Bump Gateway API to v0.8.0-rc2

changelogs/unreleased/5568-sunjayBhatia-minor.md

@@ -0,0 +1,6 @@
+## Support Gateway API v0.8.0
+
+Contour now supports Gateway API v0.8.0, keeping up to date with conformance and API changes.
+This release mainly contains refinements to status conditions, conformance test additions, and the addition of CEL validation for Gateway API CRDs.
+The previous version of Contour supported Gateway API v0.6.2 and there have been multiple releases in the interim.
+See [v0.7.0 release notes](https://github.com/kubernetes-sigs/gateway-api/releases/tag/v0.7.0), [v0.7.1 release notes ](https://github.com/kubernetes-sigs/gateway-api/releases/tag/v0.7.1), and [v0.8.0 release notes](https://github.com/kubernetes-sigs/gateway-api/releases/tag/v0.8.0) for more detail on the content of these releases.

examples/gateway/00-namespace.yaml

@@ -2,3 +2,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: gateway-system
+  labels:
+    pod-security.kubernetes.io/enforce: restricted
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/warn: restricted

examples/gateway/01-admission_webhook.yaml

@@ -56,8 +56,8 @@ spec:
     spec:
       containers:
       - name: webhook
-        image: registry.k8s.io/gateway-api/admission-server:v0.7.1
-        imagePullPolicy: Always
+        image: registry.k8s.io/gateway-api/admission-server:v0.8.0-rc2
+        imagePullPolicy: IfNotPresent
         args:
         - -logtostderr
         - --tlsCertFile=/etc/certs/cert
@@ -79,7 +79,16 @@ spec:
           mountPath: /etc/certs
           readOnly: true
         securityContext:
+          allowPrivilegeEscalation: false
           readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          runAsUser: 65532
+          runAsGroup: 65532
+          capabilities:
+            drop:
+            - "ALL"
+          seccompProfile:
+            type: RuntimeDefault
       volumes:
       - name: webhook-certs
         secret:

examples/gateway/02-certificate_config.yaml

@@ -92,19 +92,31 @@ spec:
         imagePullPolicy: IfNotPresent
         args:
         - create
-        - --host=gateway-api-admission-server,gateway-api-admission-server.gateway-system.svc
-        - --namespace=gateway-system
+        - --host=gateway-api-admission-server,gateway-api-admission-server.$(POD_NAMESPACE).svc
+        - --namespace=$(POD_NAMESPACE)
         - --secret-name=gateway-api-admission
         env:
         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          runAsUser: 2000
+          runAsGroup: 2000
+          capabilities:
+            drop:
+            - "ALL"
+          seccompProfile:
+            type: RuntimeDefault
       restartPolicy: OnFailure
       serviceAccountName: gateway-api-admission
       securityContext:
         runAsNonRoot: true
         runAsUser: 2000
+        runAsGroup: 2000
 ---
 apiVersion: batch/v1
 kind: Job
@@ -127,7 +139,7 @@ spec:
         args:
         - patch
         - --webhook-name=gateway-api-admission
-        - --namespace=gateway-system
+        - --namespace=$(POD_NAMESPACE)
         - --patch-mutating=false
         - --patch-validating=true
         - --secret-name=gateway-api-admission
@@ -137,8 +149,20 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          runAsUser: 2000
+          runAsGroup: 2000
+          capabilities:
+            drop:
+            - "ALL"
+          seccompProfile:
+            type: RuntimeDefault
       restartPolicy: OnFailure
       serviceAccountName: gateway-api-admission
       securityContext:
         runAsNonRoot: true
         runAsUser: 2000
+        runAsGroup: 2000