Validate CRDs labels in validating webhook

[GraysonWu]

Describe what you are trying to solve
Currently while creating K8s resources, for example, Pod, k8s NeworkPolicy, etc., the API server will validate if labels used in those resources are valid. For example, if I use an invalid character '=', it will return:

The Deployment "client" is invalid: metadata.labels: Invalid value: "foo=bar": a valid label must be an empty string or consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyValue',  or 'my_value',  or '12345', regex used for validation is '(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?')

But now our CRDs with invalid labels can be accepted, for example, the acnp below:

apiVersion: crd.antrea.io/v1alpha1
kind: ClusterNetworkPolicy
metadata:
  name: acnp-invalid-labels
spec:
    priority: 5
    tier: SecurityOps
    appliedTo:
      - podSelector:
          matchLabels:
            app: client
    egress:
      - action: Reject
        to:
          - podSelector:
              matchLabels:
                app: foo=bar

This ACNP won't have any effect since no Pod will have this invalid label app: foo=bar. But Antrea will still waste computing resource to process this ACNP.

Describe the solution you have in mind
I'm wondering if we could add this validation in out validating webhook?

Idea comes from here