feat: migrating to validating admission policies for our validating logic (2/): enable the VAP manager

[michaelawyu (michaelawyu)]

Description of your changes

This PR enables the admission policy manager in the hub agent and adds additional E2E tests.

Fixes #707

I have:

• Associated this change with a known KubeFleet Issue (Bug, Feature, etc).
• Run make reviewable to ensure this PR is ready for review.

How has this code been tested

• E2E tests
• UTs

Special notes for your reviewer

[codecov]

Codecov Report

❌ Patch coverage is 57.14286% with 18 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
pkg/admissionpolicymanager/configs.go	35.71%	16 Missing and 2 partials ⚠️

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

This PR enables the Validating Admission Policy (VAP) manager path in the hub agent (including Helm chart wiring + new CLI options), and adds E2E coverage for VAP-enforced guard-rail behavior while selectively skipping overlapping webhook E2Es.

Changes:

• Add hub-agent option flags + startup wiring to read/validate an admission policy manager config and install/GC VAPs on startup.
• Extend admission policy generation logic (e.g., kubeadm admin group exemption) and simplify policy manager initialization.
• Update Helm chart + E2E setup/tests to enable the admission policy manager and validate denial behavior via VAPs.

Reviewed changes

Copilot reviewed 24 out of 24 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
test/e2e/setup.sh	Enables admission policy manager in the E2E hub-agent Helm install and mounts a config file via ConfigMap data.
test/e2e/setup_test.go	Adds VAP-related toggles used to run/skip webhook vs VAP E2E cases.
test/e2e/fleet_guard_rail_test.go	Skips a webhook E2E suite when the equivalent VAP is enabled.
test/e2e/admission_policy_manager_cfg.yaml	Adds an E2E admission policy manager config (reserved namespace prefixes).
test/e2e/admission_policies_test.go	Adds new E2E coverage validating VAP denial behavior for SAs/token requests (and optional pod/RS denials).
pkg/webhook/webhook.go	Switches webhook config construction to the renamed combined webhook/admission-policy options struct.
pkg/webhook/webhook_test.go	Updates webhook config unit tests for the renamed options struct.
pkg/admissionpolicymanager/svcaccountsntokenreqs.go	Exempts kubeadm:cluster-admins group from the SA/token-request VAP.
pkg/admissionpolicymanager/suite_test.go	Updates admission policy manager test setup for the new constructor signature.
pkg/admissionpolicymanager/manager.go	Simplifies manager construction to enable all non-nil generators from config (no explicit enabled list).
pkg/admissionpolicymanager/manager_integration_test.go	Updates CEL expression expectation to include kubeadm admin group exemption.
pkg/admissionpolicymanager/configs.go	Adds config validation across generators and ensures default config includes both generators.
cmd/hubagent/workload/setup.go	Uses the renamed combined options struct for EnableWorkload.
cmd/hubagent/options/webhooks.go	Renames and extends webhook options to include admission policy manager enablement + config path flags.
cmd/hubagent/options/validation.go	Validates admission policy manager config file readability/unmarshal + generator validation when enabled.
cmd/hubagent/options/validation_test.go	Adds unit tests for admission policy manager config validation and updates existing validation tests for renamed options.
cmd/hubagent/options/options.go	Renames the Options field to WebhookAndAdmissionPolicyOpts.
cmd/hubagent/options/options_test.go	Updates flag parsing tests for the renamed/extended options struct.
cmd/hubagent/main.go	Starts the admission policy manager (including reading config + uncached client creation) when enabled.
charts/hub-agent/values.yaml	Adds values to enable admission policy manager and to mount additional config data.
charts/hub-agent/templates/rbac.yaml	Conditionally grants RBAC to manage VAPs/bindings when the manager is enabled.
charts/hub-agent/templates/deployment.yaml	Wires new flags and mounts additional config data into the hub-agent pod.
charts/hub-agent/templates/config.yaml	Adds a conditional ConfigMap for additionalConfigData.
charts/hub-agent/README.md	Documents new Helm values for admission policy manager/config injection.

[Britania Rodriguez Reyes (britaniar)]

May need to double check this e2e. Keeps failing.

[michaelawyu (michaelawyu)]

Thanks, Britania! Merging this to unblock progress; will start the backport PR.