Allow is a replacement for controller-runtime's admission.Allowed() that allows you to set the message (human-readable) as opposed to the reason (machine-readable).

CodeFromReason implements the needed subset of https://godoc.org/k8s.io/apimachinery/pkg/apis/meta/v1#StatusReason.

Deny is a replacement for controller-runtime's admission.Denied() that allows you to set _both_ a human-readable message _and_ a machine-readable reason, and also sets the code correctly instead of hardcoding it to 403 Forbidden.

DenyInvalid is a wrapper for Deny with reason metav1.StatusReasonInvalid.

IsHNCServiceAccount is inspired by isGKServiceAccount from open-policy-agent/gatekeeper.