incompatibility issue between AWS ECR pull-through repo and ECR admission webhook

[pasitconsulting]

by default the AWS ECR pull-through solution doesnt set immutability or scan on push on the cached ECR repos it implicitly creates.
This means in any namespace where we have a tag 'ecr-compliance' set to enabled the admission webhook enforces criteria which the AWS ECR pull-through solution doesnt comply with.

i attempted a workaround of creating my own ECR repo with immutability and push-on-scan set, with upstream images (from docker.io/gcr.io) pushed.
When i scale a workload that pulls from this manually created repo i get the following error:-
Error creating: Internal error occurred: failed calling webhook "admission.ecr.amazonaws.com": failed to call webhook: an error on the server ("unknown") has prevented the request from succeeding