[Story] Look into admission webhook as alternative to ClusterCryostat

[ebaron]

It would be nice for Cryostat 3.0 if we could combine the Cryostat and ClusterCryostat APIs. One possibility is keeping the namespaced Cryostat CRD and using a validating admission webhook:
https://sdk.operatorframework.io/docs/building-operators/golang/webhook/#1-validating-admission-webhook

We could add a targetNamespaces field to the Cryostat instance. If possible, the webhook would use the user info the AdmissionRequest to do an authorization check against the target namespaces (e.g. can user X create a Cryostat in namespaces Y, Z).

There would still be potential for role binding name conflicts to account for as we already deal with between the ClusterCryostat and Cryostat APIs.

[ebaron]

Consider also using the webhook to check for any potential naming conflicts across target namespaces.

[ebaron]

Another possibility to avoid name conflicts is to use GenerateName on some initial resource, maybe the lock ConfigMap, and store the resulting name in the CR. Then use that generated name consistently for all other objects owned by that CR.

[ebaron]

Yet another possibility is to not rely on the names of objects but to use labels or annotations to indicate which CR owns them, and then use a List instead of Get operation.