cluster/kube: deploy admitomatic webhook

This has been (succesfully) tested on prod and then rolled back.

Change-Id: I22657f66b4aeaa8a0ae452035ba18a79f4549b14
diff --git a/kube/kube.libsonnet b/kube/kube.libsonnet
index 929c6f2..8d7254a 100644
--- a/kube/kube.libsonnet
+++ b/kube/kube.libsonnet
@@ -17,6 +17,11 @@
         secret: { secretName: certificate.spec.secretName },
     },
 
+    ValidatingWebhookConfiguration(name): kube._Object("admissionregistration.k8s.io/v1", "ValidatingWebhookConfiguration", name) {
+        webhooks_:: error "webhooks_ must be defined",
+        webhooks: kube.mapToNamedList(self.webhooks_),
+    },
+
     # Add .Contain method to Namespaces, allowing for easy marking of particular
     # kube objects as contained in that namespace.
     Namespace(name): kube.Namespace(name) {