fix: correct webhook order to match Kubernetes admission flow

Place APIService before webhooks, with MutatingWebhookConfiguration
before ValidatingWebhookConfiguration to match standard admission control.

Signed-off-by: Mike Delucchi <git@zanuka.com>

pkg/release/util/kind_sorter.go

@@ -64,18 +64,19 @@ var InstallOrder KindSortOrder = []string{
 	"CronJob",
 	"IngressClass",
 	"Ingress",
+	"APIService",
 	"MutatingWebhookConfiguration",
 	"ValidatingWebhookConfiguration",
-	"APIService",
 }
 
 // UninstallOrder is the order in which manifests should be uninstalled (by Kind).
 //
 // Those occurring earlier in the list get uninstalled before those occurring later in the list.
 var UninstallOrder KindSortOrder = []string{
-	"APIService",
+	// For uninstall, we remove validation before mutation to ensure webhooks don't block removal
 	"ValidatingWebhookConfiguration",
 	"MutatingWebhookConfiguration",
+	"APIService",
 	"Ingress",
 	"IngressClass",
 	"Service",

pkg/release/util/kind_sorter_test.go

@@ -188,8 +188,8 @@ func TestKindSorter(t *testing.T) {
 		order       KindSortOrder
 		expected    string
 	}{
-		{"install", InstallOrder, "FaAbcC3deEf1gh2iIjJkKlLmnopqrxstuUvMVw!"},
-		{"uninstall", UninstallOrder, "wVMvUmutsxrqponLlKkJjIi2hg1fEed3CcbAaF!"},
+		{"install", InstallOrder, "FaAbcC3deEf1gh2iIjJkKlLmnopqrxstuUvwMV!"},
+		{"uninstall", UninstallOrder, "VMwvUmutsxrqponLlKkJjIi2hg1fEed3CcbAaF!"},
 	} {
 		var buf bytes.Buffer
 		t.Run(test.description, func(t *testing.T) {