I'm currently writing a custom admission webhook to accept/deny at the creation of a CRD that I defined.
My main purpose is to ensure the creation of this resource won't go beyond a certain quota but with some custom logic around it.
I can do this easily with an atomic counter on the custom webhook.

The thing is I'm not sure what happens with that custom admission if another webhook would fail just after (making my "customRessourceQuota" out of sync as it will be incremented by 1 but no resource has booted).

So my question is how do K8s chains its admission webhooks?

• Does custom ones are the ending ones?
• Can we adjust the order ourselves?
• Should I use another mechanism of K8s to make my own quota?

PS: I've looked into the ResourceQuota calculator code but didn't find a good answer to this neither