Install a validating webhook for Gateway API custom resources

[jpeach]

Description

Gateway API has a validating webhook because not all the invariants of the API can be enforced by CRD validation. We need to install the validation webhook for the Gateway API types, though not necessarily as a separate controller. I expect that the gateway controller can be the admission controller, since the validation is exposed as a public package in the gateway Go module.

https://github.com/kubernetes-sigs/gateway-api/blob/master/deploy/admission_webhook.yaml

[jpeach]

triage: We want this because there's no other machinery that installs the webhook and it's better to give early feedback for users.

[michaelbeaumont]

I expect that the gateway controller can be the admission controller, since the validation is exposed as a public package in the gateway Go module.

I think we may want to separate our validation from core Gateway API validation since our validator will end up validating resources of a different gatewayClass which may be unexpected behavior. It's not clear who's responsible for the webhook, so users might end up installing the upstream webhook to validate all their Gateway resources on their own.

[jpeach]

I expect that the gateway controller can be the admission controller, since the validation is exposed as a public package in the gateway Go module.

I think we may want to separate our validation from core Gateway API validation since our validator will end up validating resources of a different gatewayClass which may be unexpected behavior. It's not clear who's responsible for the webhook, so users might end up installing the upstream webhook to validate all their Gateway resources on their own.

In principle, it's OK for multiple controllers to validate gateway resources. Could be a trap if someone has some buggy validation though.

[github-actions]

This issue was inactive for 30 days it will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant please comment on it promptly or attend the next triage meeting.

[lahabana]

xref #3905

[michaelbeaumont]

See also kubernetes-sigs/gateway-api#1005