Istio: Gateway API, seccomp value, native sidecars, new registry

[juliusvonkohout]

Validation Checklist

• Is this a Kubeflow issue?
• Are you posting in the right repository ?
• Did you follow the Kubeflow installation guideline ?
• Is the issue report properly structured and detailed with version numbers?
• Is this for Kubeflow development ?
• Would you like to work on this issue?
• You can join the CNCF Slack and access our meetings at the Kubeflow Community website. Our channel on the CNCF Slack is here #kubeflow-platform.

Version

master

Describe your issue

Since istio has been upgraded in #2950 the next part is the seccomp value and the gateway api CC @biswajit-9776

Steps to reproduce the issue

See #2907 and #2938

Put here any screenshots or videos (optional)

No response

[juliusvonkohout]

@biswajit-9776 @MaxKavun

[juliusvonkohout]

@akagami-harsh can you help here as well?

[akagami-harsh]

/assign

[juliusvonkohout]

@akagami-harsh can you also update the base images for istio and busybox according to #3010 (comment) ?

[juliusvonkohout]

CC @tarekabouzeid

[juliusvonkohout]

#3022 should cover "native sidecars, new registry" so the new Gateway API is remaining.

manifests/.github/workflows/pss_test.yaml

Lines 39 to 47 in 8d69c8d

	run: |
	kubectl get cm istio-sidecar-injector -n istio-system -o yaml > temporary_patch.yaml
	sed -i '0,/runAsNonRoot: true/{s//&\n seccompProfile:\n type: RuntimeDefault/}' temporary_patch.yaml
	sed -i '/runAsNonRoot: true/{N; /runAsUser: {{ .ProxyUID | default "1337" }}/a\
	seccompProfile:\n type: RuntimeDefault
	}' temporary_patch.yaml
	kubectl apply -f temporary_patch.yaml
	rm temporary_patch.yaml

so the sidecar seccomp profile still needs to be integrated directly into istio and https://github.com/kubeflow/manifests/blob/master/.github/workflows/pss_test.yaml must be merged into https://github.com/kubeflow/manifests/blob/master/.github/workflows/pipeline_test.yaml