chore: revert dry-run admission tests (#2038)

* fix: allow administrator operations on tenant namespaces

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* fix: allow administrator operations on tenant namespaces

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* fix: allow administrator operations on tenant namespaces

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* fix: allow administrator operations on tenant namespaces

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* fix: revert dry-run

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* fix: revert dry-run

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* fix: revert dry-run

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: implement namespace metadata enforcement

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

---------

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Author: oliverbaehler

e2e/config_namespace_hijacking_test.go

@@ -399,7 +399,7 @@ var _ = Describe("creating several Namespaces for a Tenant", Ordered, Label("con
 		_, err = cs.CoreV1().Namespaces().UpdateStatus(
 			context.TODO(),
 			hijacked,
-			metav1.UpdateOptions{DryRun: []string{metav1.DryRunAll}},
+			metav1.UpdateOptions{},
 		)
 
 		if err != nil {
@@ -484,7 +484,7 @@ var _ = Describe("creating several Namespaces for a Tenant", Ordered, Label("con
 		_, err = cs.CoreV1().Namespaces().Finalize(
 			context.TODO(),
 			hijacked,
-			metav1.UpdateOptions{DryRun: []string{metav1.DryRunAll}},
+			metav1.UpdateOptions{},
 		)
 
 		if err != nil {
@@ -525,7 +525,7 @@ var _ = Describe("creating several Namespaces for a Tenant", Ordered, Label("con
 			_, err = cs.CoreV1().Namespaces().Update(
 				context.TODO(),
 				current,
-				metav1.UpdateOptions{DryRun: []string{metav1.DryRunAll}},
+				metav1.UpdateOptions{},
 			)
 
 			Expect(err).To(HaveOccurred())
@@ -950,7 +950,10 @@ var _ = Describe("creating several Namespaces for a Tenant", Ordered, Label("con
 				UID:        tenant.GetUID(),
 			}}
 
-			_, _ = cs.CoreV1().Namespaces().UpdateStatus(context.TODO(), statusNs, metav1.UpdateOptions{DryRun: []string{metav1.DryRunAll}})
+			_, err = cs.CoreV1().Namespaces().UpdateStatus(context.TODO(), statusNs, metav1.UpdateOptions{})
+			Expect(err).To(HaveOccurred())
+			Expect(apierrors.IsForbidden(err)).To(BeTrue())
+			Expect(err).To(MatchError(ContainSubstring("namespace can not be patched into a tenant")))
 
 			patch := []byte(fmt.Sprintf(
 				`{"metadata":{"labels":{"%s":"%s"}}}`,
@@ -1219,7 +1222,7 @@ var _ = Describe("creating several Namespaces for a Tenant", Ordered, Label("con
 				},
 			}
 
-			_, err = cs.CoreV1().Namespaces().UpdateStatus(context.TODO(), statusNs, metav1.UpdateOptions{DryRun: []string{metav1.DryRunAll}})
+			_, err = cs.CoreV1().Namespaces().UpdateStatus(context.TODO(), statusNs, metav1.UpdateOptions{})
 			if err != nil {
 				expectOriginalTenantOwnership(ns.Name, tenant)
 
@@ -1261,7 +1264,7 @@ var _ = Describe("creating several Namespaces for a Tenant", Ordered, Label("con
 
 			statusNs.Labels[meta.TenantLabel] = randomName
 
-			_, err = cs.CoreV1().Namespaces().UpdateStatus(context.TODO(), statusNs, metav1.UpdateOptions{DryRun: []string{metav1.DryRunAll}})
+			_, err = cs.CoreV1().Namespaces().UpdateStatus(context.TODO(), statusNs, metav1.UpdateOptions{})
 			if err != nil {
 				expectOriginalTenantOwnership(ns.Name, tenant)
 
@@ -1312,7 +1315,7 @@ var _ = Describe("creating several Namespaces for a Tenant", Ordered, Label("con
 				},
 			}
 
-			_, err = cs.CoreV1().Namespaces().UpdateStatus(context.TODO(), statusNs, metav1.UpdateOptions{DryRun: []string{metav1.DryRunAll}})
+			_, err = cs.CoreV1().Namespaces().UpdateStatus(context.TODO(), statusNs, metav1.UpdateOptions{})
 			if err != nil {
 				retrievedNs := getNamespace(ns.Name)
 
@@ -1361,7 +1364,7 @@ var _ = Describe("creating several Namespaces for a Tenant", Ordered, Label("con
 				},
 			}
 
-			_, err = cs.CoreV1().Namespaces().UpdateStatus(context.TODO(), statusNs, metav1.UpdateOptions{DryRun: []string{metav1.DryRunAll}})
+			_, err = cs.CoreV1().Namespaces().UpdateStatus(context.TODO(), statusNs, metav1.UpdateOptions{})
 			if err != nil {
 				expectNoTenantOwnership(unmanaged.Name, tenant)