fix(metrics): double counting injection failures

Fix injection counting logic in `Handle()` to address a potential
double counting of an injection failure. Prior to this change, if
`Mutate()` returned an error, an injection failure would be counted
immediately. Then, if the response could not be serialized or written
back, a second failure would be counted.

agent-inject/handler.go

@@ -138,10 +138,6 @@ func (h *Handler) Handle(w http.ResponseWriter, r *http.Request) {
 		admResp.Response = h.Mutate(admReq.Request)
 	}
 
-	if !admResp.Response.Allowed {
-		incrementInjectionFailures(admReq.Request.Namespace)
-	}
-
 	// Default to a v1 AdmissionReview, otherwise the API server may not recognize the request
 	// if multiple AdmissionReview versions are permitted by the webhook config.
 	if actualAdmRevGVK == nil || *actualAdmRevGVK == (schema.GroupVersionKind{}) {
@@ -162,8 +158,13 @@ func (h *Handler) Handle(w http.ResponseWriter, r *http.Request) {
 	if _, err := w.Write(resp); err != nil {
 		h.Log.Error("error writing response", "Error", err)
 		incrementInjectionFailures(admReq.Request.Namespace)
-	} else {
+		return
+	}
+
+	if admResp.Response.Allowed {
 		incrementInjections(admReq.Request.Namespace)
+	} else {
+		incrementInjectionFailures(admReq.Request.Namespace)
 	}
 }