taavi@tools-sgebastion-10:~ $ kubectl get namespace|grep -- "-admission"
ingress-admission                           Active   704d
registry-admission                          Active   704d
volume-admission                            Active   21d
taavi@tools-sgebastion-10:~ $ kubectl --as admin --as-group system:masters get validatingwebhookconfigurations
NAME                 WEBHOOKS   AGE
ingress-admission    1          704d  # enforces ingress hostnames only use $TOOL.toolforge.org
registry-admission   1          689d  # enforces local docker-registry use
taavi@tools-sgebastion-10:~ $ kubectl --as admin --as-group system:masters get mutatingwebhookconfigurations
NAME               WEBHOOKS   AGE
volume-admission   1          21d     # mounts nfs volumes for pods with toolforge=tool label, replacing kubernetes's PodPreset feature removed in 1.20