFile)
-	if err != nil {
-		return nil, err
-	}
-
-	cm, err := config.NewClientManager()
-	if err != nil {
-		return nil, err
-	}
-	authInfoResolver, err := config.NewDefaultAuthenticationInfoResolver(kubeconfigFile)
-	if err != nil {
-		return nil, err
-	}
-	// Set defaults which may be overridden later.
-	cm.SetAuthenticationInfoResolver(authInfoResolver)
-	cm.SetServiceResolver(config.NewDefaultServiceResolver())
-
-	return &MutatingWebhook{
-		Handler: admission.NewHandler(
-			admission.Connect,
-			admission.Create,
-			admission.Delete,
-			admission.Update,
-		),
-		clientManager: cm,
-	}, nil
-}
-
-var _ admission.MutationInterface = &MutatingWebhook{}
-
-// MutatingWebhook is an implementation of admission.Interface.
-type MutatingWebhook struct {
-	*admission.Handler
-	hookSource       WebhookSource
-	namespaceMatcher namespace.Matcher
-	clientManager    config.ClientManager
-	convertor        versioned.Convertor
-	jsonSerializer   runtime.Serializer
-}
-
-var (
-	_ = genericadmissioninit.WantsExternalKubeClientSet(&MutatingWebhook{})
-)
-
-// TODO find a better way wire this, but keep this pull small for now.
-func (a *MutatingWebhook) SetAuthenticationInfoResolverWrapper(wrapper config.AuthenticationInfoResolverWrapper) {
-	a.clientManager.SetAuthenticationInfoResolverWrapper(wrapper)
-}
-
-// SetServiceResolver sets a service resolver for the webhook admission plugin.
-// Passing a nil resolver does not have an effect, instead a default one will be used.
-func (a *MutatingWebhook) SetServiceResolver(sr config.ServiceResolver) {
-	a.clientManager.SetServiceResolver(sr)
-}
-
-// SetScheme sets a serializer(NegotiatedSerializer) which is derived from the scheme
-func (a *MutatingWebhook) SetScheme(scheme *runtime.Scheme) {
-	if scheme != nil {
-		a.clientManager.SetNegotiatedSerializer(serializer.NegotiatedSerializerWrapper(runtime.SerializerInfo{
-			Serializer: serializer.NewCodecFactory(scheme).LegacyCodec(admissionv1beta1.SchemeGroupVersion),
-		}))
-		a.convertor.Scheme = scheme
-		a.jsonSerializer = json.NewSerializer(json.DefaultMetaFactory, scheme, scheme, false)
-	}
-}
-
-// WantsExternalKubeClientSet defines a function which sets external ClientSet for admission plugins that need it
-func (a *MutatingWebhook) SetExternalKubeClientSet(client clientset.Interface) {
-	a.namespaceMatcher.Client = client
-	a.hookSource = configuration.NewMutatingWebhookConfigurationManager(client.AdmissionregistrationV1beta1().MutatingWebhookConfigurations())
-}
-
-// SetExternalKubeInformerFactory implements the WantsExternalKubeInformerFactory interface.
-func (a *MutatingWebhook) SetExternalKubeInformerFactory(f informers.SharedInformerFactory) {
-	namespaceInformer := f.Core().V1().Namespaces()
-	a.namespaceMatcher.NamespaceLister = namespaceInformer.Lister()
-	a.SetReadyFunc(namespaceInformer.Informer().HasSynced)
-}
-
-// ValidateInitialization implements the InitializationValidator interface.
-func (a *MutatingWebhook) ValidateInitialization() error {
-	if a.hookSource == nil {
-		return fmt.Errorf("MutatingWebhook admission plugin requires a Kubernetes client to be provided")
-	}
-	if a.jsonSerializer == nil {
-		return fmt.Errorf("MutatingWebhook admission plugin's jsonSerializer is not properly setup")
-	}
-	if err := a.namespaceMatcher.Validate(); err != nil {
-		return fmt.Errorf("MutatingWebhook.namespaceMatcher is not properly setup: %v", err)
-	}
-	if err := a.clientManager.Validate(); err != nil {
-		return fmt.Errorf("MutatingWebhook.clientManager is not properly setup: %v", err)
-	}
-	if err := a.convertor.Validate(); err != nil {
-		return fmt.Errorf("MutatingWebhook.convertor is not properly setup: %v", err)
-	}
-	go a.hookSource.Run(wait.NeverStop)
-	return nil
-}
-
-func (a *MutatingWebhook) loadConfiguration(attr admission.Attributes) (*v1beta1.MutatingWebhookConfiguration, error) {
-	hookConfig, err := a.hookSource.Webhooks()
-	// if Webhook configuration is disabled, fail open
-	if err == configuration.ErrDisabled {
-		return &v1beta1.MutatingWebhookConfiguration{}, nil
-	}
-	if err != nil {
-		e := apierrors.NewServerTimeout(attr.GetResource().GroupResource(), string(attr.GetOperation()), 1)
-		e.ErrStatus.Message = fmt.Sprintf("Unable to refresh the Webhook configuration: %v", err)
-		e.ErrStatus.Reason = "LoadingConfiguration"
-		e.ErrStatus.Details.Causes = append(e.ErrStatus.Details.Causes, metav1.StatusCause{
-			Type:    "MutatingWebhookConfigurationFailure",
-			Message: "An error has occurred while refreshing the MutatingWebhook configuration, no resources can be created/updated/deleted/connected until a refresh succeeds.",
-		})
-		return nil, e
-	}
-	return hookConfig, nil
-}
-
-// Admit makes an admission decision based on the request attributes.
-func (a *MutatingWebhook) Admit(attr admission.Attributes) error {
-	hookConfig, err := a.loadConfiguration(attr)
-	if err != nil {
-		return err
-	}
-	hooks := hookConfig.Webhooks
-	ctx := context.TODO()
-
-	var relevantHooks []*v1beta1.Webhook
-	for i := range hooks {
-		call, err := a.shouldCallHook(&hooks[i], attr)
-		if err != nil {
-			return err
-		}
-		if call {
-			relevantHooks = append(relevantHooks, &hooks[i])
-		}
-	}
-
-	if len(relevantHooks) == 0 {
-		// no matching hooks
-		return nil
-	}
-
-	// convert the object to the external version before sending it to the webhook
-	versionedAttr := versioned.Attributes{
-		Attributes: attr,
-	}
-	if oldObj := attr.GetOldObject(); oldObj != nil {
-		out, err := a.convertor.ConvertToGVK(oldObj, attr.GetKind())
-		if err != nil {
-			return apierrors.NewInternalError(err)
-		}
-		versionedAttr.OldObject = out
-	}
-	if obj := attr.GetObject(); obj != nil {
-		out, err := a.convertor.ConvertToGVK(obj, attr.GetKind())
-		if err != nil {
-			return apierrors.NewInternalError(err)
-		}
-		versionedAttr.Object = out
-	}
-
-	for _, hook := range relevantHooks {
-		t := time.Now()
-		err := a.callAttrMutatingHook(ctx, hook, versionedAttr)
-		admissionmetrics.Metrics.ObserveWebhook(time.Since(t), err != nil, attr, "admit", hook.Name)
-		if err == nil {
-			continue
-		}
-
-		ignoreClientCallFailures := hook.FailurePolicy != nil && *hook.FailurePolicy == v1beta1.Ignore
-		if callErr, ok := err.(*webhookerrors.ErrCallingWebhook); ok {
-			if ignoreClientCallFailures {
-				glog.Warningf("Failed calling webhook, failing open %v: %v", hook.Name, callErr)
-				utilruntime.HandleError(callErr)
-				continue
-			}
-			glog.Warningf("Failed calling webhook, failing closed %v: %v", hook.Name, err)
-		}
-		return apierrors.NewInternalError(err)
-	}
-
-	// convert attr.Object to the internal version
-	return a.convertor.Convert(versionedAttr.Object, attr.GetObject())
-}
-
-// TODO: factor into a common place along with the validating webhook version.
-func (a *MutatingWebhook) shouldCallHook(h *v1beta1.Webhook, attr admission.Attributes) (bool, *apierrors.StatusError) {
-	var matches bool
-	for _, r := range h.Rules {
-		m := rules.Matcher{Rule: r, Attr: attr}
-		if m.Matches() {
-			matches = true
-			break
-		}
-	}
-	if !matches {
-		return false, nil
-	}
-
-	return a.namespaceMatcher.MatchNamespaceSelector(h, attr)
-}
-
-// note that callAttrMutatingHook updates attr
-func (a *MutatingWebhook) callAttrMutatingHook(ctx context.Context, h *v1beta1.Webhook, attr versioned.Attributes) error {
-	// Make the webhook request
-	request := request.CreateAdmissionReview(attr)
-	client, err := a.clientManager.HookClient(h)
-	if err != nil {
-		return &webhookerrors.ErrCallingWebhook{WebhookName: h.Name, Reason: err}
-	}
-	response := &admissionv1beta1.AdmissionReview{}
-	if err := client.Post().Context(ctx).Body(&request).Do().Into(response); err != nil {
-		return &webhookerrors.ErrCallingWebhook{WebhookName: h.Name, Reason: err}
-	}
-
-	if !response.Response.Allowed {
-		return webhookerrors.ToStatusErr(h.Name, response.Response.Result)
-	}
-
-	patchJS := response.Response.Patch
-	if len(patchJS) == 0 {
-		return nil
-	}
-	patchObj, err := jsonpatch.DecodePatch(patchJS)
-	if err != nil {
-		return apierrors.NewInternalError(err)
-	}
-	objJS, err := runtime.Encode(a.jsonSerializer, attr.Object)
-	if err != nil {
-		return apierrors.NewInternalError(err)
-	}
-	patchedJS, err := patchObj.Apply(objJS)
-	if err != nil {
-		return apierrors.NewInternalError(err)
-	}
-	// TODO: if we have multiple mutating webhooks, we can remember the json
-	// instead of encoding and decoding for each one.
-	if _, _, err := a.jsonSerializer.Decode(patchedJS, nil, attr.Object); err != nil {
-		return apierrors.NewInternalError(err)
-	}
-	return nil
-}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/mutating/admission_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/mutating/admission_test.go
@@ -1,649 +0,0 @@
-/*
-Copyright 2017 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package mutating
-
-import (
-	"crypto/tls"
-	"crypto/x509"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"strings"
-	"sync/atomic"
-	"testing"
-
-	"k8s.io/api/admission/v1beta1"
-	registrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
-	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apiserver/pkg/admission"
-	"k8s.io/apiserver/pkg/admission/plugin/webhook/config"
-	"k8s.io/apiserver/pkg/admission/plugin/webhook/testcerts"
-	"k8s.io/apiserver/pkg/authentication/user"
-	"k8s.io/client-go/rest"
-)
-
-type fakeHookSource struct {
-	hooks []registrationv1beta1.Webhook
-	err   error
-}
-
-func (f *fakeHookSource) Webhooks() (*registrationv1beta1.MutatingWebhookConfiguration, error) {
-	if f.err != nil {
-		return nil, f.err
-	}
-	for i, h := range f.hooks {
-		if h.NamespaceSelector == nil {
-			f.hooks[i].NamespaceSelector = &metav1.LabelSelector{}
-		}
-	}
-	return &registrationv1beta1.MutatingWebhookConfiguration{Webhooks: f.hooks}, nil
-}
-
-func (f *fakeHookSource) Run(stopCh <-chan struct{}) {}
-
-type fakeServiceResolver struct {
-	base url.URL
-}
-
-func (f fakeServiceResolver) ResolveEndpoint(namespace, name string) (*url.URL, error) {
-	if namespace == "failResolve" {
-		return nil, fmt.Errorf("couldn't resolve service location")
-	}
-	u := f.base
-	return &u, nil
-}
-
-type fakeNamespaceLister struct {
-	namespaces map[string]*corev1.Namespace
-}
-
-func (f fakeNamespaceLister) List(selector labels.Selector) (ret []*corev1.Namespace, err error) {
-	return nil, nil
-}
-func (f fakeNamespaceLister) Get(name string) (*corev1.Namespace, error) {
-	ns, ok := f.namespaces[name]
-	if ok {
-		return ns, nil
-	}
-	return nil, errors.NewNotFound(corev1.Resource("namespaces"), name)
-}
-
-// ccfgSVC returns a client config using the service reference mechanism.
-func ccfgSVC(urlPath string) registrationv1beta1.WebhookClientConfig {
-	return registrationv1beta1.WebhookClientConfig{
-		Service: &registrationv1beta1.ServiceReference{
-			Name:      "webhook-test",
-			Namespace: "default",
-			Path:      &urlPath,
-		},
-		CABundle: testcerts.CACert,
-	}
-}
-
-type urlConfigGenerator struct {
-	baseURL *url.URL
-}
-
-// ccfgURL returns a client config using the URL mechanism.
-func (c urlConfigGenerator) ccfgURL(urlPath string) registrationv1beta1.WebhookClientConfig {
-	u2 := *c.baseURL
-	u2.Path = urlPath
-	urlString := u2.String()
-	return registrationv1beta1.WebhookClientConfig{
-		URL:      &urlString,
-		CABundle: testcerts.CACert,
-	}
-}
-
-// TestAdmit tests that MutatingWebhook#Admit works as expected
-func TestAdmit(t *testing.T) {
-	scheme := runtime.NewScheme()
-	v1beta1.AddToScheme(scheme)
-	corev1.AddToScheme(scheme)
-
-	testServer := newTestServer(t)
-	testServer.StartTLS()
-	defer testServer.Close()
-	serverURL, err := url.ParseRequestURI(testServer.URL)
-	if err != nil {
-		t.Fatalf("this should never happen? %v", err)
-	}
-	wh, err := NewMutatingWebhook(nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	cm, err := config.NewClientManager()
-	if err != nil {
-		t.Fatalf("cannot create client manager: %v", err)
-	}
-	cm.SetAuthenticationInfoResolver(newFakeAuthenticationInfoResolver(new(int32)))
-	cm.SetServiceResolver(fakeServiceResolver{base: *serverURL})
-	wh.clientManager = cm
-	wh.SetScheme(scheme)
-	if err = wh.clientManager.Validate(); err != nil {
-		t.Fatal(err)
-	}
-	namespace := "webhook-test"
-	wh.namespaceMatcher.NamespaceLister = fakeNamespaceLister{map[string]*corev1.Namespace{
-		namespace: {
-			ObjectMeta: metav1.ObjectMeta{
-				Labels: map[string]string{
-					"runlevel": "0",
-				},
-			},
-		},
-	},
-	}
-
-	// Set up a test object for the call
-	kind := corev1.SchemeGroupVersion.WithKind("Pod")
-	name := "my-pod"
-	object := corev1.Pod{
-		ObjectMeta: metav1.ObjectMeta{
-			Labels: map[string]string{
-				"pod.name": name,
-			},
-			Name:      name,
-			Namespace: namespace,
-		},
-		TypeMeta: metav1.TypeMeta{
-			APIVersion: "v1",
-			Kind:       "Pod",
-		},
-	}
-	oldObject := corev1.Pod{
-		ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: namespace},
-	}
-	operation := admission.Update
-	resource := corev1.Resource("pods").WithVersion("v1")
-	subResource := ""
-	userInfo := user.DefaultInfo{
-		Name: "webhook-test",
-		UID:  "webhook-test",
-	}
-
-	ccfgURL := urlConfigGenerator{serverURL}.ccfgURL
-
-	type test struct {
-		hookSource    fakeHookSource
-		path          string
-		expectAllow   bool
-		errorContains string
-	}
-
-	matchEverythingRules := []registrationv1beta1.RuleWithOperations{{
-		Operations: []registrationv1beta1.OperationType{registrationv1beta1.OperationAll},
-		Rule: registrationv1beta1.Rule{
-			APIGroups:   []string{"*"},
-			APIVersions: []string{"*"},
-			Resources:   []string{"*/*"},
-		},
-	}}
-
-	policyFail := registrationv1beta1.Fail
-	policyIgnore := registrationv1beta1.Ignore
-
-	table := map[string]test{
-		"no match": {
-			hookSource: fakeHookSource{
-				hooks: []registrationv1beta1.Webhook{{
-					Name:         "nomatch",
-					ClientConfig: ccfgSVC("disallow"),
-					Rules: []registrationv1beta1.RuleWithOperations{{
-						Operations: []registrationv1beta1.OperationType{registrationv1beta1.Create},
-					}},
-				}},
-			},
-			expectAllow: true,
-		},
-		"match & allow": {
-			hookSource: fakeHookSource{
-				hooks: []registrationv1beta1.Webhook{{
-					Name:         "allow",
-					ClientConfig: ccfgSVC("allow"),
-					Rules:        matchEverythingRules,
-				}},
-			},
-			expectAllow: true,
-		},
-		"match & disallow": {
-			hookSource: fakeHookSource{
-				hooks: []registrationv1beta1.Webhook{{
-					Name:         "disallow",
-					ClientConfig: ccfgSVC("disallow"),
-					Rules:        matchEverythingRules,
-				}},
-			},
-			errorContains: "without explanation",
-		},
-		"match & disallow ii": {
-			hookSource: fakeHookSource{
-				hooks: []registrationv1beta1.Webhook{{
-					Name:         "disallowReason",
-					ClientConfig: ccfgSVC("disallowReason"),
-					Rules:        matchEverythingRules,
-				}},
-			},
-			errorContains: "you shall not pass",
-		},
-		"match & disallow & but allowed because namespaceSelector exempt the namespace": {
-			hookSource: fakeHookSource{
-				hooks: []registrationv1beta1.Webhook{{
-					Name:         "disallow",
-					ClientConfig: ccfgSVC("disallow"),
-					Rules:        newMatchEverythingRules(),
-					NamespaceSelector: &metav1.LabelSelector{
-						MatchExpressions: []metav1.LabelSelectorRequirement{{
-							Key:      "runlevel",
-							Values:   []string{"1"},
-							Operator: metav1.LabelSelectorOpIn,
-						}},
-					},
-				}},
-			},
-			expectAllow: true,
-		},
-		"match & disallow & but allowed because namespaceSelector exempt the namespace ii": {
-			hookSource: fakeHookSource{
-				hooks: []registrationv1beta1.Webhook{{
-					Name:         "disallow",
-					ClientConfig: ccfgSVC("disallow"),
-					Rules:        newMatchEverythingRules(),
-					NamespaceSelector: &metav1.LabelSelector{
-						MatchExpressions: []metav1.LabelSelectorRequirement{{
-							Key:      "runlevel",
-							Values:   []string{"0"},
-							Operator: metav1.LabelSelectorOpNotIn,
-						}},
-					},
-				}},
-			},
-			expectAllow: true,
-		},
-		"match & fail (but allow because fail open)": {
-			hookSource: fakeHookSource{
-				hooks: []registrationv1beta1.Webhook{{
-					Name:          "internalErr A",
-					ClientConfig:  ccfgSVC("internalErr"),
-					Rules:         matchEverythingRules,
-					FailurePolicy: &policyIgnore,
-				}, {
-					Name:          "internalErr B",
-					ClientConfig:  ccfgSVC("internalErr"),
-					Rules:         matchEverythingRules,
-					FailurePolicy: &policyIgnore,
-				}, {
-					Name:          "internalErr C",
-					ClientConfig:  ccfgSVC("internalErr"),
-					Rules:         matchEverythingRules,
-					FailurePolicy: &policyIgnore,
-				}},
-			},
-			expectAllow: true,
-		},
-		"match & fail (but disallow because fail closed on nil)": {
-			hookSource: fakeHookSource{
-				hooks: []registrationv1beta1.Webhook{{
-					Name:         "internalErr A",
-					ClientConfig: ccfgSVC("internalErr"),
-					Rules:        matchEverythingRules,
-				}, {
-					Name:         "internalErr B",
-					ClientConfig: ccfgSVC("internalErr"),
-					Rules:        matchEverythingRules,
-				}, {
-					Name:         "internalErr C",
-					ClientConfig: ccfgSVC("internalErr"),
-					Rules:        matchEverythingRules,
-				}},
-			},
-			expectAllow: false,
-		},
-		"match & fail (but fail because fail closed)": {
-			hookSource: fakeHookSource{
-				hooks: []registrationv1beta1.Webhook{{
-					Name:          "internalErr A",
-					ClientConfig:  ccfgSVC("internalErr"),
-					Rules:         matchEverythingRules,
-					FailurePolicy: &policyFail,
-				}, {
-					Name:          "internalErr B",
-					ClientConfig:  ccfgSVC("internalErr"),
-					Rules:         matchEverythingRules,
-					FailurePolicy: &policyFail,
-				}, {
-					Name:          "internalErr C",
-					ClientConfig:  ccfgSVC("internalErr"),
-					Rules:         matchEverythingRules,
-					FailurePolicy: &policyFail,
-				}},
-			},
-			expectAllow: false,
-		},
-		"match & allow (url)": {
-			hookSource: fakeHookSource{
-				hooks: []registrationv1beta1.Webhook{{
-					Name:         "allow",
-					ClientConfig: ccfgURL("allow"),
-					Rules:        matchEverythingRules,
-				}},
-			},
-			expectAllow: true,
-		},
-		"match & disallow (url)": {
-			hookSource: fakeHookSource{
-				hooks: []registrationv1beta1.Webhook{{
-					Name:         "disallow",
-					ClientConfig: ccfgURL("disallow"),
-					Rules:        matchEverythingRules,
-				}},
-			},
-			errorContains: "without explanation",
-		},
-		// No need to test everything with the url case, since only the
-		// connection is different.
-	}
-
-	for name, tt := range table {
-		if !strings.Contains(name, "no match") {
-			continue
-		}
-		t.Run(name, func(t *testing.T) {
-			wh.hookSource = &tt.hookSource
-			err = wh.Admit(admission.NewAttributesRecord(&object, &oldObject, kind, namespace, name, resource, subResource, operation, &userInfo))
-			if tt.expectAllow != (err == nil) {
-				t.Errorf("expected allowed=%v, but got err=%v", tt.expectAllow, err)
-			}
-			// ErrWebhookRejected is not an error for our purposes
-			if tt.errorContains != "" {
-				if err == nil || !strings.Contains(err.Error(), tt.errorContains) {
-					t.Errorf(" expected an error saying %q, but got %v", tt.errorContains, err)
-				}
-			}
-			if _, isStatusErr := err.(*apierrors.StatusError); err != nil && !isStatusErr {
-				t.Errorf("%s: expected a StatusError, got %T", name, err)
-			}
-		})
-	}
-}
-
-// TestAdmitCachedClient tests that MutatingWebhook#Admit should cache restClient
-func TestAdmitCachedClient(t *testing.T) {
-	scheme := runtime.NewScheme()
-	v1beta1.AddToScheme(scheme)
-	corev1.AddToScheme(scheme)
-
-	testServer := newTestServer(t)
-	testServer.StartTLS()
-	defer testServer.Close()
-	serverURL, err := url.ParseRequestURI(testServer.URL)
-	if err != nil {
-		t.Fatalf("this should never happen? %v", err)
-	}
-	wh, err := NewMutatingWebhook(nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	cm, err := config.NewClientManager()
-	if err != nil {
-		t.Fatalf("cannot create client manager: %v", err)
-	}
-	cm.SetServiceResolver(fakeServiceResolver{base: *serverURL})
-	wh.clientManager = cm
-	wh.SetScheme(scheme)
-	namespace := "webhook-test"
-	wh.namespaceMatcher.NamespaceLister = fakeNamespaceLister{map[string]*corev1.Namespace{
-		namespace: {
-			ObjectMeta: metav1.ObjectMeta{
-				Labels: map[string]string{
-					"runlevel": "0",
-				},
-			},
-		},
-	},
-	}
-
-	// Set up a test object for the call
-	kind := corev1.SchemeGroupVersion.WithKind("Pod")
-	name := "my-pod"
-	object := corev1.Pod{
-		ObjectMeta: metav1.ObjectMeta{
-			Labels: map[string]string{
-				"pod.name": name,
-			},
-			Name:      name,
-			Namespace: namespace,
-		},
-		TypeMeta: metav1.TypeMeta{
-			APIVersion: "v1",
-			Kind:       "Pod",
-		},
-	}
-	oldObject := corev1.Pod{
-		ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: namespace},
-	}
-	operation := admission.Update
-	resource := corev1.Resource("pods").WithVersion("v1")
-	subResource := ""
-	userInfo := user.DefaultInfo{
-		Name: "webhook-test",
-		UID:  "webhook-test",
-	}
-	ccfgURL := urlConfigGenerator{serverURL}.ccfgURL
-
-	type test struct {
-		name        string
-		hookSource  fakeHookSource
-		expectAllow bool
-		expectCache bool
-	}
-
-	policyIgnore := registrationv1beta1.Ignore
-	cases := []test{
-		{
-			name: "cache 1",
-			hookSource: fakeHookSource{
-				hooks: []registrationv1beta1.Webhook{{
-					Name:          "cache1",
-					ClientConfig:  ccfgSVC("allow"),
-					Rules:         newMatchEverythingRules(),
-					FailurePolicy: &policyIgnore,
-				}},
-			},
-			expectAllow: true,
-			expectCache: true,
-		},
-		{
-			name: "cache 2",
-			hookSource: fakeHookSource{
-				hooks: []registrationv1beta1.Webhook{{
-					Name:          "cache2",
-					ClientConfig:  ccfgSVC("internalErr"),
-					Rules:         newMatchEverythingRules(),
-					FailurePolicy: &policyIgnore,
-				}},
-			},
-			expectAllow: true,
-			expectCache: true,
-		},
-		{
-			name: "cache 3",
-			hookSource: fakeHookSource{
-				hooks: []registrationv1beta1.Webhook{{
-					Name:          "cache3",
-					ClientConfig:  ccfgSVC("allow"),
-					Rules:         newMatchEverythingRules(),
-					FailurePolicy: &policyIgnore,
-				}},
-			},
-			expectAllow: true,
-			expectCache: false,
-		},
-		{
-			name: "cache 4",
-			hookSource: fakeHookSource{
-				hooks: []registrationv1beta1.Webhook{{
-					Name:          "cache4",
-					ClientConfig:  ccfgURL("allow"),
-					Rules:         newMatchEverythingRules(),
-					FailurePolicy: &policyIgnore,
-				}},
-			},
-			expectAllow: true,
-			expectCache: true,
-		},
-		{
-			name: "cache 5",
-			hookSource: fakeHookSource{
-				hooks: []registrationv1beta1.Webhook{{
-					Name:          "cache5",
-					ClientConfig:  ccfgURL("allow"),
-					Rules:         newMatchEverythingRules(),
-					FailurePolicy: &policyIgnore,
-				}},
-			},
-			expectAllow: true,
-			expectCache: false,
-		},
-	}
-
-	for _, testcase := range cases {
-		t.Run(testcase.name, func(t *testing.T) {
-			wh.hookSource = &testcase.hookSource
-			authInfoResolverCount := new(int32)
-			r := newFakeAuthenticationInfoResolver(authInfoResolverCount)
-			wh.clientManager.SetAuthenticationInfoResolver(r)
-			if err = wh.clientManager.Validate(); err != nil {
-				t.Fatal(err)
-			}
-
-			err = wh.Admit(admission.NewAttributesRecord(&object, &oldObject, kind, namespace, testcase.name, resource, subResource, operation, &userInfo))
-			if testcase.expectAllow != (err == nil) {
-				t.Errorf("expected allowed=%v, but got err=%v", testcase.expectAllow, err)
-			}
-
-			if testcase.expectCache && *authInfoResolverCount != 1 {
-				t.Errorf("expected cacheclient, but got none")
-			}
-
-			if !testcase.expectCache && *authInfoResolverCount != 0 {
-				t.Errorf("expected not cacheclient, but got cache")
-			}
-		})
-	}
-
-}
-
-func newTestServer(t *testing.T) *httptest.Server {
-	// Create the test webhook server
-	sCert, err := tls.X509KeyPair(testcerts.ServerCert, testcerts.ServerKey)
-	if err != nil {
-		t.Fatal(err)
-	}
-	rootCAs := x509.NewCertPool()
-	rootCAs.AppendCertsFromPEM(testcerts.CACert)
-	testServer := httptest.NewUnstartedServer(http.HandlerFunc(webhookHandler))
-	testServer.TLS = &tls.Config{
-		Certificates: []tls.Certificate{sCert},
-		ClientCAs:    rootCAs,
-		ClientAuth:   tls.RequireAndVerifyClientCert,
-	}
-	return testServer
-}
-
-func webhookHandler(w http.ResponseWriter, r *http.Request) {
-	fmt.Printf("got req: %v\n", r.URL.Path)
-	switch r.URL.Path {
-	case "/internalErr":
-		http.Error(w, "webhook internal server error", http.StatusInternalServerError)
-		return
-	case "/invalidReq":
-		w.WriteHeader(http.StatusSwitchingProtocols)
-		w.Write([]byte("webhook invalid request"))
-		return
-	case "/invalidResp":
-		w.Header().Set("Content-Type", "application/json")
-		w.Write([]byte("webhook invalid response"))
-	case "/disallow":
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(&v1beta1.AdmissionReview{
-			Response: &v1beta1.AdmissionResponse{
-				Allowed: false,
-			},
-		})
-	case "/disallowReason":
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(&v1beta1.AdmissionReview{
-			Response: &v1beta1.AdmissionResponse{
-				Allowed: false,
-				Result: &metav1.Status{
-					Message: "you shall not pass",
-				},
-			},
-		})
-	case "/allow":
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(&v1beta1.AdmissionReview{
-			Response: &v1beta1.AdmissionResponse{
-				Allowed: true,
-			},
-		})
-	default:
-		http.NotFound(w, r)
-	}
-}
-
-func newFakeAuthenticationInfoResolver(count *int32) *fakeAuthenticationInfoResolver {
-	return &fakeAuthenticationInfoResolver{
-		restConfig: &rest.Config{
-			TLSClientConfig: rest.TLSClientConfig{
-				CAData:   testcerts.CACert,
-				CertData: testcerts.ClientCert,
-				KeyData:  testcerts.ClientKey,
-			},
-		},
-		cachedCount: count,
-	}
-}
-
-type fakeAuthenticationInfoResolver struct {
-	restConfig  *rest.Config
-	cachedCount *int32
-}
-
-func (c *fakeAuthenticationInfoResolver) ClientConfigFor(server string) (*rest.Config, error) {
-	atomic.AddInt32(c.cachedCount, 1)
-	return c.restConfig, nil
-}
-
-func newMatchEverythingRules() []registrationv1beta1.RuleWithOperations {
-	return []registrationv1beta1.RuleWithOperations{{
-		Operations: []registrationv1beta1.OperationType{registrationv1beta1.OperationAll},
-		Rule: registrationv1beta1.Rule{
-			APIGroups:   []string{"*"},
-			APIVersions: []string{"*"},
-			Resources:   []string{"*/*"},
-		},
-	}}
-}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/mutating/dispatcher.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/mutating/dispatcher.go
@@ -0,0 +1,425 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package mutating delegates admission checks to dynamically configured
+// mutating webhooks.
+package mutating
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	jsonpatch "github.com/evanphx/json-patch"
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	"k8s.io/klog"
+
+	admissionv1 "k8s.io/api/admission/v1"
+	"k8s.io/api/admissionregistration/v1beta1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/serializer/json"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apiserver/pkg/admission"
+	admissionmetrics "k8s.io/apiserver/pkg/admission/metrics"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook"
+	webhookerrors "k8s.io/apiserver/pkg/admission/plugin/webhook/errors"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook/generic"
+	webhookrequest "k8s.io/apiserver/pkg/admission/plugin/webhook/request"
+	auditinternal "k8s.io/apiserver/pkg/apis/audit"
+	webhookutil "k8s.io/apiserver/pkg/util/webhook"
+	utiltrace "k8s.io/utils/trace"
+)
+
+const (
+	// PatchAuditAnnotationPrefix is a prefix for persisting webhook patch in audit annotation.
+	// Audit handler decides whether annotation with this prefix should be logged based on audit level.
+	// Since mutating webhook patches the request body, audit level must be greater or equal to Request
+	// for the annotation to be logged
+	PatchAuditAnnotationPrefix = "patch.webhook.admission.k8s.io/"
+	// MutationAuditAnnotationPrefix is a prefix for presisting webhook mutation existence in audit annotation.
+	MutationAuditAnnotationPrefix = "mutation.webhook.admission.k8s.io/"
+)
+
+var encodingjson = json.CaseSensitiveJsonIterator()
+
+type mutatingDispatcher struct {
+	cm     *webhookutil.ClientManager
+	plugin *Plugin
+}
+
+func newMutatingDispatcher(p *Plugin) func(cm *webhookutil.ClientManager) generic.Dispatcher {
+	return func(cm *webhookutil.ClientManager) generic.Dispatcher {
+		return &mutatingDispatcher{cm, p}
+	}
+}
+
+var _ generic.Dispatcher = &mutatingDispatcher{}
+
+func (a *mutatingDispatcher) Dispatch(ctx context.Context, attr admission.Attributes, o admission.ObjectInterfaces, hooks []webhook.WebhookAccessor) error {
+	reinvokeCtx := attr.GetReinvocationContext()
+	var webhookReinvokeCtx *webhookReinvokeContext
+	if v := reinvokeCtx.Value(PluginName); v != nil {
+		webhookReinvokeCtx = v.(*webhookReinvokeContext)
+	} else {
+		webhookReinvokeCtx = &webhookReinvokeContext{}
+		reinvokeCtx.SetValue(PluginName, webhookReinvokeCtx)
+	}
+
+	if reinvokeCtx.IsReinvoke() && webhookReinvokeCtx.IsOutputChangedSinceLastWebhookInvocation(attr.GetObject()) {
+		// If the object has changed, we know the in-tree plugin re-invocations have mutated the object,
+		// and we need to reinvoke all eligible webhooks.
+		webhookReinvokeCtx.RequireReinvokingPreviouslyInvokedPlugins()
+	}
+	defer func() {
+		webhookReinvokeCtx.SetLastWebhookInvocationOutput(attr.GetObject())
+	}()
+	var versionedAttr *generic.VersionedAttributes
+	for i, hook := range hooks {
+		attrForCheck := attr
+		if versionedAttr != nil {
+			attrForCheck = versionedAttr
+		}
+		invocation, statusErr := a.plugin.ShouldCallHook(hook, attrForCheck, o)
+		if statusErr != nil {
+			return statusErr
+		}
+		if invocation == nil {
+			continue
+		}
+		hook, ok := invocation.Webhook.GetMutatingWebhook()
+		if !ok {
+			return fmt.Errorf("mutating webhook dispatch requires v1beta1.MutatingWebhook, but got %T", hook)
+		}
+		// This means that during reinvocation, a webhook will not be
+		// called for the first time. For example, if the webhook is
+		// skipped in the first round because of mismatching labels,
+		// even if the labels become matching, the webhook does not
+		// get called during reinvocation.
+		if reinvokeCtx.IsReinvoke() && !webhookReinvokeCtx.ShouldReinvokeWebhook(invocation.Webhook.GetUID()) {
+			continue
+		}
+
+		if versionedAttr == nil {
+			// First webhook, create versioned attributes
+			var err error
+			if versionedAttr, err = generic.NewVersionedAttributes(attr, invocation.Kind, o); err != nil {
+				return apierrors.NewInternalError(err)
+			}
+		} else {
+			// Subsequent webhook, convert existing versioned attributes to this webhook's version
+			if err := generic.ConvertVersionedAttributes(versionedAttr, invocation.Kind, o); err != nil {
+				return apierrors.NewInternalError(err)
+			}
+		}
+
+		t := time.Now()
+		round := 0
+		if reinvokeCtx.IsReinvoke() {
+			round = 1
+		}
+		changed, err := a.callAttrMutatingHook(ctx, hook, invocation, versionedAttr, o, round, i)
+		ignoreClientCallFailures := hook.FailurePolicy != nil && *hook.FailurePolicy == v1beta1.Ignore
+		rejected := false
+		if err != nil {
+			switch err := err.(type) {
+			case *webhookutil.ErrCallingWebhook:
+				if !ignoreClientCallFailures {
+					rejected = true
+					admissionmetrics.Metrics.ObserveWebhookRejection(hook.Name, "admit", string(versionedAttr.Attributes.GetOperation()), admissionmetrics.WebhookRejectionCallingWebhookError, 0)
+				}
+			case *webhookutil.ErrWebhookRejection:
+				rejected = true
+				admissionmetrics.Metrics.ObserveWebhookRejection(hook.Name, "admit", string(versionedAttr.Attributes.GetOperation()), admissionmetrics.WebhookRejectionNoError, int(err.Status.ErrStatus.Code))
+			default:
+				rejected = true
+				admissionmetrics.Metrics.ObserveWebhookRejection(hook.Name, "admit", string(versionedAttr.Attributes.GetOperation()), admissionmetrics.WebhookRejectionAPIServerInternalError, 0)
+			}
+		}
+		admissionmetrics.Metrics.ObserveWebhook(time.Since(t), rejected, versionedAttr.Attributes, "admit", hook.Name)
+		if changed {
+			// Patch had changed the object. Prepare to reinvoke all previous webhooks that are eligible for re-invocation.
+			webhookReinvokeCtx.RequireReinvokingPreviouslyInvokedPlugins()
+			reinvokeCtx.SetShouldReinvoke()
+		}
+		if hook.ReinvocationPolicy != nil && *hook.ReinvocationPolicy == v1beta1.IfNeededReinvocationPolicy {
+			webhookReinvokeCtx.AddReinvocableWebhookToPreviouslyInvoked(invocation.Webhook.GetUID())
+		}
+		if err == nil {
+			continue
+		}
+
+		if callErr, ok := err.(*webhookutil.ErrCallingWebhook); ok {
+			if ignoreClientCallFailures {
+				klog.Warningf("Failed calling webhook, failing open %v: %v", hook.Name, callErr)
+				utilruntime.HandleError(callErr)
+
+				select {
+				case <-ctx.Done():
+					// parent context is canceled or timed out, no point in continuing
+					return apierrors.NewTimeoutError("request did not complete within requested timeout", 0)
+				default:
+					// individual webhook timed out, but parent context did not, continue
+					continue
+				}
+			}
+			klog.Warningf("Failed calling webhook, failing closed %v: %v", hook.Name, err)
+			return apierrors.NewInternalError(err)
+		}
+		if rejectionErr, ok := err.(*webhookutil.ErrWebhookRejection); ok {
+			return rejectionErr.Status
+		}
+		return err
+	}
+
+	// convert versionedAttr.VersionedObject to the internal version in the underlying admission.Attributes
+	if versionedAttr != nil && versionedAttr.VersionedObject != nil && versionedAttr.Dirty {
+		return o.GetObjectConvertor().Convert(versionedAttr.VersionedObject, versionedAttr.Attributes.GetObject(), nil)
+	}
+
+	return nil
+}
+
+// note that callAttrMutatingHook updates attr
+
+func (a *mutatingDispatcher) callAttrMutatingHook(ctx context.Context, h *v1beta1.MutatingWebhook, invocation *generic.WebhookInvocation, attr *generic.VersionedAttributes, o admission.ObjectInterfaces, round, idx int) (bool, error) {
+	configurationName := invocation.Webhook.GetConfigurationName()
+	annotator := newWebhookAnnotator(attr, round, idx, h.Name, configurationName)
+	changed := false
+	defer func() { annotator.addMutationAnnotation(changed) }()
+	if attr.Attributes.IsDryRun() {
+		if h.SideEffects == nil {
+			return false, &webhookutil.ErrCallingWebhook{WebhookName: h.Name, Reason: fmt.Errorf("Webhook SideEffects is nil")}
+		}
+		if !(*h.SideEffects == v1beta1.SideEffectClassNone || *h.SideEffects == v1beta1.SideEffectClassNoneOnDryRun) {
+			return false, webhookerrors.NewDryRunUnsupportedErr(h.Name)
+		}
+	}
+
+	uid, request, response, err := webhookrequest.CreateAdmissionObjects(attr, invocation)
+	if err != nil {
+		return false, &webhookutil.ErrCallingWebhook{WebhookName: h.Name, Reason: err}
+	}
+	// Make the webhook request
+	client, err := invocation.Webhook.GetRESTClient(a.cm)
+	if err != nil {
+		return false, &webhookutil.ErrCallingWebhook{WebhookName: h.Name, Reason: err}
+	}
+	trace := utiltrace.New("Call mutating webhook",
+		utiltrace.Field{"configuration", configurationName},
+		utiltrace.Field{"webhook", h.Name},
+		utiltrace.Field{"resource", attr.GetResource()},
+		utiltrace.Field{"subresource", attr.GetSubresource()},
+		utiltrace.Field{"operation", attr.GetOperation()},
+		utiltrace.Field{"UID", uid})
+	defer trace.LogIfLong(500 * time.Millisecond)
+
+	// if the webhook has a specific timeout, wrap the context to apply it
+	if h.TimeoutSeconds != nil {
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithTimeout(ctx, time.Duration(*h.TimeoutSeconds)*time.Second)
+		defer cancel()
+	}
+
+	r := client.Post().Context(ctx).Body(request)
+
+	// if the context has a deadline, set it as a parameter to inform the backend
+	if deadline, hasDeadline := ctx.Deadline(); hasDeadline {
+		// compute the timeout
+		if timeout := time.Until(deadline); timeout > 0 {
+			// if it's not an even number of seconds, round up to the nearest second
+			if truncated := timeout.Truncate(time.Second); truncated != timeout {
+				timeout = truncated + time.Second
+			}
+			// set the timeout
+			r.Timeout(timeout)
+		}
+	}
+
+	if err := r.Do().Into(response); err != nil {
+		return false, &webhookutil.ErrCallingWebhook{WebhookName: h.Name, Reason: err}
+	}
+	trace.Step("Request completed")
+
+	result, err := webhookrequest.VerifyAdmissionResponse(uid, true, response)
+	if err != nil {
+		return false, &webhookutil.ErrCallingWebhook{WebhookName: h.Name, Reason: err}
+	}
+
+	for k, v := range result.AuditAnnotations {
+		key := h.Name + "/" + k
+		if err := attr.Attributes.AddAnnotation(key, v); err != nil {
+			klog.Warningf("Failed to set admission audit annotation %s to %s for mutating webhook %s: %v", key, v, h.Name, err)
+		}
+	}
+
+	if !result.Allowed {
+		return false, &webhookutil.ErrWebhookRejection{Status: webhookerrors.ToStatusErr(h.Name, result.Result)}
+	}
+
+	if len(result.Patch) == 0 {
+		return false, nil
+	}
+	patchObj, err := jsonpatch.DecodePatch(result.Patch)
+	if err != nil {
+		return false, apierrors.NewInternalError(err)
+	}
+
+	if len(patchObj) == 0 {
+		return false, nil
+	}
+
+	// if a non-empty patch was provided, and we have no object we can apply it to (e.g. a DELETE admission operation), error
+	if attr.VersionedObject == nil {
+		return false, apierrors.NewInternalError(fmt.Errorf("admission webhook %q attempted to modify the object, which is not supported for this operation", h.Name))
+	}
+
+	var patchedJS []byte
+	jsonSerializer := json.NewSerializer(json.DefaultMetaFactory, o.GetObjectCreater(), o.GetObjectTyper(), false)
+	switch result.PatchType {
+	// VerifyAdmissionResponse normalizes to v1 patch types, regardless of the AdmissionReview version used
+	case admissionv1.PatchTypeJSONPatch:
+		objJS, err := runtime.Encode(jsonSerializer, attr.VersionedObject)
+		if err != nil {
+			return false, apierrors.NewInternalError(err)
+		}
+		patchedJS, err = patchObj.Apply(objJS)
+		if err != nil {
+			return false, apierrors.NewInternalError(err)
+		}
+	default:
+		return false, &webhookutil.ErrCallingWebhook{WebhookName: h.Name, Reason: fmt.Errorf("unsupported patch type %q", result.PatchType)}
+	}
+
+	var newVersionedObject runtime.Object
+	if _, ok := attr.VersionedObject.(*unstructured.Unstructured); ok {
+		// Custom Resources don't have corresponding Go struct's.
+		// They are represented as Unstructured.
+		newVersionedObject = &unstructured.Unstructured{}
+	} else {
+		newVersionedObject, err = o.GetObjectCreater().New(attr.VersionedKind)
+		if err != nil {
+			return false, apierrors.NewInternalError(err)
+		}
+	}
+
+	// TODO: if we have multiple mutating webhooks, we can remember the json
+	// instead of encoding and decoding for each one.
+	if newVersionedObject, _, err = jsonSerializer.Decode(patchedJS, nil, newVersionedObject); err != nil {
+		return false, apierrors.NewInternalError(err)
+	}
+
+	changed = !apiequality.Semantic.DeepEqual(attr.VersionedObject, newVersionedObject)
+	trace.Step("Patch applied")
+	annotator.addPatchAnnotation(patchObj, result.PatchType)
+	attr.Dirty = true
+	attr.VersionedObject = newVersionedObject
+	o.GetObjectDefaulter().Default(attr.VersionedObject)
+	return changed, nil
+}
+
+type webhookAnnotator struct {
+	attr                  *generic.VersionedAttributes
+	patchAnnotationKey    string
+	mutationAnnotationKey string
+	webhook               string
+	configuration         string
+}
+
+func newWebhookAnnotator(attr *generic.VersionedAttributes, round, idx int, webhook, configuration string) *webhookAnnotator {
+	return &webhookAnnotator{
+		attr:                  attr,
+		patchAnnotationKey:    fmt.Sprintf("%sround_%d_index_%d", PatchAuditAnnotationPrefix, round, idx),
+		mutationAnnotationKey: fmt.Sprintf("%sround_%d_index_%d", MutationAuditAnnotationPrefix, round, idx),
+		webhook:               webhook,
+		configuration:         configuration,
+	}
+}
+
+func (w *webhookAnnotator) addMutationAnnotation(mutated bool) {
+	if w.attr == nil || w.attr.Attributes == nil {
+		return
+	}
+	value, err := mutationAnnotationValue(w.configuration, w.webhook, mutated)
+	if err != nil {
+		klog.Warningf("unexpected error composing mutating webhook annotation: %v", err)
+		return
+	}
+	if err := w.attr.Attributes.AddAnnotation(w.mutationAnnotationKey, value); err != nil {
+		klog.Warningf("failed to set mutation annotation for mutating webhook key %s to %s: %v", w.mutationAnnotationKey, value, err)
+	}
+}
+
+func (w *webhookAnnotator) addPatchAnnotation(patch interface{}, patchType admissionv1.PatchType) {
+	if w.attr == nil || w.attr.Attributes == nil {
+		return
+	}
+	var value string
+	var err error
+	switch patchType {
+	case admissionv1.PatchTypeJSONPatch:
+		value, err = jsonPatchAnnotationValue(w.configuration, w.webhook, patch)
+		if err != nil {
+			klog.Warningf("unexpected error composing mutating webhook JSON patch annotation: %v", err)
+			return
+		}
+	default:
+		klog.Warningf("unsupported patch type for mutating webhook annotation: %v", patchType)
+		return
+	}
+	if err := w.attr.Attributes.AddAnnotationWithLevel(w.patchAnnotationKey, value, auditinternal.LevelRequest); err != nil {
+		// NOTE: we don't log actual patch in kube-apiserver log to avoid potentially
+		// leaking information
+		klog.Warningf("failed to set patch annotation for mutating webhook key %s; confugiration name: %s, webhook name: %s", w.patchAnnotationKey, w.configuration, w.webhook)
+	}
+}
+
+// MutationAuditAnnotation logs if a webhook invocation mutated the request object
+type MutationAuditAnnotation struct {
+	Configuration string `json:"configuration"`
+	Webhook       string `json:"webhook"`
+	Mutated       bool   `json:"mutated"`
+}
+
+// PatchAuditAnnotation logs a patch from a mutating webhook
+type PatchAuditAnnotation struct {
+	Configuration string      `json:"configuration"`
+	Webhook       string      `json:"webhook"`
+	Patch         interface{} `json:"patch,omitempty"`
+	PatchType     string      `json:"patchType,omitempty"`
+}
+
+func mutationAnnotationValue(configuration, webhook string, mutated bool) (string, error) {
+	m := MutationAuditAnnotation{
+		Configuration: configuration,
+		Webhook:       webhook,
+		Mutated:       mutated,
+	}
+	bytes, err := encodingjson.Marshal(m)
+	return string(bytes), err
+}
+
+func jsonPatchAnnotationValue(configuration, webhook string, patch interface{}) (string, error) {
+	p := PatchAuditAnnotation{
+		Configuration: configuration,
+		Webhook:       webhook,
+		Patch:         patch,
+		PatchType:     string(admissionv1.PatchTypeJSONPatch),
+	}
+	bytes, err := encodingjson.Marshal(p)
+	return string(bytes), err
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/mutating/dispatcher_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/mutating/dispatcher_test.go
@@ -0,0 +1,133 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package mutating
+
+import (
+	"encoding/json"
+	"reflect"
+	"testing"
+
+	jsonpatch "github.com/evanphx/json-patch"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestMutationAnnotationValue(t *testing.T) {
+	tcs := []struct {
+		config   string
+		webhook  string
+		mutated  bool
+		expected string
+	}{
+		{
+			config:   "test-config",
+			webhook:  "test-webhook",
+			mutated:  true,
+			expected: `{"configuration":"test-config","webhook":"test-webhook","mutated":true}`,
+		},
+		{
+			config:   "test-config",
+			webhook:  "test-webhook",
+			mutated:  false,
+			expected: `{"configuration":"test-config","webhook":"test-webhook","mutated":false}`,
+		},
+	}
+
+	for _, tc := range tcs {
+		actual, err := mutationAnnotationValue(tc.config, tc.webhook, tc.mutated)
+		assert.NoError(t, err, "unexpected error")
+		if actual != tc.expected {
+			t.Errorf("composed mutation annotation value doesn't match, want: %s, got: %s", tc.expected, actual)
+		}
+	}
+}
+
+func TestJSONPatchAnnotationValue(t *testing.T) {
+	tcs := []struct {
+		name     string
+		config   string
+		webhook  string
+		patch    []byte
+		expected string
+	}{
+		{
+			name:     "valid patch annotation",
+			config:   "test-config",
+			webhook:  "test-webhook",
+			patch:    []byte(`[{"op": "add", "path": "/metadata/labels/a", "value": "true"}]`),
+			expected: `{"configuration":"test-config","webhook":"test-webhook","patch":[{"op":"add","path":"/metadata/labels/a","value":"true"}],"patchType":"JSONPatch"}`,
+		},
+		{
+			name:     "empty configuration",
+			config:   "",
+			webhook:  "test-webhook",
+			patch:    []byte(`[{"op": "add", "path": "/metadata/labels/a", "value": "true"}]`),
+			expected: `{"configuration":"","webhook":"test-webhook","patch":[{"op":"add","path":"/metadata/labels/a","value":"true"}],"patchType":"JSONPatch"}`,
+		},
+		{
+			name:     "empty webhook",
+			config:   "test-config",
+			webhook:  "",
+			patch:    []byte(`[{"op": "add", "path": "/metadata/labels/a", "value": "true"}]`),
+			expected: `{"configuration":"test-config","webhook":"","patch":[{"op":"add","path":"/metadata/labels/a","value":"true"}],"patchType":"JSONPatch"}`,
+		},
+		{
+			name:     "valid JSON patch empty operation",
+			config:   "test-config",
+			webhook:  "test-webhook",
+			patch:    []byte("[{}]"),
+			expected: `{"configuration":"test-config","webhook":"test-webhook","patch":[{}],"patchType":"JSONPatch"}`,
+		},
+		{
+			name:     "empty slice patch",
+			config:   "test-config",
+			webhook:  "test-webhook",
+			patch:    []byte("[]"),
+			expected: `{"configuration":"test-config","webhook":"test-webhook","patch":[],"patchType":"JSONPatch"}`,
+		},
+	}
+
+	for _, tc := range tcs {
+		t.Run(tc.name, func(t *testing.T) {
+			jsonPatch, err := jsonpatch.DecodePatch(tc.patch)
+			assert.NoError(t, err, "unexpected error decode patch")
+			actual, err := jsonPatchAnnotationValue(tc.config, tc.webhook, jsonPatch)
+			assert.NoError(t, err, "unexpected error getting json patch annotation")
+			if actual != tc.expected {
+				t.Errorf("composed patch annotation value doesn't match, want: %s, got: %s", tc.expected, actual)
+			}
+
+			var p map[string]interface{}
+			if err := json.Unmarshal([]byte(actual), &p); err != nil {
+				t.Errorf("unexpected error unmarshaling patch annotation: %v", err)
+			}
+			if p["configuration"] != tc.config {
+				t.Errorf("unmarshaled configuration doesn't match, want: %s, got: %v", tc.config, p["configuration"])
+			}
+			if p["webhook"] != tc.webhook {
+				t.Errorf("unmarshaled webhook doesn't match, want: %s, got: %v", tc.webhook, p["webhook"])
+			}
+			var expectedPatch interface{}
+			err = json.Unmarshal(tc.patch, &expectedPatch)
+			if err != nil {
+				t.Errorf("unexpected error unmarshaling patch: %v, %v", tc.patch, err)
+			}
+			if !reflect.DeepEqual(expectedPatch, p["patch"]) {
+				t.Errorf("unmarshaled patch doesn't match, want: %v, got: %v", expectedPatch, p["patch"])
+			}
+		})
+	}
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/mutating/plugin.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/mutating/plugin.go
@@ -0,0 +1,76 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package mutating
+
+import (
+	"context"
+	"io"
+
+	"k8s.io/apiserver/pkg/admission"
+	"k8s.io/apiserver/pkg/admission/configuration"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook/generic"
+)
+
+const (
+	// PluginName indicates the name of admission plug-in
+	PluginName = "MutatingAdmissionWebhook"
+)
+
+// Register registers a plugin
+func Register(plugins *admission.Plugins) {
+	plugins.Register(PluginName, func(configFile io.Reader) (admission.Interface, error) {
+		plugin, err := NewMutatingWebhook(configFile)
+		if err != nil {
+			return nil, err
+		}
+
+		return plugin, nil
+	})
+}
+
+// Plugin is an implementation of admission.Interface.
+type Plugin struct {
+	*generic.Webhook
+}
+
+var _ admission.MutationInterface = &Plugin{}
+
+// NewMutatingWebhook returns a generic admission webhook plugin.
+func NewMutatingWebhook(configFile io.Reader) (*Plugin, error) {
+	handler := admission.NewHandler(admission.Connect, admission.Create, admission.Delete, admission.Update)
+	p := &Plugin{}
+	var err error
+	p.Webhook, err = generic.NewWebhook(handler, configFile, configuration.NewMutatingWebhookConfigurationManager, newMutatingDispatcher(p))
+	if err != nil {
+		return nil, err
+	}
+
+	return p, nil
+}
+
+// ValidateInitialization implements the InitializationValidator interface.
+func (a *Plugin) ValidateInitialization() error {
+	if err := a.Webhook.ValidateInitialization(); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Admit makes an admission decision based on the request attributes.
+func (a *Plugin) Admit(ctx context.Context, attr admission.Attributes, o admission.ObjectInterfaces) error {
+	return a.Webhook.Dispatch(ctx, attr, o)
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/mutating/plugin_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/mutating/plugin_test.go
@@ -0,0 +1,253 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package mutating
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"os"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apiserver/pkg/admission"
+	webhooktesting "k8s.io/apiserver/pkg/admission/plugin/webhook/testing"
+	auditinternal "k8s.io/apiserver/pkg/apis/audit"
+)
+
+// BenchmarkAdmit tests the performance cost of invoking a mutating webhook
+func BenchmarkAdmit(b *testing.B) {
+	testServerURL := os.Getenv("WEBHOOK_TEST_SERVER_URL")
+	if len(testServerURL) == 0 {
+		b.Log("warning, WEBHOOK_TEST_SERVER_URL not set, starting in-process server, benchmarks will include webhook cost.")
+		b.Log("to run a standalone server, run:")
+		b.Log("go run ./vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/testing/main/main.go")
+		testServer := webhooktesting.NewTestServer(b)
+		testServer.StartTLS()
+		defer testServer.Close()
+		testServerURL = testServer.URL
+	}
+
+	serverURL, err := url.ParseRequestURI(testServerURL)
+	if err != nil {
+		b.Fatalf("this should never happen? %v", err)
+	}
+
+	objectInterfaces := webhooktesting.NewObjectInterfacesForTest()
+
+	stopCh := make(chan struct{})
+	defer close(stopCh)
+
+	testCases := append(webhooktesting.NewMutatingTestCases(serverURL, "test-webhooks"),
+		webhooktesting.ConvertToMutatingTestCases(webhooktesting.NewNonMutatingTestCases(serverURL), "test-webhooks")...)
+
+	for _, tt := range testCases {
+		// For now, skip failure cases or tests that explicitly skip benchmarking
+		if !tt.ExpectAllow || tt.SkipBenchmark {
+			continue
+		}
+		b.Run(tt.Name, func(b *testing.B) {
+			wh, err := NewMutatingWebhook(nil)
+			if err != nil {
+				b.Errorf("failed to create mutating webhook: %v", err)
+				return
+			}
+
+			ns := "webhook-test"
+			client, informer := webhooktesting.NewFakeMutatingDataSource(ns, tt.Webhooks, stopCh)
+
+			wh.SetAuthenticationInfoResolverWrapper(webhooktesting.Wrapper(webhooktesting.NewAuthenticationInfoResolver(new(int32))))
+			wh.SetServiceResolver(webhooktesting.NewServiceResolver(*serverURL))
+			wh.SetExternalKubeClientSet(client)
+			wh.SetExternalKubeInformerFactory(informer)
+
+			informer.Start(stopCh)
+			informer.WaitForCacheSync(stopCh)
+
+			if err = wh.ValidateInitialization(); err != nil {
+				b.Errorf("failed to validate initialization: %v", err)
+				return
+			}
+
+			var attr admission.Attributes
+			if tt.IsCRD {
+				attr = webhooktesting.NewAttributeUnstructured(ns, tt.AdditionalLabels, tt.IsDryRun)
+			} else {
+				attr = webhooktesting.NewAttribute(ns, tt.AdditionalLabels, tt.IsDryRun)
+			}
+
+			b.ResetTimer()
+			b.RunParallel(func(pb *testing.PB) {
+				for pb.Next() {
+					wh.Admit(context.TODO(), attr, objectInterfaces)
+				}
+			})
+		})
+	}
+}
+
+// TestAdmit tests that MutatingWebhook#Admit works as expected
+func TestAdmit(t *testing.T) {
+	testServer := webhooktesting.NewTestServer(t)
+	testServer.StartTLS()
+	defer testServer.Close()
+	serverURL, err := url.ParseRequestURI(testServer.URL)
+	if err != nil {
+		t.Fatalf("this should never happen? %v", err)
+	}
+
+	objectInterfaces := webhooktesting.NewObjectInterfacesForTest()
+
+	stopCh := make(chan struct{})
+	defer close(stopCh)
+
+	testCases := append(webhooktesting.NewMutatingTestCases(serverURL, "test-webhooks"),
+		webhooktesting.ConvertToMutatingTestCases(webhooktesting.NewNonMutatingTestCases(serverURL), "test-webhooks")...)
+
+	for _, tt := range testCases {
+		t.Run(tt.Name, func(t *testing.T) {
+			wh, err := NewMutatingWebhook(nil)
+			if err != nil {
+				t.Errorf("failed to create mutating webhook: %v", err)
+				return
+			}
+
+			ns := "webhook-test"
+			client, informer := webhooktesting.NewFakeMutatingDataSource(ns, tt.Webhooks, stopCh)
+
+			wh.SetAuthenticationInfoResolverWrapper(webhooktesting.Wrapper(webhooktesting.NewAuthenticationInfoResolver(new(int32))))
+			wh.SetServiceResolver(webhooktesting.NewServiceResolver(*serverURL))
+			wh.SetExternalKubeClientSet(client)
+			wh.SetExternalKubeInformerFactory(informer)
+
+			informer.Start(stopCh)
+			informer.WaitForCacheSync(stopCh)
+
+			if err = wh.ValidateInitialization(); err != nil {
+				t.Errorf("failed to validate initialization: %v", err)
+				return
+			}
+
+			var attr admission.Attributes
+			if tt.IsCRD {
+				attr = webhooktesting.NewAttributeUnstructured(ns, tt.AdditionalLabels, tt.IsDryRun)
+			} else {
+				attr = webhooktesting.NewAttribute(ns, tt.AdditionalLabels, tt.IsDryRun)
+			}
+
+			err = wh.Admit(context.TODO(), attr, objectInterfaces)
+			if tt.ExpectAllow != (err == nil) {
+				t.Errorf("expected allowed=%v, but got err=%v", tt.ExpectAllow, err)
+			}
+			if tt.ExpectLabels != nil {
+				if !reflect.DeepEqual(tt.ExpectLabels, attr.GetObject().(metav1.Object).GetLabels()) {
+					t.Errorf("expected labels '%v', but got '%v'", tt.ExpectLabels, attr.GetObject().(metav1.Object).GetLabels())
+				}
+			}
+			// ErrWebhookRejected is not an error for our purposes
+			if tt.ErrorContains != "" {
+				if err == nil || !strings.Contains(err.Error(), tt.ErrorContains) {
+					t.Errorf("expected an error saying %q, but got: %v", tt.ErrorContains, err)
+				}
+			}
+			if statusErr, isStatusErr := err.(*errors.StatusError); err != nil && !isStatusErr {
+				t.Errorf("expected a StatusError, got %T", err)
+			} else if isStatusErr {
+				if statusErr.ErrStatus.Code != tt.ExpectStatusCode {
+					t.Errorf("expected status code %d, got %d", tt.ExpectStatusCode, statusErr.ErrStatus.Code)
+				}
+			}
+			fakeAttr, ok := attr.(*webhooktesting.FakeAttributes)
+			if !ok {
+				t.Errorf("Unexpected error, failed to convert attr to webhooktesting.FakeAttributes")
+				return
+			}
+			if len(tt.ExpectAnnotations) == 0 {
+				assert.Empty(t, fakeAttr.GetAnnotations(auditinternal.LevelMetadata), tt.Name+": annotations not set as expected.")
+			} else {
+				assert.Equal(t, tt.ExpectAnnotations, fakeAttr.GetAnnotations(auditinternal.LevelMetadata), tt.Name+": annotations not set as expected.")
+			}
+			reinvocationCtx := fakeAttr.Attributes.GetReinvocationContext()
+			reinvocationCtx.SetIsReinvoke()
+			for webhook, expectReinvoke := range tt.ExpectReinvokeWebhooks {
+				shouldReinvoke := reinvocationCtx.Value(PluginName).(*webhookReinvokeContext).ShouldReinvokeWebhook(fmt.Sprintf("test-webhooks/%s/0", webhook))
+				if expectReinvoke != shouldReinvoke {
+					t.Errorf("expected reinvocationContext.ShouldReinvokeWebhook(%s)=%t, but got %t", webhook, expectReinvoke, shouldReinvoke)
+				}
+			}
+		})
+	}
+}
+
+// TestAdmitCachedClient tests that MutatingWebhook#Admit should cache restClient
+func TestAdmitCachedClient(t *testing.T) {
+	testServer := webhooktesting.NewTestServer(t)
+	testServer.StartTLS()
+	defer testServer.Close()
+	serverURL, err := url.ParseRequestURI(testServer.URL)
+	if err != nil {
+		t.Fatalf("this should never happen? %v", err)
+	}
+
+	objectInterfaces := webhooktesting.NewObjectInterfacesForTest()
+
+	stopCh := make(chan struct{})
+	defer close(stopCh)
+
+	wh, err := NewMutatingWebhook(nil)
+	if err != nil {
+		t.Fatalf("Failed to create mutating webhook: %v", err)
+	}
+	wh.SetServiceResolver(webhooktesting.NewServiceResolver(*serverURL))
+
+	for _, tt := range webhooktesting.NewCachedClientTestcases(serverURL) {
+		ns := "webhook-test"
+		client, informer := webhooktesting.NewFakeMutatingDataSource(ns, webhooktesting.ConvertToMutatingWebhooks(tt.Webhooks), stopCh)
+
+		// override the webhook source. The client cache will stay the same.
+		cacheMisses := new(int32)
+		wh.SetAuthenticationInfoResolverWrapper(webhooktesting.Wrapper(webhooktesting.NewAuthenticationInfoResolver(cacheMisses)))
+		wh.SetExternalKubeClientSet(client)
+		wh.SetExternalKubeInformerFactory(informer)
+
+		informer.Start(stopCh)
+		informer.WaitForCacheSync(stopCh)
+
+		if err = wh.ValidateInitialization(); err != nil {
+			t.Errorf("%s: failed to validate initialization: %v", tt.Name, err)
+			continue
+		}
+
+		err = wh.Admit(context.TODO(), webhooktesting.NewAttribute(ns, nil, false), objectInterfaces)
+		if tt.ExpectAllow != (err == nil) {
+			t.Errorf("%s: expected allowed=%v, but got err=%v", tt.Name, tt.ExpectAllow, err)
+		}
+
+		if tt.ExpectCacheMiss && *cacheMisses == 0 {
+			t.Errorf("%s: expected cache miss, but got no AuthenticationInfoResolver call", tt.Name)
+		}
+
+		if !tt.ExpectCacheMiss && *cacheMisses > 0 {
+			t.Errorf("%s: expected client to be cached, but got %d AuthenticationInfoResolver calls", tt.Name, *cacheMisses)
+		}
+	}
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/mutating/reinvocationcontext.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/mutating/reinvocationcontext.go
@@ -0,0 +1,68 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package mutating
+
+import (
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+type webhookReinvokeContext struct {
+	// lastWebhookOutput holds the result of the last webhook admission plugin call
+	lastWebhookOutput runtime.Object
+	// previouslyInvokedReinvocableWebhooks holds the set of webhooks that have been invoked and
+	// should be reinvoked if a later mutation occurs
+	previouslyInvokedReinvocableWebhooks sets.String
+	// reinvokeWebhooks holds the set of webhooks that should be reinvoked
+	reinvokeWebhooks sets.String
+}
+
+func (rc *webhookReinvokeContext) ShouldReinvokeWebhook(webhook string) bool {
+	return rc.reinvokeWebhooks.Has(webhook)
+}
+
+func (rc *webhookReinvokeContext) IsOutputChangedSinceLastWebhookInvocation(object runtime.Object) bool {
+	return !apiequality.Semantic.DeepEqual(rc.lastWebhookOutput, object)
+}
+
+func (rc *webhookReinvokeContext) SetLastWebhookInvocationOutput(object runtime.Object) {
+	if object == nil {
+		rc.lastWebhookOutput = nil
+		return
+	}
+	rc.lastWebhookOutput = object.DeepCopyObject()
+}
+
+func (rc *webhookReinvokeContext) AddReinvocableWebhookToPreviouslyInvoked(webhook string) {
+	if rc.previouslyInvokedReinvocableWebhooks == nil {
+		rc.previouslyInvokedReinvocableWebhooks = sets.NewString()
+	}
+	rc.previouslyInvokedReinvocableWebhooks.Insert(webhook)
+}
+
+func (rc *webhookReinvokeContext) RequireReinvokingPreviouslyInvokedPlugins() {
+	if len(rc.previouslyInvokedReinvocableWebhooks) > 0 {
+		if rc.reinvokeWebhooks == nil {
+			rc.reinvokeWebhooks = sets.NewString()
+		}
+		for s := range rc.previouslyInvokedReinvocableWebhooks {
+			rc.reinvokeWebhooks.Insert(s)
+		}
+		rc.previouslyInvokedReinvocableWebhooks = sets.NewString()
+	}
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/namespace/BUILD
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/namespace/BUILD
@@ -1,52 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-
-go_library(
-    name = "go_default_library",
-    srcs = [
-        "doc.go",
-        "matcher.go",
-    ],
-    importpath = "k8s.io/apiserver/pkg/admission/plugin/webhook/namespace",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//vendor/k8s.io/api/admissionregistration/v1beta1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/api/meta:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/labels:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/errors:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
-        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
-        "//vendor/k8s.io/client-go/listers/core/v1:go_default_library",
-    ],
-)
-
-go_test(
-    name = "go_default_test",
-    srcs = ["matcher_test.go"],
-    importpath = "k8s.io/apiserver/pkg/admission/plugin/webhook/namespace",
-    library = ":go_default_library",
-    deps = [
-        "//vendor/k8s.io/api/admissionregistration/v1beta1:go_default_library",
-        "//vendor/k8s.io/api/core/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/labels:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
-    ],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-    visibility = ["//visibility:public"],
-)
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/namespace/matcher.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/namespace/matcher.go
@@ -19,13 +19,13 @@ package namespace
 import (
 	"fmt"

-	"k8s.io/api/admissionregistration/v1beta1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	utilerrors "k8s.io/apimachinery/pkg/util/errors"
 	"k8s.io/apiserver/pkg/admission"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook"
 	clientset "k8s.io/client-go/kubernetes"
 	corelisters "k8s.io/client-go/listers/core/v1"
 )
@@ -86,15 +86,23 @@ func (m *Matcher) GetNamespaceLabels(attr admission.Attributes) (map[string]stri

 // MatchNamespaceSelector decideds whether the request matches the
 // namespaceSelctor of the webhook. Only when they match, the webhook is called.
-func (m *Matcher) MatchNamespaceSelector(h *v1beta1.Webhook, attr admission.Attributes) (bool, *apierrors.StatusError) {
+func (m *Matcher) MatchNamespaceSelector(h webhook.WebhookAccessor, attr admission.Attributes) (bool, *apierrors.StatusError) {
 	namespaceName := attr.GetNamespace()
 	if len(namespaceName) == 0 && attr.GetResource().Resource != "namespaces" {
 		// If the request is about a cluster scoped resource, and it is not a
-		// namespace, it is exempted from all webhooks for now.
+		// namespace, it is never exempted.
 		// TODO: figure out a way selective exempt cluster scoped resources.
 		// Also update the comment in types.go
-		return false, nil
+		return true, nil
 	}
+	selector, err := h.GetParsedNamespaceSelector()
+	if err != nil {
+		return false, apierrors.NewInternalError(err)
+	}
+	if selector.Empty() {
+		return true, nil
+	}
+
 	namespaceLabels, err := m.GetNamespaceLabels(attr)
 	// this means the namespace is not found, for backwards compatibility,
 	// return a 404
@@ -108,10 +116,5 @@ func (m *Matcher) MatchNamespaceSelector(h *v1beta1.Webhook, attr admission.Attr
 	if err != nil {
 		return false, apierrors.NewInternalError(err)
 	}
-	// TODO: adding an LRU cache to cache the translation
-	selector, err := metav1.LabelSelectorAsSelector(h.NamespaceSelector)
-	if err != nil {
-		return false, apierrors.NewInternalError(err)
-	}
 	return selector.Matches(labels.Set(namespaceLabels)), nil
 }
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/namespace/matcher_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/namespace/matcher_test.go
@@ -27,6 +27,7 @@ import (
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apiserver/pkg/admission"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook"
 )

 type fakeNamespaceLister struct {
@@ -75,27 +76,27 @@ func TestGetNamespaceLabels(t *testing.T) {
 	}{
 		{
 			name:           "request is for creating namespace, the labels should be from the object itself",
-			attr:           admission.NewAttributesRecord(&namespace2, nil, schema.GroupVersionKind{}, "", namespace2.Name, schema.GroupVersionResource{Resource: "namespaces"}, "", admission.Create, nil),
+			attr:           admission.NewAttributesRecord(&namespace2, nil, schema.GroupVersionKind{}, "", namespace2.Name, schema.GroupVersionResource{Resource: "namespaces"}, "", admission.Create, &metav1.CreateOptions{}, false, nil),
 			expectedLabels: namespace2Labels,
 		},
 		{
 			name:           "request is for updating namespace, the labels should be from the new object",
-			attr:           admission.NewAttributesRecord(&namespace2, nil, schema.GroupVersionKind{}, namespace2.Name, namespace2.Name, schema.GroupVersionResource{Resource: "namespaces"}, "", admission.Update, nil),
+			attr:           admission.NewAttributesRecord(&namespace2, nil, schema.GroupVersionKind{}, namespace2.Name, namespace2.Name, schema.GroupVersionResource{Resource: "namespaces"}, "", admission.Update, &metav1.UpdateOptions{}, false, nil),
 			expectedLabels: namespace2Labels,
 		},
 		{
 			name:           "request is for deleting namespace, the labels should be from the cache",
-			attr:           admission.NewAttributesRecord(&namespace2, nil, schema.GroupVersionKind{}, namespace1.Name, namespace1.Name, schema.GroupVersionResource{Resource: "namespaces"}, "", admission.Delete, nil),
+			attr:           admission.NewAttributesRecord(&namespace2, nil, schema.GroupVersionKind{}, namespace1.Name, namespace1.Name, schema.GroupVersionResource{Resource: "namespaces"}, "", admission.Delete, &metav1.DeleteOptions{}, false, nil),
 			expectedLabels: namespace1Labels,
 		},
 		{
 			name:           "request is for namespace/finalizer",
-			attr:           admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{}, namespace1.Name, "mock-name", schema.GroupVersionResource{Resource: "namespaces"}, "finalizers", admission.Create, nil),
+			attr:           admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{}, namespace1.Name, "mock-name", schema.GroupVersionResource{Resource: "namespaces"}, "finalizers", admission.Create, &metav1.CreateOptions{}, false, nil),
 			expectedLabels: namespace1Labels,
 		},
 		{
 			name:           "request is for pod",
-			attr:           admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{}, namespace1.Name, "mock-name", schema.GroupVersionResource{Resource: "pods"}, "", admission.Create, nil),
+			attr:           admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{}, namespace1.Name, "mock-name", schema.GroupVersionResource{Resource: "pods"}, "", admission.Create, &metav1.CreateOptions{}, false, nil),
 			expectedLabels: namespace1Labels,
 		},
 	}
@@ -113,17 +114,17 @@ func TestGetNamespaceLabels(t *testing.T) {
 	}
 }

-func TestExemptClusterScopedResource(t *testing.T) {
-	hook := &registrationv1beta1.Webhook{
+func TestNotExemptClusterScopedResource(t *testing.T) {
+	hook := &registrationv1beta1.ValidatingWebhook{
 		NamespaceSelector: &metav1.LabelSelector{},
 	}
-	attr := admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{}, "", "mock-name", schema.GroupVersionResource{Version: "v1", Resource: "nodes"}, "", admission.Create, nil)
+	attr := admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{}, "", "mock-name", schema.GroupVersionResource{Version: "v1", Resource: "nodes"}, "", admission.Create, &metav1.CreateOptions{}, false, nil)
 	matcher := Matcher{}
-	matches, err := matcher.MatchNamespaceSelector(hook, attr)
+	matches, err := matcher.MatchNamespaceSelector(webhook.NewValidatingWebhookAccessor("mock-hook", "mock-cfg", hook), attr)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if matches {
-		t.Errorf("cluster scoped resources (but not a namespace) should be exempted from all webhooks")
+	if !matches {
+		t.Errorf("cluster scoped resources (but not a namespace) should not be exempted from webhooks")
 	}
 }
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/object/doc.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/object/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package object defines the utilities that are used by the webhook plugin to
+// decide if a webhook should run, as long as either the old object or the new
+// object has labels matching the webhook config's objectSelector.
+package object // import "k8s.io/apiserver/pkg/admission/plugin/webhook/object"
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/object/matcher.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/object/matcher.go
@@ -0,0 +1,57 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package object
+
+import (
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apiserver/pkg/admission"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook"
+	"k8s.io/klog"
+)
+
+// Matcher decides if a request selected by the ObjectSelector.
+type Matcher struct {
+}
+
+func matchObject(obj runtime.Object, selector labels.Selector) bool {
+	if obj == nil {
+		return false
+	}
+	accessor, err := meta.Accessor(obj)
+	if err != nil {
+		klog.V(5).Infof("cannot access metadata of %v: %v", obj, err)
+		return false
+	}
+	return selector.Matches(labels.Set(accessor.GetLabels()))
+
+}
+
+// MatchObjectSelector decideds whether the request matches the ObjectSelector
+// of the webhook. Only when they match, the webhook is called.
+func (m *Matcher) MatchObjectSelector(h webhook.WebhookAccessor, attr admission.Attributes) (bool, *apierrors.StatusError) {
+	selector, err := h.GetParsedObjectSelector()
+	if err != nil {
+		return false, apierrors.NewInternalError(err)
+	}
+	if selector.Empty() {
+		return true, nil
+	}
+	return matchObject(attr.GetObject(), selector) || matchObject(attr.GetOldObject(), selector), nil
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/object/matcher_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/object/matcher_test.go
@@ -0,0 +1,130 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package object
+
+import (
+	"testing"
+
+	"k8s.io/api/admissionregistration/v1beta1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apiserver/pkg/admission"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook"
+)
+
+func TestObjectSelector(t *testing.T) {
+	nodeLevel1 := &corev1.Node{
+		ObjectMeta: metav1.ObjectMeta{
+			Labels: map[string]string{
+				"runlevel": "1",
+			},
+		},
+	}
+	nodeLevel2 := &corev1.Node{
+		ObjectMeta: metav1.ObjectMeta{
+			Labels: map[string]string{
+				"runlevel": "2",
+			},
+		},
+	}
+	runLevel1Excluder := &metav1.LabelSelector{
+		MatchExpressions: []metav1.LabelSelectorRequirement{
+			{
+				Key:      "runlevel",
+				Operator: metav1.LabelSelectorOpNotIn,
+				Values:   []string{"1"},
+			},
+		},
+	}
+	matcher := &Matcher{}
+	allScopes := v1beta1.AllScopes
+	testcases := []struct {
+		name string
+
+		objectSelector *metav1.LabelSelector
+		attrs          admission.Attributes
+
+		expectCall bool
+	}{
+		{
+			name:           "empty object selector matches everything",
+			objectSelector: &metav1.LabelSelector{},
+			attrs:          admission.NewAttributesRecord(nil, nil, schema.GroupVersionKind{}, "", "name", schema.GroupVersionResource{}, "", admission.Create, &metav1.CreateOptions{}, false, nil),
+			expectCall:     true,
+		},
+		{
+			name:           "matches new object",
+			objectSelector: runLevel1Excluder,
+			attrs:          admission.NewAttributesRecord(nodeLevel2, nil, schema.GroupVersionKind{}, "", "name", schema.GroupVersionResource{}, "", admission.Create, &metav1.CreateOptions{}, false, nil),
+			expectCall:     true,
+		},
+		{
+			name:           "matches old object",
+			objectSelector: runLevel1Excluder,
+			attrs:          admission.NewAttributesRecord(nil, nodeLevel2, schema.GroupVersionKind{}, "", "name", schema.GroupVersionResource{}, "", admission.Delete, &metav1.DeleteOptions{}, false, nil),
+			expectCall:     true,
+		},
+		{
+			name:           "does not match new object",
+			objectSelector: runLevel1Excluder,
+			attrs:          admission.NewAttributesRecord(nodeLevel1, nil, schema.GroupVersionKind{}, "", "name", schema.GroupVersionResource{}, "", admission.Create, &metav1.CreateOptions{}, false, nil),
+			expectCall:     false,
+		},
+		{
+			name:           "does not match old object",
+			objectSelector: runLevel1Excluder,
+			attrs:          admission.NewAttributesRecord(nil, nodeLevel1, schema.GroupVersionKind{}, "", "name", schema.GroupVersionResource{}, "", admission.Create, &metav1.CreateOptions{}, false, nil),
+			expectCall:     false,
+		},
+		{
+			name:           "does not match object that does not implement Object interface",
+			objectSelector: runLevel1Excluder,
+			attrs:          admission.NewAttributesRecord(&corev1.NodeProxyOptions{}, nil, schema.GroupVersionKind{}, "", "name", schema.GroupVersionResource{}, "", admission.Create, &metav1.CreateOptions{}, false, nil),
+			expectCall:     false,
+		},
+		{
+			name:           "empty selector matches everything, including object that does not implement Object interface",
+			objectSelector: &metav1.LabelSelector{},
+			attrs:          admission.NewAttributesRecord(&corev1.NodeProxyOptions{}, nil, schema.GroupVersionKind{}, "", "name", schema.GroupVersionResource{}, "", admission.Create, &metav1.CreateOptions{}, false, nil),
+			expectCall:     true,
+		},
+	}
+
+	for _, testcase := range testcases {
+		hook := &v1beta1.ValidatingWebhook{
+			NamespaceSelector: &metav1.LabelSelector{},
+			ObjectSelector:    testcase.objectSelector,
+			Rules: []v1beta1.RuleWithOperations{{
+				Operations: []v1beta1.OperationType{"*"},
+				Rule:       v1beta1.Rule{APIGroups: []string{"*"}, APIVersions: []string{"*"}, Resources: []string{"*"}, Scope: &allScopes},
+			}}}
+
+		t.Run(testcase.name, func(t *testing.T) {
+			match, err := matcher.MatchObjectSelector(webhook.NewValidatingWebhookAccessor("mock-hook", "mock-cfg", hook), testcase.attrs)
+			if err != nil {
+				t.Error(err)
+			}
+			if testcase.expectCall && !match {
+				t.Errorf("expected the webhook to be called")
+			}
+			if !testcase.expectCall && match {
+				t.Errorf("expected the webhook to be called")
+			}
+		})
+	}
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/request/BUILD
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/request/BUILD
@@ -1,33 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-
-go_library(
-    name = "go_default_library",
-    srcs = [
-        "admissionreview.go",
-        "doc.go",
-    ],
-    importpath = "k8s.io/apiserver/pkg/admission/plugin/webhook/request",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//vendor/k8s.io/api/admission/v1beta1:go_default_library",
-        "//vendor/k8s.io/api/authentication/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/uuid:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
-    ],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-    visibility = ["//visibility:public"],
-)
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/request/admissionreview.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/request/admissionreview.go
@@ -17,18 +17,145 @@ limitations under the License.
 package request

 import (
+	"fmt"
+
+	admissionv1 "k8s.io/api/admission/v1"
 	admissionv1beta1 "k8s.io/api/admission/v1beta1"
 	authenticationv1 "k8s.io/api/authentication/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/uuid"
-	"k8s.io/apiserver/pkg/admission"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook/generic"
 )

-// CreateAdmissionReview creates an AdmissionReview for the provided admission.Attributes
-func CreateAdmissionReview(attr admission.Attributes) admissionv1beta1.AdmissionReview {
-	gvk := attr.GetKind()
-	gvr := attr.GetResource()
+// AdmissionResponse contains the fields extracted from an AdmissionReview response
+type AdmissionResponse struct {
+	AuditAnnotations map[string]string
+	Allowed          bool
+	Patch            []byte
+	PatchType        admissionv1.PatchType
+	Result           *metav1.Status
+}
+
+// VerifyAdmissionResponse checks the validity of the provided admission review object, and returns the
+// audit annotations, whether the response allowed the request, any provided patch/patchType/status,
+// or an error if the provided admission review was not valid.
+func VerifyAdmissionResponse(uid types.UID, mutating bool, review runtime.Object) (*AdmissionResponse, error) {
+	switch r := review.(type) {
+	case *admissionv1.AdmissionReview:
+		if r.Response == nil {
+			return nil, fmt.Errorf("webhook response was absent")
+		}
+
+		// Verify UID matches
+		if r.Response.UID != uid {
+			return nil, fmt.Errorf("expected response.uid=%q, got %q", uid, r.Response.UID)
+		}
+
+		// Verify GVK
+		v1GVK := admissionv1.SchemeGroupVersion.WithKind("AdmissionReview")
+		if r.GroupVersionKind() != v1GVK {
+			return nil, fmt.Errorf("expected webhook response of %v, got %v", v1GVK.String(), r.GroupVersionKind().String())
+		}
+
+		patch := []byte(nil)
+		patchType := admissionv1.PatchType("")
+
+		if mutating {
+			// Ensure a mutating webhook provides both patch and patchType together
+			if len(r.Response.Patch) > 0 && r.Response.PatchType == nil {
+				return nil, fmt.Errorf("webhook returned response.patch but not response.patchType")
+			}
+			if len(r.Response.Patch) == 0 && r.Response.PatchType != nil {
+				return nil, fmt.Errorf("webhook returned response.patchType but not response.patch")
+			}
+			patch = r.Response.Patch
+			if r.Response.PatchType != nil {
+				patchType = *r.Response.PatchType
+				if len(patchType) == 0 {
+					return nil, fmt.Errorf("webhook returned invalid response.patchType of %q", patchType)
+				}
+			}
+		} else {
+			// Ensure a validating webhook doesn't return patch or patchType
+			if len(r.Response.Patch) > 0 {
+				return nil, fmt.Errorf("validating webhook may not return response.patch")
+			}
+			if r.Response.PatchType != nil {
+				return nil, fmt.Errorf("validating webhook may not return response.patchType")
+			}
+		}
+
+		return &AdmissionResponse{
+			AuditAnnotations: r.Response.AuditAnnotations,
+			Allowed:          r.Response.Allowed,
+			Patch:            patch,
+			PatchType:        patchType,
+			Result:           r.Response.Result,
+		}, nil
+
+	case *admissionv1beta1.AdmissionReview:
+		if r.Response == nil {
+			return nil, fmt.Errorf("webhook response was absent")
+		}
+
+		// Response GVK and response.uid were not verified in v1beta1 handling, allow any
+
+		patch := []byte(nil)
+		patchType := admissionv1.PatchType("")
+		if mutating {
+			patch = r.Response.Patch
+			if len(r.Response.Patch) > 0 {
+				// patch type was not verified in v1beta1 admissionreview handling. pin to only supported version if a patch is provided.
+				patchType = admissionv1.PatchTypeJSONPatch
+			}
+		}
+
+		return &AdmissionResponse{
+			AuditAnnotations: r.Response.AuditAnnotations,
+			Allowed:          r.Response.Allowed,
+			Patch:            patch,
+			PatchType:        patchType,
+			Result:           r.Response.Result,
+		}, nil
+
+	default:
+		return nil, fmt.Errorf("unexpected response type %T", review)
+	}
+}
+
+// CreateAdmissionObjects returns the unique request uid, the AdmissionReview object to send the webhook and to decode the response into,
+// or an error if the webhook does not support receiving any of the admission review versions we know to send
+func CreateAdmissionObjects(versionedAttributes *generic.VersionedAttributes, invocation *generic.WebhookInvocation) (uid types.UID, request, response runtime.Object, err error) {
+	for _, version := range invocation.Webhook.GetAdmissionReviewVersions() {
+		switch version {
+		case admissionv1.SchemeGroupVersion.Version:
+			uid := types.UID(uuid.NewUUID())
+			request := CreateV1AdmissionReview(uid, versionedAttributes, invocation)
+			response := &admissionv1.AdmissionReview{}
+			return uid, request, response, nil
+
+		case admissionv1beta1.SchemeGroupVersion.Version:
+			uid := types.UID(uuid.NewUUID())
+			request := CreateV1beta1AdmissionReview(uid, versionedAttributes, invocation)
+			response := &admissionv1beta1.AdmissionReview{}
+			return uid, request, response, nil
+
+		}
+	}
+	return "", nil, nil, fmt.Errorf("webhook does not accept known AdmissionReview versions (v1, v1beta1)")
+}
+
+// CreateV1AdmissionReview creates an AdmissionReview for the provided admission.Attributes
+func CreateV1AdmissionReview(uid types.UID, versionedAttributes *generic.VersionedAttributes, invocation *generic.WebhookInvocation) *admissionv1.AdmissionReview {
+	attr := versionedAttributes.Attributes
+	gvk := invocation.Kind
+	gvr := invocation.Resource
+	subresource := invocation.Subresource
+	requestGVK := attr.GetKind()
+	requestGVR := attr.GetResource()
+	requestSubResource := attr.GetSubresource()
 	aUserInfo := attr.GetUserInfo()
 	userInfo := authenticationv1.UserInfo{
 		Extra:    make(map[string]authenticationv1.ExtraValue),
@@ -36,15 +163,16 @@ func CreateAdmissionReview(attr admission.Attributes) admissionv1beta1.Admission
 		UID:      aUserInfo.GetUID(),
 		Username: aUserInfo.GetName(),
 	}
+	dryRun := attr.IsDryRun()

 	// Convert the extra information in the user object
 	for key, val := range aUserInfo.GetExtra() {
 		userInfo.Extra[key] = authenticationv1.ExtraValue(val)
 	}

-	return admissionv1beta1.AdmissionReview{
-		Request: &admissionv1beta1.AdmissionRequest{
-			UID: uuid.NewUUID(),
+	return &admissionv1.AdmissionReview{
+		Request: &admissionv1.AdmissionRequest{
+			UID: uid,
 			Kind: metav1.GroupVersionKind{
 				Group:   gvk.Group,
 				Kind:    gvk.Kind,
@@ -55,16 +183,97 @@ func CreateAdmissionReview(attr admission.Attributes) admissionv1beta1.Admission
 				Resource: gvr.Resource,
 				Version:  gvr.Version,
 			},
-			SubResource: attr.GetSubresource(),
-			Name:        attr.GetName(),
-			Namespace:   attr.GetNamespace(),
-			Operation:   admissionv1beta1.Operation(attr.GetOperation()),
-			UserInfo:    userInfo,
+			SubResource: subresource,
+			RequestKind: &metav1.GroupVersionKind{
+				Group:   requestGVK.Group,
+				Kind:    requestGVK.Kind,
+				Version: requestGVK.Version,
+			},
+			RequestResource: &metav1.GroupVersionResource{
+				Group:    requestGVR.Group,
+				Resource: requestGVR.Resource,
+				Version:  requestGVR.Version,
+			},
+			RequestSubResource: requestSubResource,
+			Name:               attr.GetName(),
+			Namespace:          attr.GetNamespace(),
+			Operation:          admissionv1.Operation(attr.GetOperation()),
+			UserInfo:           userInfo,
 			Object: runtime.RawExtension{
-				Object: attr.GetObject(),
+				Object: versionedAttributes.VersionedObject,
 			},
 			OldObject: runtime.RawExtension{
-				Object: attr.GetOldObject(),
+				Object: versionedAttributes.VersionedOldObject,
+			},
+			DryRun: &dryRun,
+			Options: runtime.RawExtension{
+				Object: attr.GetOperationOptions(),
+			},
+		},
+	}
+}
+
+// CreateV1beta1AdmissionReview creates an AdmissionReview for the provided admission.Attributes
+func CreateV1beta1AdmissionReview(uid types.UID, versionedAttributes *generic.VersionedAttributes, invocation *generic.WebhookInvocation) *admissionv1beta1.AdmissionReview {
+	attr := versionedAttributes.Attributes
+	gvk := invocation.Kind
+	gvr := invocation.Resource
+	subresource := invocation.Subresource
+	requestGVK := attr.GetKind()
+	requestGVR := attr.GetResource()
+	requestSubResource := attr.GetSubresource()
+	aUserInfo := attr.GetUserInfo()
+	userInfo := authenticationv1.UserInfo{
+		Extra:    make(map[string]authenticationv1.ExtraValue),
+		Groups:   aUserInfo.GetGroups(),
+		UID:      aUserInfo.GetUID(),
+		Username: aUserInfo.GetName(),
+	}
+	dryRun := attr.IsDryRun()
+
+	// Convert the extra information in the user object
+	for key, val := range aUserInfo.GetExtra() {
+		userInfo.Extra[key] = authenticationv1.ExtraValue(val)
+	}
+
+	return &admissionv1beta1.AdmissionReview{
+		Request: &admissionv1beta1.AdmissionRequest{
+			UID: uid,
+			Kind: metav1.GroupVersionKind{
+				Group:   gvk.Group,
+				Kind:    gvk.Kind,
+				Version: gvk.Version,
+			},
+			Resource: metav1.GroupVersionResource{
+				Group:    gvr.Group,
+				Resource: gvr.Resource,
+				Version:  gvr.Version,
+			},
+			SubResource: subresource,
+			RequestKind: &metav1.GroupVersionKind{
+				Group:   requestGVK.Group,
+				Kind:    requestGVK.Kind,
+				Version: requestGVK.Version,
+			},
+			RequestResource: &metav1.GroupVersionResource{
+				Group:    requestGVR.Group,
+				Resource: requestGVR.Resource,
+				Version:  requestGVR.Version,
+			},
+			RequestSubResource: requestSubResource,
+			Name:               attr.GetName(),
+			Namespace:          attr.GetNamespace(),
+			Operation:          admissionv1beta1.Operation(attr.GetOperation()),
+			UserInfo:           userInfo,
+			Object: runtime.RawExtension{
+				Object: versionedAttributes.VersionedObject,
+			},
+			OldObject: runtime.RawExtension{
+				Object: versionedAttributes.VersionedOldObject,
+			},
+			DryRun: &dryRun,
+			Options: runtime.RawExtension{
+				Object: attr.GetOperationOptions(),
 			},
 		},
 	}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/request/admissionreview_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/request/admissionreview_test.go
@@ -0,0 +1,618 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package request
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+
+	admissionv1 "k8s.io/api/admission/v1"
+	admissionv1beta1 "k8s.io/api/admission/v1beta1"
+	admissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
+	appsv1 "k8s.io/api/apps/v1"
+	authenticationv1 "k8s.io/api/authentication/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apiserver/pkg/admission"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook/generic"
+	"k8s.io/apiserver/pkg/authentication/user"
+	utilpointer "k8s.io/utils/pointer"
+)
+
+func TestVerifyAdmissionResponse(t *testing.T) {
+	v1beta1JSONPatch := admissionv1beta1.PatchTypeJSONPatch
+	v1JSONPatch := admissionv1.PatchTypeJSONPatch
+
+	emptyv1beta1Patch := admissionv1beta1.PatchType("")
+	emptyv1Patch := admissionv1.PatchType("")
+
+	invalidv1beta1Patch := admissionv1beta1.PatchType("Foo")
+	invalidv1Patch := admissionv1.PatchType("Foo")
+
+	testcases := []struct {
+		name     string
+		uid      types.UID
+		mutating bool
+		review   runtime.Object
+
+		expectAuditAnnotations map[string]string
+		expectAllowed          bool
+		expectPatch            []byte
+		expectPatchType        admissionv1.PatchType
+		expectResult           *metav1.Status
+		expectErr              string
+	}{
+		// Allowed validating
+		{
+			name: "v1beta1 allowed validating",
+			uid:  "123",
+			review: &admissionv1beta1.AdmissionReview{
+				Response: &admissionv1beta1.AdmissionResponse{Allowed: true},
+			},
+			expectAllowed: true,
+		},
+		{
+			name: "v1 allowed validating",
+			uid:  "123",
+			review: &admissionv1.AdmissionReview{
+				TypeMeta: metav1.TypeMeta{APIVersion: "admission.k8s.io/v1", Kind: "AdmissionReview"},
+				Response: &admissionv1.AdmissionResponse{UID: "123", Allowed: true},
+			},
+			expectAllowed: true,
+		},
+		// Allowed mutating
+		{
+			name:     "v1beta1 allowed mutating",
+			uid:      "123",
+			mutating: true,
+			review: &admissionv1beta1.AdmissionReview{
+				Response: &admissionv1beta1.AdmissionResponse{Allowed: true},
+			},
+			expectAllowed: true,
+		},
+		{
+			name:     "v1 allowed mutating",
+			uid:      "123",
+			mutating: true,
+			review: &admissionv1.AdmissionReview{
+				TypeMeta: metav1.TypeMeta{APIVersion: "admission.k8s.io/v1", Kind: "AdmissionReview"},
+				Response: &admissionv1.AdmissionResponse{UID: "123", Allowed: true},
+			},
+			expectAllowed: true,
+		},
+
+		// Audit annotations
+		{
+			name: "v1beta1 auditAnnotations",
+			uid:  "123",
+			review: &admissionv1beta1.AdmissionReview{
+				Response: &admissionv1beta1.AdmissionResponse{
+					Allowed:          true,
+					AuditAnnotations: map[string]string{"foo": "bar"},
+				},
+			},
+			expectAllowed:          true,
+			expectAuditAnnotations: map[string]string{"foo": "bar"},
+		},
+		{
+			name: "v1 auditAnnotations",
+			uid:  "123",
+			review: &admissionv1.AdmissionReview{
+				TypeMeta: metav1.TypeMeta{APIVersion: "admission.k8s.io/v1", Kind: "AdmissionReview"},
+				Response: &admissionv1.AdmissionResponse{
+					UID:              "123",
+					Allowed:          true,
+					AuditAnnotations: map[string]string{"foo": "bar"},
+				},
+			},
+			expectAllowed:          true,
+			expectAuditAnnotations: map[string]string{"foo": "bar"},
+		},
+
+		// Patch
+		{
+			name:     "v1beta1 patch",
+			uid:      "123",
+			mutating: true,
+			review: &admissionv1beta1.AdmissionReview{
+				Response: &admissionv1beta1.AdmissionResponse{
+					Allowed: true,
+					Patch:   []byte(`[{"op":"add","path":"/foo","value":"bar"}]`),
+				},
+			},
+			expectAllowed:   true,
+			expectPatch:     []byte(`[{"op":"add","path":"/foo","value":"bar"}]`),
+			expectPatchType: "JSONPatch",
+		},
+		{
+			name:     "v1 patch",
+			uid:      "123",
+			mutating: true,
+			review: &admissionv1.AdmissionReview{
+				TypeMeta: metav1.TypeMeta{APIVersion: "admission.k8s.io/v1", Kind: "AdmissionReview"},
+				Response: &admissionv1.AdmissionResponse{
+					UID:       "123",
+					Allowed:   true,
+					Patch:     []byte(`[{"op":"add","path":"/foo","value":"bar"}]`),
+					PatchType: &v1JSONPatch,
+				},
+			},
+			expectAllowed:   true,
+			expectPatch:     []byte(`[{"op":"add","path":"/foo","value":"bar"}]`),
+			expectPatchType: "JSONPatch",
+		},
+
+		// Result
+		{
+			name: "v1beta1 result",
+			uid:  "123",
+			review: &admissionv1beta1.AdmissionReview{
+				Response: &admissionv1beta1.AdmissionResponse{
+					Allowed: false,
+					Result:  &metav1.Status{Status: "Failure", Message: "Foo", Code: 401},
+				},
+			},
+			expectAllowed: false,
+			expectResult:  &metav1.Status{Status: "Failure", Message: "Foo", Code: 401},
+		},
+		{
+			name: "v1 result",
+			uid:  "123",
+			review: &admissionv1.AdmissionReview{
+				TypeMeta: metav1.TypeMeta{APIVersion: "admission.k8s.io/v1", Kind: "AdmissionReview"},
+				Response: &admissionv1.AdmissionResponse{
+					UID:     "123",
+					Allowed: false,
+					Result:  &metav1.Status{Status: "Failure", Message: "Foo", Code: 401},
+				},
+			},
+			expectAllowed: false,
+			expectResult:  &metav1.Status{Status: "Failure", Message: "Foo", Code: 401},
+		},
+
+		// Missing response
+		{
+			name:      "v1beta1 no response",
+			uid:       "123",
+			review:    &admissionv1beta1.AdmissionReview{},
+			expectErr: "response was absent",
+		},
+		{
+			name: "v1 no response",
+			uid:  "123",
+			review: &admissionv1.AdmissionReview{
+				TypeMeta: metav1.TypeMeta{APIVersion: "admission.k8s.io/v1", Kind: "AdmissionReview"},
+			},
+			expectErr: "response was absent",
+		},
+
+		// v1 invalid responses
+		{
+			name: "v1 wrong group",
+			uid:  "123",
+			review: &admissionv1.AdmissionReview{
+				TypeMeta: metav1.TypeMeta{APIVersion: "admission.k8s.io2/v1", Kind: "AdmissionReview"},
+				Response: &admissionv1.AdmissionResponse{
+					UID:     "123",
+					Allowed: true,
+				},
+			},
+			expectErr: "expected webhook response of admission.k8s.io/v1, Kind=AdmissionReview",
+		},
+		{
+			name: "v1 wrong version",
+			uid:  "123",
+			review: &admissionv1.AdmissionReview{
+				TypeMeta: metav1.TypeMeta{APIVersion: "admission.k8s.io/v2", Kind: "AdmissionReview"},
+				Response: &admissionv1.AdmissionResponse{
+					UID:     "123",
+					Allowed: true,
+				},
+			},
+			expectErr: "expected webhook response of admission.k8s.io/v1, Kind=AdmissionReview",
+		},
+		{
+			name: "v1 wrong kind",
+			uid:  "123",
+			review: &admissionv1.AdmissionReview{
+				TypeMeta: metav1.TypeMeta{APIVersion: "admission.k8s.io/v1", Kind: "AdmissionReview2"},
+				Response: &admissionv1.AdmissionResponse{
+					UID:     "123",
+					Allowed: true,
+				},
+			},
+			expectErr: "expected webhook response of admission.k8s.io/v1, Kind=AdmissionReview",
+		},
+		{
+			name: "v1 wrong uid",
+			uid:  "123",
+			review: &admissionv1.AdmissionReview{
+				TypeMeta: metav1.TypeMeta{APIVersion: "admission.k8s.io/v1", Kind: "AdmissionReview"},
+				Response: &admissionv1.AdmissionResponse{
+					UID:     "1234",
+					Allowed: true,
+				},
+			},
+			expectErr: `expected response.uid="123"`,
+		},
+		{
+			name:     "v1 patch without patch type",
+			uid:      "123",
+			mutating: true,
+			review: &admissionv1.AdmissionReview{
+				TypeMeta: metav1.TypeMeta{APIVersion: "admission.k8s.io/v1", Kind: "AdmissionReview"},
+				Response: &admissionv1.AdmissionResponse{
+					UID:     "123",
+					Allowed: true,
+					Patch:   []byte(`[{"op":"add","path":"/foo","value":"bar"}]`),
+				},
+			},
+			expectErr: `webhook returned response.patch but not response.patchType`,
+		},
+		{
+			name:     "v1 patch type without patch",
+			uid:      "123",
+			mutating: true,
+			review: &admissionv1.AdmissionReview{
+				TypeMeta: metav1.TypeMeta{APIVersion: "admission.k8s.io/v1", Kind: "AdmissionReview"},
+				Response: &admissionv1.AdmissionResponse{
+					UID:       "123",
+					Allowed:   true,
+					PatchType: &v1JSONPatch,
+				},
+			},
+			expectErr: `webhook returned response.patchType but not response.patch`,
+		},
+		{
+			name:     "v1 empty patch type",
+			uid:      "123",
+			mutating: true,
+			review: &admissionv1.AdmissionReview{
+				TypeMeta: metav1.TypeMeta{APIVersion: "admission.k8s.io/v1", Kind: "AdmissionReview"},
+				Response: &admissionv1.AdmissionResponse{
+					UID:       "123",
+					Allowed:   true,
+					Patch:     []byte(`[{"op":"add","path":"/foo","value":"bar"}]`),
+					PatchType: &emptyv1Patch,
+				},
+			},
+			expectErr: `webhook returned invalid response.patchType of ""`,
+		},
+		{
+			name:     "v1 invalid patch type",
+			uid:      "123",
+			mutating: true,
+			review: &admissionv1.AdmissionReview{
+				TypeMeta: metav1.TypeMeta{APIVersion: "admission.k8s.io/v1", Kind: "AdmissionReview"},
+				Response: &admissionv1.AdmissionResponse{
+					UID:       "123",
+					Allowed:   true,
+					Patch:     []byte(`[{"op":"add","path":"/foo","value":"bar"}]`),
+					PatchType: &invalidv1Patch,
+				},
+			},
+			expectAllowed:   true,
+			expectPatch:     []byte(`[{"op":"add","path":"/foo","value":"bar"}]`),
+			expectPatchType: invalidv1Patch, // invalid patch types are caught when the mutating dispatcher evaluates the patch
+		},
+		{
+			name:     "v1 patch for validating webhook",
+			uid:      "123",
+			mutating: false,
+			review: &admissionv1.AdmissionReview{
+				TypeMeta: metav1.TypeMeta{APIVersion: "admission.k8s.io/v1", Kind: "AdmissionReview"},
+				Response: &admissionv1.AdmissionResponse{
+					UID:     "123",
+					Allowed: true,
+					Patch:   []byte(`[{"op":"add","path":"/foo","value":"bar"}]`),
+				},
+			},
+			expectErr: `validating webhook may not return response.patch`,
+		},
+		{
+			name:     "v1 patch type for validating webhook",
+			uid:      "123",
+			mutating: false,
+			review: &admissionv1.AdmissionReview{
+				TypeMeta: metav1.TypeMeta{APIVersion: "admission.k8s.io/v1", Kind: "AdmissionReview"},
+				Response: &admissionv1.AdmissionResponse{
+					UID:       "123",
+					Allowed:   true,
+					PatchType: &invalidv1Patch,
+				},
+			},
+			expectErr: `validating webhook may not return response.patchType`,
+		},
+
+		// v1beta1 invalid responses that we have to allow/fixup for compatibility
+		{
+			name: "v1beta1 wrong group/version/kind",
+			uid:  "123",
+			review: &admissionv1beta1.AdmissionReview{
+				TypeMeta: metav1.TypeMeta{APIVersion: "admission.k8s.io2/v2", Kind: "AdmissionReview2"},
+				Response: &admissionv1beta1.AdmissionResponse{
+					Allowed: true,
+				},
+			},
+			expectAllowed: true,
+		},
+		{
+			name: "v1beta1 wrong uid",
+			uid:  "123",
+			review: &admissionv1beta1.AdmissionReview{
+				Response: &admissionv1beta1.AdmissionResponse{
+					UID:     "1234",
+					Allowed: true,
+				},
+			},
+			expectAllowed: true,
+		},
+		{
+			name:     "v1beta1 validating returns patch/patchType",
+			uid:      "123",
+			mutating: false,
+			review: &admissionv1beta1.AdmissionReview{
+				Response: &admissionv1beta1.AdmissionResponse{
+					UID:       "1234",
+					Allowed:   true,
+					Patch:     []byte(`[{"op":"add","path":"/foo","value":"bar"}]`),
+					PatchType: &v1beta1JSONPatch,
+				},
+			},
+			expectAllowed: true,
+		},
+		{
+			name:     "v1beta1 empty patch type",
+			uid:      "123",
+			mutating: true,
+			review: &admissionv1beta1.AdmissionReview{
+				Response: &admissionv1beta1.AdmissionResponse{
+					Allowed:   true,
+					Patch:     []byte(`[{"op":"add","path":"/foo","value":"bar"}]`),
+					PatchType: &emptyv1beta1Patch,
+				},
+			},
+			expectAllowed:   true,
+			expectPatch:     []byte(`[{"op":"add","path":"/foo","value":"bar"}]`),
+			expectPatchType: admissionv1.PatchTypeJSONPatch,
+		},
+		{
+			name:     "v1beta1 invalid patchType",
+			uid:      "123",
+			mutating: true,
+			review: &admissionv1beta1.AdmissionReview{
+				Response: &admissionv1beta1.AdmissionResponse{
+					Allowed:   true,
+					Patch:     []byte(`[{"op":"add","path":"/foo","value":"bar"}]`),
+					PatchType: &invalidv1beta1Patch,
+				},
+			},
+			expectAllowed:   true,
+			expectPatch:     []byte(`[{"op":"add","path":"/foo","value":"bar"}]`),
+			expectPatchType: admissionv1.PatchTypeJSONPatch,
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			result, err := VerifyAdmissionResponse(tc.uid, tc.mutating, tc.review)
+			if err != nil {
+				if len(tc.expectErr) > 0 {
+					if !strings.Contains(err.Error(), tc.expectErr) {
+						t.Errorf("expected error '%s', got %v", tc.expectErr, err)
+					}
+				} else {
+					t.Errorf("unexpected error %v", err)
+				}
+				return
+			} else if len(tc.expectErr) > 0 {
+				t.Errorf("expected error '%s', got none", tc.expectErr)
+				return
+			}
+
+			if e, a := tc.expectAuditAnnotations, result.AuditAnnotations; !reflect.DeepEqual(e, a) {
+				t.Errorf("unexpected: %v", cmp.Diff(e, a))
+			}
+			if e, a := tc.expectAllowed, result.Allowed; !reflect.DeepEqual(e, a) {
+				t.Errorf("unexpected: %v", cmp.Diff(e, a))
+			}
+			if e, a := tc.expectPatch, result.Patch; !reflect.DeepEqual(e, a) {
+				t.Errorf("unexpected: %v", cmp.Diff(e, a))
+			}
+			if e, a := tc.expectPatchType, result.PatchType; !reflect.DeepEqual(e, a) {
+				t.Errorf("unexpected: %v", cmp.Diff(e, a))
+			}
+			if e, a := tc.expectResult, result.Result; !reflect.DeepEqual(e, a) {
+				t.Errorf("unexpected: %v", cmp.Diff(e, a))
+			}
+		})
+	}
+}
+
+func TestCreateAdmissionObjects(t *testing.T) {
+	internalObj := &appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{ResourceVersion: "2", Name: "myname", Namespace: "myns"}}
+	internalObjOld := &appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{ResourceVersion: "1", Name: "myname", Namespace: "myns"}}
+	versionedObj := &appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{ResourceVersion: "2", Name: "myname", Namespace: "myns"}}
+	versionedObjOld := &appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{ResourceVersion: "1", Name: "myname", Namespace: "myns"}}
+	userInfo := &user.DefaultInfo{
+		Name:   "myuser",
+		Groups: []string{"mygroup"},
+		UID:    "myuid",
+		Extra:  map[string][]string{"extrakey": {"value1", "value2"}},
+	}
+	attrs := admission.NewAttributesRecord(
+		internalObj.DeepCopyObject(),
+		internalObjOld.DeepCopyObject(),
+		schema.GroupVersionKind{Group: "apps", Version: "v1", Kind: "Deployment"},
+		"myns",
+		"myname",
+		schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "deployments"},
+		"",
+		admission.Update,
+		&metav1.UpdateOptions{FieldManager: "foo"},
+		false,
+		userInfo,
+	)
+
+	testcases := []struct {
+		name       string
+		attrs      *generic.VersionedAttributes
+		invocation *generic.WebhookInvocation
+
+		expectRequest  func(uid types.UID) runtime.Object
+		expectResponse runtime.Object
+		expectErr      string
+	}{
+		{
+			name: "no supported versions",
+			invocation: &generic.WebhookInvocation{
+				Webhook: webhook.NewMutatingWebhookAccessor("mywebhook", "mycfg", &admissionregistrationv1beta1.MutatingWebhook{}),
+			},
+			expectErr: "webhook does not accept known AdmissionReview versions",
+		},
+		{
+			name: "no known supported versions",
+			invocation: &generic.WebhookInvocation{
+				Webhook: webhook.NewMutatingWebhookAccessor("mywebhook", "mycfg", &admissionregistrationv1beta1.MutatingWebhook{
+					AdmissionReviewVersions: []string{"vX"},
+				}),
+			},
+			expectErr: "webhook does not accept known AdmissionReview versions",
+		},
+		{
+			name: "v1",
+			attrs: &generic.VersionedAttributes{
+				VersionedObject:    versionedObj.DeepCopyObject(),
+				VersionedOldObject: versionedObjOld.DeepCopyObject(),
+				Attributes:         attrs,
+			},
+			invocation: &generic.WebhookInvocation{
+				Resource:    schema.GroupVersionResource{Group: "extensions", Version: "v1beta1", Resource: "deployments"},
+				Subresource: "",
+				Kind:        schema.GroupVersionKind{Group: "extensions", Version: "v1beta1", Kind: "Deployment"},
+				Webhook: webhook.NewMutatingWebhookAccessor("mywebhook", "mycfg", &admissionregistrationv1beta1.MutatingWebhook{
+					AdmissionReviewVersions: []string{"v1", "v1beta1"},
+				}),
+			},
+			expectRequest: func(uid types.UID) runtime.Object {
+				return &admissionv1.AdmissionReview{
+					Request: &admissionv1.AdmissionRequest{
+						UID:                uid,
+						Kind:               metav1.GroupVersionKind{Group: "extensions", Version: "v1beta1", Kind: "Deployment"},
+						Resource:           metav1.GroupVersionResource{Group: "extensions", Version: "v1beta1", Resource: "deployments"},
+						SubResource:        "",
+						RequestKind:        &metav1.GroupVersionKind{Group: "apps", Version: "v1", Kind: "Deployment"},
+						RequestResource:    &metav1.GroupVersionResource{Group: "apps", Version: "v1", Resource: "deployments"},
+						RequestSubResource: "",
+						Name:               "myname",
+						Namespace:          "myns",
+						Operation:          "UPDATE",
+						UserInfo: authenticationv1.UserInfo{
+							Username: "myuser",
+							UID:      "myuid",
+							Groups:   []string{"mygroup"},
+							Extra:    map[string]authenticationv1.ExtraValue{"extrakey": {"value1", "value2"}},
+						},
+						Object:    runtime.RawExtension{Object: versionedObj},
+						OldObject: runtime.RawExtension{Object: versionedObjOld},
+						DryRun:    utilpointer.BoolPtr(false),
+						Options:   runtime.RawExtension{Object: &metav1.UpdateOptions{FieldManager: "foo"}},
+					},
+				}
+			},
+			expectResponse: &admissionv1.AdmissionReview{},
+		},
+		{
+			name: "v1beta1",
+			attrs: &generic.VersionedAttributes{
+				VersionedObject:    versionedObj.DeepCopyObject(),
+				VersionedOldObject: versionedObjOld.DeepCopyObject(),
+				Attributes:         attrs,
+			},
+			invocation: &generic.WebhookInvocation{
+				Resource:    schema.GroupVersionResource{Group: "extensions", Version: "v1beta1", Resource: "deployments"},
+				Subresource: "",
+				Kind:        schema.GroupVersionKind{Group: "extensions", Version: "v1beta1", Kind: "Deployment"},
+				Webhook: webhook.NewMutatingWebhookAccessor("mywebhook", "mycfg", &admissionregistrationv1beta1.MutatingWebhook{
+					AdmissionReviewVersions: []string{"v1beta1", "v1"},
+				}),
+			},
+			expectRequest: func(uid types.UID) runtime.Object {
+				return &admissionv1beta1.AdmissionReview{
+					Request: &admissionv1beta1.AdmissionRequest{
+						UID:                uid,
+						Kind:               metav1.GroupVersionKind{Group: "extensions", Version: "v1beta1", Kind: "Deployment"},
+						Resource:           metav1.GroupVersionResource{Group: "extensions", Version: "v1beta1", Resource: "deployments"},
+						SubResource:        "",
+						RequestKind:        &metav1.GroupVersionKind{Group: "apps", Version: "v1", Kind: "Deployment"},
+						RequestResource:    &metav1.GroupVersionResource{Group: "apps", Version: "v1", Resource: "deployments"},
+						RequestSubResource: "",
+						Name:               "myname",
+						Namespace:          "myns",
+						Operation:          "UPDATE",
+						UserInfo: authenticationv1.UserInfo{
+							Username: "myuser",
+							UID:      "myuid",
+							Groups:   []string{"mygroup"},
+							Extra:    map[string]authenticationv1.ExtraValue{"extrakey": {"value1", "value2"}},
+						},
+						Object:    runtime.RawExtension{Object: versionedObj},
+						OldObject: runtime.RawExtension{Object: versionedObjOld},
+						DryRun:    utilpointer.BoolPtr(false),
+						Options:   runtime.RawExtension{Object: &metav1.UpdateOptions{FieldManager: "foo"}},
+					},
+				}
+			},
+			expectResponse: &admissionv1beta1.AdmissionReview{},
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			uid, request, response, err := CreateAdmissionObjects(tc.attrs, tc.invocation)
+			if err != nil {
+				if len(tc.expectErr) > 0 {
+					if !strings.Contains(err.Error(), tc.expectErr) {
+						t.Errorf("expected error '%s', got %v", tc.expectErr, err)
+					}
+				} else {
+					t.Errorf("unexpected error %v", err)
+				}
+				return
+			} else if len(tc.expectErr) > 0 {
+				t.Errorf("expected error '%s', got none", tc.expectErr)
+				return
+			}
+
+			if len(uid) == 0 {
+				t.Errorf("expected uid, got none")
+			}
+			if e, a := tc.expectRequest(uid), request; !reflect.DeepEqual(e, a) {
+				t.Errorf("unexpected: %v", cmp.Diff(e, a))
+			}
+			if e, a := tc.expectResponse, response; !reflect.DeepEqual(e, a) {
+				t.Errorf("unexpected: %v", cmp.Diff(e, a))
+			}
+		})
+	}
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/rules/BUILD
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/rules/BUILD
@@ -1,38 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-
-go_library(
-    name = "go_default_library",
-    srcs = ["rules.go"],
-    importpath = "k8s.io/apiserver/pkg/admission/plugin/webhook/rules",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//vendor/k8s.io/api/admissionregistration/v1beta1:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
-    ],
-)
-
-go_test(
-    name = "go_default_test",
-    srcs = ["rules_test.go"],
-    importpath = "k8s.io/apiserver/pkg/admission/plugin/webhook/rules",
-    library = ":go_default_library",
-    deps = [
-        "//vendor/k8s.io/api/admissionregistration/v1beta1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
-    ],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-    visibility = ["//visibility:public"],
-)
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/rules/rules.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/rules/rules.go
@@ -20,6 +20,8 @@ import (
 	"strings"

 	"k8s.io/api/admissionregistration/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apiserver/pkg/admission"
 )

@@ -31,7 +33,8 @@ type Matcher struct {

 // Matches returns if the Attr matches the Rule.
 func (r *Matcher) Matches() bool {
-	return r.operation() &&
+	return r.scope() &&
+		r.operation() &&
 		r.group() &&
 		r.version() &&
 		r.resource()
@@ -50,6 +53,25 @@ func exactOrWildcard(items []string, requested string) bool {
 	return false
 }

+var namespaceResource = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "namespaces"}
+
+func (r *Matcher) scope() bool {
+	if r.Rule.Scope == nil || *r.Rule.Scope == v1beta1.AllScopes {
+		return true
+	}
+	// attr.GetNamespace() is set to the name of the namespace for requests of the namespace object itself.
+	switch *r.Rule.Scope {
+	case v1beta1.NamespacedScope:
+		// first make sure that we are not requesting a namespace object (namespace objects are cluster-scoped)
+		return r.Attr.GetResource() != namespaceResource && r.Attr.GetNamespace() != metav1.NamespaceNone
+	case v1beta1.ClusterScope:
+		// also return true if the request is for a namespace object (namespace objects are cluster-scoped)
+		return r.Attr.GetResource() == namespaceResource || r.Attr.GetNamespace() == metav1.NamespaceNone
+	default:
+		return false
+	}
+}
+
 func (r *Matcher) group() bool {
 	return exactOrWildcard(r.Rule.APIGroups, r.Attr.GetResource().Group)
 }
@@ -93,3 +115,15 @@ func (r *Matcher) resource() bool {
 	}
 	return false
 }
+
+// IsWebhookConfigurationResource determines if an admission.Attributes object is describing
+// the admission of a ValidatingWebhookConfiguration or a MutatingWebhookConfiguration
+func IsWebhookConfigurationResource(attr admission.Attributes) bool {
+	gvk := attr.GetKind()
+	if gvk.Group == "admissionregistration.k8s.io" {
+		if gvk.Kind == "ValidatingWebhookConfiguration" || gvk.Kind == "MutatingWebhookConfiguration" {
+			return true
+		}
+	}
+	return false
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/rules/rules_test.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/rules/rules_test.go
@@ -17,10 +17,14 @@ limitations under the License.
 package rules

 import (
+	"fmt"
 	"testing"

 	adreg "k8s.io/api/admissionregistration/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/apiserver/pkg/admission"
 )

@@ -31,13 +35,41 @@ type ruleTest struct {
 }
 type tests map[string]ruleTest

-func a(group, version, resource, subresource, name string, operation admission.Operation) admission.Attributes {
+func a(group, version, resource, subresource, name string, operation admission.Operation, operationOptions runtime.Object) admission.Attributes {
 	return admission.NewAttributesRecord(
 		nil, nil,
 		schema.GroupVersionKind{Group: group, Version: version, Kind: "k" + resource},
 		"ns", name,
 		schema.GroupVersionResource{Group: group, Version: version, Resource: resource}, subresource,
 		operation,
+		operationOptions,
+		false,
+		nil,
+	)
+}
+
+func namespacedAttributes(group, version, resource, subresource, name string, operation admission.Operation, operationOptions runtime.Object) admission.Attributes {
+	return admission.NewAttributesRecord(
+		nil, nil,
+		schema.GroupVersionKind{Group: group, Version: version, Kind: "k" + resource},
+		"ns", name,
+		schema.GroupVersionResource{Group: group, Version: version, Resource: resource}, subresource,
+		operation,
+		operationOptions,
+		false,
+		nil,
+	)
+}
+
+func clusterScopedAttributes(group, version, resource, subresource, name string, operation admission.Operation, operationOptions runtime.Object) admission.Attributes {
+	return admission.NewAttributesRecord(
+		nil, nil,
+		schema.GroupVersionKind{Group: group, Version: version, Kind: "k" + resource},
+		"", name,
+		schema.GroupVersionResource{Group: group, Version: version, Resource: resource}, subresource,
+		operation,
+		operationOptions,
+		false,
 		nil,
 	)
 }
@@ -55,7 +87,7 @@ func TestGroup(t *testing.T) {
 				},
 			},
 			match: attrList(
-				a("g", "v", "r", "", "name", admission.Create),
+				a("g", "v", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
 			),
 		},
 		"exact": {
@@ -65,12 +97,12 @@ func TestGroup(t *testing.T) {
 				},
 			},
 			match: attrList(
-				a("g1", "v", "r", "", "name", admission.Create),
-				a("g2", "v2", "r3", "", "name", admission.Create),
+				a("g1", "v", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
+				a("g2", "v2", "r3", "", "name", admission.Create, &metav1.CreateOptions{}),
 			),
 			noMatch: attrList(
-				a("g3", "v", "r", "", "name", admission.Create),
-				a("g4", "v", "r", "", "name", admission.Create),
+				a("g3", "v", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
+				a("g4", "v", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
 			),
 		},
 	}
@@ -100,7 +132,7 @@ func TestVersion(t *testing.T) {
 				},
 			},
 			match: attrList(
-				a("g", "v", "r", "", "name", admission.Create),
+				a("g", "v", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
 			),
 		},
 		"exact": {
@@ -110,12 +142,12 @@ func TestVersion(t *testing.T) {
 				},
 			},
 			match: attrList(
-				a("g1", "v1", "r", "", "name", admission.Create),
-				a("g2", "v2", "r", "", "name", admission.Create),
+				a("g1", "v1", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
+				a("g2", "v2", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
 			),
 			noMatch: attrList(
-				a("g1", "v3", "r", "", "name", admission.Create),
-				a("g2", "v4", "r", "", "name", admission.Create),
+				a("g1", "v3", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
+				a("g2", "v4", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
 			),
 		},
 	}
@@ -140,65 +172,65 @@ func TestOperation(t *testing.T) {
 		"wildcard": {
 			rule: adreg.RuleWithOperations{Operations: []adreg.OperationType{adreg.OperationAll}},
 			match: attrList(
-				a("g", "v", "r", "", "name", admission.Create),
-				a("g", "v", "r", "", "name", admission.Update),
-				a("g", "v", "r", "", "name", admission.Delete),
-				a("g", "v", "r", "", "name", admission.Connect),
+				a("g", "v", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
+				a("g", "v", "r", "", "name", admission.Update, &metav1.UpdateOptions{}),
+				a("g", "v", "r", "", "name", admission.Delete, &metav1.DeleteOptions{}),
+				a("g", "v", "r", "", "name", admission.Connect, nil),
 			),
 		},
 		"create": {
 			rule: adreg.RuleWithOperations{Operations: []adreg.OperationType{adreg.Create}},
 			match: attrList(
-				a("g", "v", "r", "", "name", admission.Create),
+				a("g", "v", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
 			),
 			noMatch: attrList(
-				a("g", "v", "r", "", "name", admission.Update),
-				a("g", "v", "r", "", "name", admission.Delete),
-				a("g", "v", "r", "", "name", admission.Connect),
+				a("g", "v", "r", "", "name", admission.Update, &metav1.UpdateOptions{}),
+				a("g", "v", "r", "", "name", admission.Delete, &metav1.DeleteOptions{}),
+				a("g", "v", "r", "", "name", admission.Connect, nil),
 			),
 		},
 		"update": {
 			rule: adreg.RuleWithOperations{Operations: []adreg.OperationType{adreg.Update}},
 			match: attrList(
-				a("g", "v", "r", "", "name", admission.Update),
+				a("g", "v", "r", "", "name", admission.Update, &metav1.UpdateOptions{}),
 			),
 			noMatch: attrList(
-				a("g", "v", "r", "", "name", admission.Create),
-				a("g", "v", "r", "", "name", admission.Delete),
-				a("g", "v", "r", "", "name", admission.Connect),
+				a("g", "v", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
+				a("g", "v", "r", "", "name", admission.Delete, &metav1.DeleteOptions{}),
+				a("g", "v", "r", "", "name", admission.Connect, nil),
 			),
 		},
 		"delete": {
 			rule: adreg.RuleWithOperations{Operations: []adreg.OperationType{adreg.Delete}},
 			match: attrList(
-				a("g", "v", "r", "", "name", admission.Delete),
+				a("g", "v", "r", "", "name", admission.Delete, &metav1.DeleteOptions{}),
 			),
 			noMatch: attrList(
-				a("g", "v", "r", "", "name", admission.Create),
-				a("g", "v", "r", "", "name", admission.Update),
-				a("g", "v", "r", "", "name", admission.Connect),
+				a("g", "v", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
+				a("g", "v", "r", "", "name", admission.Update, &metav1.UpdateOptions{}),
+				a("g", "v", "r", "", "name", admission.Connect, nil),
 			),
 		},
 		"connect": {
 			rule: adreg.RuleWithOperations{Operations: []adreg.OperationType{adreg.Connect}},
 			match: attrList(
-				a("g", "v", "r", "", "name", admission.Connect),
+				a("g", "v", "r", "", "name", admission.Connect, nil),
 			),
 			noMatch: attrList(
-				a("g", "v", "r", "", "name", admission.Create),
-				a("g", "v", "r", "", "name", admission.Update),
-				a("g", "v", "r", "", "name", admission.Delete),
+				a("g", "v", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
+				a("g", "v", "r", "", "name", admission.Update, &metav1.UpdateOptions{}),
+				a("g", "v", "r", "", "name", admission.Delete, &metav1.DeleteOptions{}),
 			),
 		},
 		"multiple": {
 			rule: adreg.RuleWithOperations{Operations: []adreg.OperationType{adreg.Update, adreg.Delete}},
 			match: attrList(
-				a("g", "v", "r", "", "name", admission.Update),
-				a("g", "v", "r", "", "name", admission.Delete),
+				a("g", "v", "r", "", "name", admission.Update, &metav1.UpdateOptions{}),
+				a("g", "v", "r", "", "name", admission.Delete, &metav1.DeleteOptions{}),
 			),
 			noMatch: attrList(
-				a("g", "v", "r", "", "name", admission.Create),
-				a("g", "v", "r", "", "name", admission.Connect),
+				a("g", "v", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
+				a("g", "v", "r", "", "name", admission.Connect, nil),
 			),
 		},
 	}
@@ -227,12 +259,12 @@ func TestResource(t *testing.T) {
 				},
 			},
 			match: attrList(
-				a("g", "v", "r", "", "name", admission.Create),
-				a("2", "v", "r2", "", "name", admission.Create),
+				a("g", "v", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
+				a("2", "v", "r2", "", "name", admission.Create, &metav1.CreateOptions{}),
 			),
 			noMatch: attrList(
-				a("g", "v", "r", "exec", "name", admission.Create),
-				a("2", "v", "r2", "proxy", "name", admission.Create),
+				a("g", "v", "r", "exec", "name", admission.Create, &metav1.CreateOptions{}),
+				a("2", "v", "r2", "proxy", "name", admission.Create, &metav1.CreateOptions{}),
 			),
 		},
 		"r & subresources": {
@@ -242,12 +274,12 @@ func TestResource(t *testing.T) {
 				},
 			},
 			match: attrList(
-				a("g", "v", "r", "", "name", admission.Create),
-				a("g", "v", "r", "exec", "name", admission.Create),
+				a("g", "v", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
+				a("g", "v", "r", "exec", "name", admission.Create, &metav1.CreateOptions{}),
 			),
 			noMatch: attrList(
-				a("2", "v", "r2", "", "name", admission.Create),
-				a("2", "v", "r2", "proxy", "name", admission.Create),
+				a("2", "v", "r2", "", "name", admission.Create, &metav1.CreateOptions{}),
+				a("2", "v", "r2", "proxy", "name", admission.Create, &metav1.CreateOptions{}),
 			),
 		},
 		"r & subresources or r2": {
@@ -257,12 +289,12 @@ func TestResource(t *testing.T) {
 				},
 			},
 			match: attrList(
-				a("g", "v", "r", "", "name", admission.Create),
-				a("g", "v", "r", "exec", "name", admission.Create),
-				a("2", "v", "r2", "", "name", admission.Create),
+				a("g", "v", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
+				a("g", "v", "r", "exec", "name", admission.Create, &metav1.CreateOptions{}),
+				a("2", "v", "r2", "", "name", admission.Create, &metav1.CreateOptions{}),
 			),
 			noMatch: attrList(
-				a("2", "v", "r2", "proxy", "name", admission.Create),
+				a("2", "v", "r2", "proxy", "name", admission.Create, &metav1.CreateOptions{}),
 			),
 		},
 		"proxy or exec": {
@@ -272,14 +304,14 @@ func TestResource(t *testing.T) {
 				},
 			},
 			match: attrList(
-				a("g", "v", "r", "exec", "name", admission.Create),
-				a("2", "v", "r2", "proxy", "name", admission.Create),
-				a("2", "v", "r3", "proxy", "name", admission.Create),
+				a("g", "v", "r", "exec", "name", admission.Create, &metav1.CreateOptions{}),
+				a("2", "v", "r2", "proxy", "name", admission.Create, &metav1.CreateOptions{}),
+				a("2", "v", "r3", "proxy", "name", admission.Create, &metav1.CreateOptions{}),
 			),
 			noMatch: attrList(
-				a("g", "v", "r", "", "name", admission.Create),
-				a("2", "v", "r2", "", "name", admission.Create),
-				a("2", "v", "r4", "scale", "name", admission.Create),
+				a("g", "v", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
+				a("2", "v", "r2", "", "name", admission.Create, &metav1.CreateOptions{}),
+				a("2", "v", "r4", "scale", "name", admission.Create, &metav1.CreateOptions{}),
 			),
 		},
 	}
@@ -298,3 +330,93 @@ func TestResource(t *testing.T) {
 		}
 	}
 }
+
+func TestScope(t *testing.T) {
+	cluster := adreg.ClusterScope
+	namespace := adreg.NamespacedScope
+	allscopes := adreg.AllScopes
+	table := tests{
+		"cluster scope": {
+			rule: adreg.RuleWithOperations{
+				Rule: adreg.Rule{
+					Resources: []string{"*"},
+					Scope:     &cluster,
+				},
+			},
+			match: attrList(
+				clusterScopedAttributes("g", "v", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
+				clusterScopedAttributes("g", "v", "r", "exec", "name", admission.Create, &metav1.CreateOptions{}),
+				clusterScopedAttributes("", "v1", "namespaces", "", "ns", admission.Create, &metav1.CreateOptions{}),
+				clusterScopedAttributes("", "v1", "namespaces", "finalize", "ns", admission.Create, &metav1.CreateOptions{}),
+				namespacedAttributes("", "v1", "namespaces", "", "ns", admission.Create, &metav1.CreateOptions{}),
+				namespacedAttributes("", "v1", "namespaces", "finalize", "ns", admission.Create, &metav1.CreateOptions{}),
+			),
+			noMatch: attrList(
+				namespacedAttributes("g", "v", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
+				namespacedAttributes("g", "v", "r", "exec", "name", admission.Create, &metav1.CreateOptions{}),
+			),
+		},
+		"namespace scope": {
+			rule: adreg.RuleWithOperations{
+				Rule: adreg.Rule{
+					Resources: []string{"*"},
+					Scope:     &namespace,
+				},
+			},
+			match: attrList(
+				namespacedAttributes("g", "v", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
+				namespacedAttributes("g", "v", "r", "exec", "name", admission.Create, &metav1.CreateOptions{}),
+			),
+			noMatch: attrList(
+				clusterScopedAttributes("", "v1", "namespaces", "", "ns", admission.Create, &metav1.CreateOptions{}),
+				clusterScopedAttributes("", "v1", "namespaces", "finalize", "ns", admission.Create, &metav1.CreateOptions{}),
+				namespacedAttributes("", "v1", "namespaces", "", "ns", admission.Create, &metav1.CreateOptions{}),
+				namespacedAttributes("", "v1", "namespaces", "finalize", "ns", admission.Create, &metav1.CreateOptions{}),
+				clusterScopedAttributes("g", "v", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
+				clusterScopedAttributes("g", "v", "r", "exec", "name", admission.Create, &metav1.CreateOptions{}),
+			),
+		},
+		"all scopes": {
+			rule: adreg.RuleWithOperations{
+				Rule: adreg.Rule{
+					Resources: []string{"*"},
+					Scope:     &allscopes,
+				},
+			},
+			match: attrList(
+				namespacedAttributes("g", "v", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
+				namespacedAttributes("g", "v", "r", "exec", "name", admission.Create, &metav1.CreateOptions{}),
+				clusterScopedAttributes("g", "v", "r", "", "name", admission.Create, &metav1.CreateOptions{}),
+				clusterScopedAttributes("g", "v", "r", "exec", "name", admission.Create, &metav1.CreateOptions{}),
+				clusterScopedAttributes("", "v1", "namespaces", "", "ns", admission.Create, &metav1.CreateOptions{}),
+				clusterScopedAttributes("", "v1", "namespaces", "finalize", "ns", admission.Create, &metav1.CreateOptions{}),
+				namespacedAttributes("", "v1", "namespaces", "", "ns", admission.Create, &metav1.CreateOptions{}),
+				namespacedAttributes("", "v1", "namespaces", "finalize", "ns", admission.Create, &metav1.CreateOptions{}),
+			),
+			noMatch: attrList(),
+		},
+	}
+	keys := sets.NewString()
+	for name := range table {
+		keys.Insert(name)
+	}
+	for _, name := range keys.List() {
+		tt := table[name]
+		for i, m := range tt.match {
+			t.Run(fmt.Sprintf("%s_match_%d", name, i), func(t *testing.T) {
+				r := Matcher{tt.rule, m}
+				if !r.scope() {
+					t.Errorf("%v: expected match %#v", name, m)
+				}
+			})
+		}
+		for i, m := range tt.noMatch {
+			t.Run(fmt.Sprintf("%s_nomatch_%d", name, i), func(t *testing.T) {
+				r := Matcher{tt.rule, m}
+				if r.scope() {
+					t.Errorf("%v: expected no match %#v", name, m)
+				}
+			})
+		}
+	}
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/testcerts/BUILD
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/testcerts/BUILD
@@ -1,25 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-
-go_library(
-    name = "go_default_library",
-    srcs = [
-        "certs.go",
-        "doc.go",
-    ],
-    importpath = "k8s.io/apiserver/pkg/admission/plugin/webhook/testcerts",
-    visibility = ["//visibility:public"],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-    visibility = ["//visibility:public"],
-)
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/testcerts/gencerts.sh
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/testcerts/gencerts.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash

 # Copyright 2017 The Kubernetes Authors.
 #
@@ -90,12 +90,12 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

+// This file was generated using openssl by the gencerts.sh script
+// and holds raw certificates for the webhook tests.
+
+package testcerts
 EOF

-echo "// This file was generated using openssl by the gencerts.sh script" >> $outfile
-echo "// and holds raw certificates for the webhook tests." >> $outfile
-echo "" >> $outfile
-echo "package testcerts" >> $outfile
 for file in CAKey CACert BadCAKey BadCACert ServerKey ServerCert ClientKey ClientCert; do
 	data=$(cat ${file}.pem)
 	echo "" >> $outfile
@@ -103,7 +103,7 @@ for file in CAKey CACert BadCAKey BadCACert ServerKey ServerCert ClientKey Clien
 done

 # Clean up after we're done.
-rm *.pem
-rm *.csr
-rm *.srl
-rm *.conf
+rm ./*.pem
+rm ./*.csr
+rm ./*.srl
+rm ./*.conf
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/testing/authentication_info_resolver.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/testing/authentication_info_resolver.go
@@ -0,0 +1,63 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testing
+
+import (
+	"sync/atomic"
+
+	"k8s.io/apiserver/pkg/admission/plugin/webhook/testcerts"
+	"k8s.io/apiserver/pkg/util/webhook"
+	"k8s.io/client-go/rest"
+)
+
+// Wrapper turns an AuthenticationInfoResolver into a AuthenticationInfoResolverWrapper that unconditionally
+// returns the given AuthenticationInfoResolver.
+func Wrapper(r webhook.AuthenticationInfoResolver) func(webhook.AuthenticationInfoResolver) webhook.AuthenticationInfoResolver {
+	return func(webhook.AuthenticationInfoResolver) webhook.AuthenticationInfoResolver {
+		return r
+	}
+}
+
+// NewAuthenticationInfoResolver creates a fake AuthenticationInfoResolver that counts cache misses on
+// every call to its methods.
+func NewAuthenticationInfoResolver(cacheMisses *int32) webhook.AuthenticationInfoResolver {
+	return &authenticationInfoResolver{
+		restConfig: &rest.Config{
+			TLSClientConfig: rest.TLSClientConfig{
+				CAData:   testcerts.CACert,
+				CertData: testcerts.ClientCert,
+				KeyData:  testcerts.ClientKey,
+			},
+		},
+		cacheMisses: cacheMisses,
+	}
+}
+
+type authenticationInfoResolver struct {
+	restConfig  *rest.Config
+	cacheMisses *int32
+}
+
+func (a *authenticationInfoResolver) ClientConfigFor(hostPort string) (*rest.Config, error) {
+	atomic.AddInt32(a.cacheMisses, 1)
+	return a.restConfig, nil
+}
+
+func (a *authenticationInfoResolver) ClientConfigForService(serviceName, serviceNamespace string, servicePort int) (*rest.Config, error) {
+	atomic.AddInt32(a.cacheMisses, 1)
+	return a.restConfig, nil
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/testing/main/main.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/testing/main/main.go
@@ -0,0 +1,30 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+
+	webhooktesting "k8s.io/apiserver/pkg/admission/plugin/webhook/testing"
+)
+
+func main() {
+	server := webhooktesting.NewTestServer(nil)
+	server.StartTLS()
+	fmt.Println("serving on", server.URL)
+	select {}
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/testing/service_resolver.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/testing/service_resolver.go
@@ -0,0 +1,42 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testing
+
+import (
+	"fmt"
+	"net/url"
+
+	"k8s.io/apiserver/pkg/util/webhook"
+)
+
+type serviceResolver struct {
+	base url.URL
+}
+
+// NewServiceResolver returns a static service resolve that return the given URL or
+// an error for the failResolve namespace.
+func NewServiceResolver(base url.URL) webhook.ServiceResolver {
+	return &serviceResolver{base}
+}
+
+func (f serviceResolver) ResolveEndpoint(namespace, name string, port int32) (*url.URL, error) {
+	if namespace == "failResolve" {
+		return nil, fmt.Errorf("couldn't resolve service location")
+	}
+	u := f.base
+	return &u, nil
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/testing/testcase.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/testing/testcase.go
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/testing/webhook_server.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/testing/webhook_server.go
@@ -0,0 +1,162 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testing
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"k8s.io/api/admission/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook/testcerts"
+)
+
+// NewTestServer returns a webhook test HTTPS server with fixed webhook test certs.
+func NewTestServer(t testing.TB) *httptest.Server {
+	// Create the test webhook server
+	sCert, err := tls.X509KeyPair(testcerts.ServerCert, testcerts.ServerKey)
+	if err != nil {
+		t.Error(err)
+		t.FailNow()
+	}
+	rootCAs := x509.NewCertPool()
+	rootCAs.AppendCertsFromPEM(testcerts.CACert)
+	testServer := httptest.NewUnstartedServer(http.HandlerFunc(webhookHandler))
+	testServer.TLS = &tls.Config{
+		Certificates: []tls.Certificate{sCert},
+		ClientCAs:    rootCAs,
+		ClientAuth:   tls.RequireAndVerifyClientCert,
+	}
+	return testServer
+}
+
+func webhookHandler(w http.ResponseWriter, r *http.Request) {
+	// fmt.Printf("got req: %v\n", r.URL.Path)
+	switch r.URL.Path {
+	case "/internalErr":
+		http.Error(w, "webhook internal server error", http.StatusInternalServerError)
+		return
+	case "/invalidReq":
+		w.WriteHeader(http.StatusSwitchingProtocols)
+		w.Write([]byte("webhook invalid request"))
+		return
+	case "/invalidResp":
+		w.Header().Set("Content-Type", "application/json")
+		w.Write([]byte("webhook invalid response"))
+	case "/disallow":
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(&v1beta1.AdmissionReview{
+			Response: &v1beta1.AdmissionResponse{
+				Allowed: false,
+				Result: &metav1.Status{
+					Code: http.StatusForbidden,
+				},
+			},
+		})
+	case "/disallowReason":
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(&v1beta1.AdmissionReview{
+			Response: &v1beta1.AdmissionResponse{
+				Allowed: false,
+				Result: &metav1.Status{
+					Message: "you shall not pass",
+					Code:    http.StatusForbidden,
+				},
+			},
+		})
+	case "/shouldNotBeCalled":
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(&v1beta1.AdmissionReview{
+			Response: &v1beta1.AdmissionResponse{
+				Allowed: false,
+				Result: &metav1.Status{
+					Message: "doesn't expect labels to match object selector",
+					Code:    http.StatusForbidden,
+				},
+			},
+		})
+	case "/allow":
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(&v1beta1.AdmissionReview{
+			Response: &v1beta1.AdmissionResponse{
+				Allowed: true,
+				AuditAnnotations: map[string]string{
+					"key1": "value1",
+				},
+			},
+		})
+	case "/removeLabel":
+		w.Header().Set("Content-Type", "application/json")
+		pt := v1beta1.PatchTypeJSONPatch
+		json.NewEncoder(w).Encode(&v1beta1.AdmissionReview{
+			Response: &v1beta1.AdmissionResponse{
+				Allowed:   true,
+				PatchType: &pt,
+				Patch:     []byte(`[{"op": "remove", "path": "/metadata/labels/remove"}]`),
+				AuditAnnotations: map[string]string{
+					"key1": "value1",
+				},
+			},
+		})
+	case "/addLabel":
+		w.Header().Set("Content-Type", "application/json")
+		pt := v1beta1.PatchTypeJSONPatch
+		json.NewEncoder(w).Encode(&v1beta1.AdmissionReview{
+			Response: &v1beta1.AdmissionResponse{
+				Allowed:   true,
+				PatchType: &pt,
+				Patch:     []byte(`[{"op": "add", "path": "/metadata/labels/added", "value": "test"}]`),
+			},
+		})
+	case "/invalidMutation":
+		w.Header().Set("Content-Type", "application/json")
+		pt := v1beta1.PatchTypeJSONPatch
+		json.NewEncoder(w).Encode(&v1beta1.AdmissionReview{
+			Response: &v1beta1.AdmissionResponse{
+				Allowed:   true,
+				PatchType: &pt,
+				Patch:     []byte(`[{"op": "add", "CORRUPTED_KEY":}]`),
+			},
+		})
+	case "/nilResponse":
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(&v1beta1.AdmissionReview{})
+	case "/invalidAnnotation":
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(&v1beta1.AdmissionReview{
+			Response: &v1beta1.AdmissionResponse{
+				Allowed: true,
+				AuditAnnotations: map[string]string{
+					"invalid*key": "value1",
+				},
+			},
+		})
+	case "/noop":
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(&v1beta1.AdmissionReview{
+			Response: &v1beta1.AdmissionResponse{
+				Allowed: true,
+			},
+		})
+	default:
+		http.NotFound(w, r)
+	}
+}
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/util/client_config.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/util/client_config.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2017 The Kubernetes Authors.
+Copyright 2018 The Kubernetes Authors.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -14,17 +14,18 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-package tests
+package util

 import (
-	"k8s.io/apiserver/pkg/apis/example"
+	"k8s.io/apiserver/pkg/admission/plugin/webhook"
 )

-func DeepEqualSafePodSpec() example.PodSpec {
-	grace := int64(30)
-	return example.PodSpec{
-		RestartPolicy:                 "Always",
-		TerminationGracePeriodSeconds: &grace,
-		SchedulerName:                 "default-scheduler",
+// HasAdmissionReviewVersion check whether a version is accepted by a given webhook.
+func HasAdmissionReviewVersion(a string, w webhook.WebhookAccessor) bool {
+	for _, b := range w.GetAdmissionReviewVersions() {
+		if b == a {
+			return true
+		}
 	}
+	return false
 }
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/validating/BUILD
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/validating/BUILD
@@ -1,71 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-
-go_library(
-    name = "go_default_library",
-    srcs = [
-        "admission.go",
-        "doc.go",
-    ],
-    importpath = "k8s.io/apiserver/pkg/admission/plugin/webhook/validating",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//vendor/github.com/golang/glog:go_default_library",
-        "//vendor/k8s.io/api/admission/v1beta1:go_default_library",
-        "//vendor/k8s.io/api/admissionregistration/v1beta1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime/serializer:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/runtime:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/configuration:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/initializer:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/metrics:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/v1alpha1:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/errors:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/namespace:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/request:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/rules:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/versioned:go_default_library",
-        "//vendor/k8s.io/client-go/informers:go_default_library",
-        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
-    ],
-)
-
-go_test(
-    name = "go_default_test",
-    srcs = ["admission_test.go"],
-    importpath = "k8s.io/apiserver/pkg/admission/plugin/webhook/validating",
-    library = ":go_default_library",
-    deps = [
-        "//vendor/k8s.io/api/admission/v1beta1:go_default_library",
-        "//vendor/k8s.io/api/admissionregistration/v1beta1:go_default_library",
-        "//vendor/k8s.io/api/core/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/labels:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/config:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/testcerts:go_default_library",
-        "//vendor/k8s.io/apiserver/pkg/authentication/user:go_default_library",
-        "//vendor/k8s.io/client-go/rest:go_default_library",
-    ],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-    visibility = ["//visibility:public"],
-)
--- a/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/validating/admission.go
+++ b/vendor/k8s.io/apiserver/pkg/admission/plugin/webhook/validating/admission.go
@@ -1,326 +0,0 @@
-/*
-Copyright 2017 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Package validating delegates admission checks to dynamically configured
-// validating webhooks.
-package validating
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"sync"
-	"time"
-
-	"github.com/golang/glog"
-
-	admissionv1beta1 "k8s.io/api/admission/v1beta1"
-	"k8s.io/api/admissionregistration/v1beta1"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/serializer"
-	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-	"k8s.io/apimachinery/pkg/util/wait"
-	"k8s.io/apiserver/pkg/admission"
-	"k8s.io/apiserver/pkg/admission/configuration"
-	genericadmissioninit "k8s.io/apiserver/pkg/admission/initializer"
-	admissionmetrics "k8s.io/apiserver/pkg/admission/metrics"
-	"k8s.io/apiserver/pkg/admission/plugin/webhook/config"
-	webhookadmissionapi "k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission"
-	webhookadmissionapiv1alpha1 "k8s.io/apiserver/pkg/admission/plugin/webhook/config/apis/webhookadmission/v1alpha1"
-	webhookerrors "k8s.io/apiserver/pkg/admission/plugin/webhook/errors"
-	"k8s.io/apiserver/pkg/admission/plugin/webhook/namespace"
-	"k8s.io/apiserver/pkg/admission/plugin/webhook/request"
-	"k8s.io/apiserver/pkg/admission/plugin/webhook/rules"
-	"k8s.io/apiserver/pkg/admission/plugin/webhook/versioned"
-	"k8s.io/client-go/informers"
-	clientset "k8s.io/client-go/kubernetes"
-)
-
-const (
-	// Name of admission plug-in
-	PluginName = "ValidatingAdmissionWebhook"
-)
-
-// Register registers a plugin
-func Register(plugins *admission.Plugins) {
-	plugins.Register(PluginName, func(configFile io.Reader) (admission.Interface, error) {
-		plugin, err := NewValidatingAdmissionWebhook(configFile)
-		if err != nil {
-			return nil, err
-		}
-
-		return plugin, nil
-	})
-	// add our config types
-	webhookadmissionapi.AddToScheme(plugins.ConfigScheme)
-	webhookadmissionapiv1alpha1.AddToScheme(plugins.ConfigScheme)
-}
-
-// WebhookSource can list dynamic webhook plugins.
-type WebhookSource interface {
-	Run(stopCh <-chan struct{})
-	Webhooks() (*v1beta1.ValidatingWebhookConfiguration, error)
-}
-
-// NewValidatingAdmissionWebhook returns a generic admission webhook plugin.
-func NewValidatingAdmissionWebhook(configFile io.Reader) (*ValidatingAdmissionWebhook, error) {
-	kubeconfigFile, err := config.LoadConfig(configFile)
-	if err != nil {
-		return nil, err
-	}
-
-	cm, err := config.NewClientManager()
-	if err != nil {
-		return nil, err
-	}
-	authInfoResolver, err := config.NewDefaultAuthenticationInfoResolver(kubeconfigFile)
-	if err != nil {
-		return nil, err
-	}
-	// Set defaults which may be overridden later.
-	cm.SetAuthenticationInfoResolver(authInfoResolver)
-	cm.SetServiceResolver(config.NewDefaultServiceResolver())
-
-	return &ValidatingAdmissionWebhook{
-		Handler: admission.NewHandler(
-			admission.Connect,
-			admission.Create,
-			admission.Delete,
-			admission.Update,
-		),
-		clientManager: cm,
-	}, nil
-}
-
-var _ admission.ValidationInterface = &ValidatingAdmissionWebhook{}
-
-// ValidatingAdmissionWebhook is an implementation of admission.Interface.
-type ValidatingAdmissionWebhook struct {
-	*admission.Handler
-	hookSource       WebhookSource
-	namespaceMatcher namespace.Matcher
-	clientManager    config.ClientManager
-	convertor        versioned.Convertor
-}
-
-var (
-	_ = genericadmissioninit.WantsExternalKubeClientSet(&ValidatingAdmissionWebhook{})
-)
-
-// TODO find a better way wire this, but keep this pull small for now.
-func (a *ValidatingAdmissionWebhook) SetAuthenticationInfoResolverWrapper(wrapper config.AuthenticationInfoResolverWrapper) {
-	a.clientManager.SetAuthenticationInfoResolverWrapper(wrapper)
-}
-
-// SetServiceResolver sets a service resolver for the webhook admission plugin.
-// Passing a nil resolver does not have an effect, instead a default one will be used.
-func (a *ValidatingAdmissionWebhook) SetServiceResolver(sr config.ServiceResolver) {
-	a.clientManager.SetServiceResolver(sr)
-}
-
-// SetScheme sets a serializer(NegotiatedSerializer) which is derived from the scheme
-func (a *ValidatingAdmissionWebhook) SetScheme(scheme *runtime.Scheme) {
-	if scheme != nil {
-		a.clientManager.SetNegotiatedSerializer(serializer.NegotiatedSerializerWrapper(runtime.SerializerInfo{
-			Serializer: serializer.NewCodecFactory(scheme).LegacyCodec(admissionv1beta1.SchemeGroupVersion),
-		}))
-		a.convertor.Scheme = scheme
-	}
-}
-
-// WantsExternalKubeClientSet defines a function which sets external ClientSet for admission plugins that need it
-func (a *ValidatingAdmissionWebhook) SetExternalKubeClientSet(client clientset.Interface) {
-	a.namespaceMatcher.Client = client
-	a.hookSource = configuration.NewValidatingWebhookConfigurationManager(client.AdmissionregistrationV1beta1().ValidatingWebhookConfigurations())
-}
-
-// SetExternalKubeInformerFactory implements the WantsExternalKubeInformerFactory interface.
-func (a *ValidatingAdmissionWebhook) SetExternalKubeInformerFactory(f informers.SharedInformerFactory) {
-	namespaceInformer := f.Core().V1().Namespaces()
-	a.namespaceMatcher.NamespaceLister = namespaceInformer.Lister()
-	a.SetReadyFunc(namespaceInformer.Informer().HasSynced)
-}
-
-// ValidateInitialization implements the InitializationValidator interface.
-func (a *ValidatingAdmissionWebhook) ValidateInitialization() error {
-	if a.hookSource == nil {
-		return fmt.Errorf("ValidatingAdmissionWebhook admission plugin requires a Kubernetes client to be provided")
-	}
-	if err := a.namespaceMatcher.Validate(); err != nil {
-		return fmt.Errorf("ValidatingAdmissionWebhook.namespaceMatcher is not properly setup: %v", err)
-	}
-	if err := a.clientManager.Validate(); err != nil {
-		return fmt.Errorf("ValidatingAdmissionWebhook.clientManager is not properly setup: %v", err)
-	}
-	if err := a.convertor.Validate(); err != nil {
-		return fmt.Errorf("ValidatingAdmissionWebhook.convertor is not properly setup: %v", err)
-	}
-	go a.hookSource.Run(wait.NeverStop)
-	return nil
-}
-
-func (a *ValidatingAdmissionWebhook) loadConfiguration(attr admission.Attributes) (*v1beta1.ValidatingWebhookConfiguration, error) {
-	hookConfig, err := a.hookSource.Webhooks()
-	// if Webhook configuration is disabled, fail open
-	if err == configuration.ErrDisabled {
-		return &v1beta1.ValidatingWebhookConfiguration{}, nil
-	}
-	if err != nil {
-		e := apierrors.NewServerTimeout(attr.GetResource().GroupResource(), string(attr.GetOperation()), 1)
-		e.ErrStatus.Message = fmt.Sprintf("Unable to refresh the Webhook configuration: %v", err)
-		e.ErrStatus.Reason = "LoadingConfiguration"
-		e.ErrStatus.Details.Causes = append(e.ErrStatus.Details.Causes, metav1.StatusCause{
-			Type:    "ValidatingWebhookConfigurationFailure",
-			Message: "An error has occurred while refreshing the ValidatingWebhook configuration, no resources can be created/updated/deleted/connected until a refresh succeeds.",
-		})
-		return nil, e
-	}
-	return hookConfig, nil
-}
-
-// Validate makes an admission decision based on the request attributes.
-func (a *ValidatingAdmissionWebhook) Validate(attr admission.Attributes) error {
-	hookConfig, err := a.loadConfiguration(attr)
-	if err != nil {
-		return err
-	}
-	hooks := hookConfig.Webhooks
-	ctx := context.TODO()
-
-	var relevantHooks []*v1beta1.Webhook
-	for i := range hooks {
-		call, err := a.shouldCallHook(&hooks[i], attr)
-		if err != nil {
-			return err
-		}
-		if call {
-			relevantHooks = append(relevantHooks, &hooks[i])
-		}
-	}
-
-	if len(relevantHooks) == 0 {
-		// no matching hooks
-		return nil
-	}
-
-	// convert the object to the external version before sending it to the webhook
-	versionedAttr := versioned.Attributes{
-		Attributes: attr,
-	}
-	if oldObj := attr.GetOldObject(); oldObj != nil {
-		out, err := a.convertor.ConvertToGVK(oldObj, attr.GetKind())
-		if err != nil {
-			return apierrors.NewInternalError(err)
-		}
-		versionedAttr.OldObject = out
-	}
-	if obj := attr.GetObject(); obj != nil {
-		out, err := a.convertor.ConvertToGVK(obj, attr.GetKind())
-		if err != nil {
-			return apierrors.NewInternalError(err)
-		}
-		versionedAttr.Object = out
-	}
-
-	wg := sync.WaitGroup{}
-	errCh := make(chan error, len(relevantHooks))
-	wg.Add(len(relevantHooks))
-	for i := range relevantHooks {
-		go func(hook *v1beta1.Webhook) {
-			defer wg.Done()
-
-			t := time.Now()
-			err := a.callHook(ctx, hook, versionedAttr)
-			admissionmetrics.Metrics.ObserveWebhook(time.Since(t), err != nil, attr, "validating", hook.Name)
-			if err == nil {
-				return
-			}
-
-			ignoreClientCallFailures := hook.FailurePolicy != nil && *hook.FailurePolicy == v1beta1.Ignore
-			if callErr, ok := err.(*webhookerrors.ErrCallingWebhook); ok {
-				if ignoreClientCallFailures {
-					glog.Warningf("Failed calling webhook, failing open %v: %v", hook.Name, callErr)
-					utilruntime.HandleError(callErr)
-					return
-				}
-
-				glog.Warningf("Failed calling webhook, failing closed %v: %v", hook.Name, err)
-				errCh <- apierrors.NewInternalError(err)
-				return
-			}
-
-			glog.Warningf("rejected by webhook %q: %#v", hook.Name, err)
-			errCh <- err
-		}(relevantHooks[i])
-	}
-	wg.Wait()
-	close(errCh)
-
-	var errs []error
-	for e := range errCh {
-		errs = append(errs, e)
-	}
-	if len(errs) == 0 {
-		return nil
-	}
-	if len(errs) > 1 {
-		for i := 1; i < len(errs); i++ {
-			// TODO: merge status errors; until then, just return the first one.
-			utilruntime.HandleError(errs[i])
-		}
-	}
-	return errs[0]
-}
-
-// TODO: factor into a common place along with the validating webhook version.
-func (a *ValidatingAdmissionWebhook) shouldCallHook(h *v1beta1.Webhook, attr admission.Attributes) (bool, *apierrors.StatusError) {
-	var matches bool
-	for _, r := range h.Rules {
-		m := rules.Matcher{Rule: r, Attr: attr}
-		if m.Matches() {
-			matches = true
-			break
-		}
-	}
-	if !matches {
-		return false, nil
-	}
-
-	return a.namespaceMatcher.MatchNamespaceSelector(h, attr)
-}
-
-func (a *ValidatingAdmissionWebhook) callHook(ctx context.Context, h *v1beta1.Webhook, attr admission.Attributes) error {
-	// Make the webhook request
-	request := request.CreateAdmissionReview(attr)
-	client, err := a.clientManager.HookClient(h)
-	if err != nil {
-		return &webhookerrors.ErrCallingWebhook{WebhookName: h.Name, Reason: err}
-	}
-	response := &admissionv1beta1.AdmissionReview{}
-	if err := client.Post().Context(ctx).Body(&request).Do().Into(response); err != nil {
-		return &webhookerrors.ErrCallingWebhook{WebhookName: h.Name, Reason: err}
-	}
-
-	if response.Response == nil {
-		return &webhookerrors.ErrCallingWebhook{WebhookName: h.Name, Reason: fmt.Errorf("Webhook response was absent")}
-	}
-	if response.Response.Allowed {
-		return nil
-	}
-	return webhookerrors.ToStatusErr(h.Name, response.Response.Result)
-}
--- a/Show More
+++ b/Show More