Description

The apiext server watches for CRD's and will ensure they are patched properly (unless disabled). Previously,
we were restricting our resources by the default provided label selectors of app.kubernetes.io/part-of: emissary-apiext when setting up our watch of the CRD resources in a cluster. Unfortunately, K8s doesn't support sets in the field selectors so we couldn't watch for specifically named CRD's per this:

https://kubernetes.io/docs/concepts/overview/working-with-objects/field-selectors/#supported-operators

So, removing this restriction had a few downside affects:

• If a user customizes the Labels so they no longer match the default provided manifest then it would cause
  the apiext server to never become ready.
• It caches all CRD's in the cluster and for large clusters we observed the apiext deployment memory going
  from about 20mb to 80mb.
• Without the label selector restriction we attempt to patch all resources in the getambassador.io group
  which means other resources not related to the APIGateway are then patched when they should not be.

The fix does the following:

1. Adds a flag for setting the crd-label-selectors
   1. Defaults to --crd-label-selectors="app.kubernetes.io/part-of=emissary-apiext"
2. crd-label-selectors configured via the new flags are passed along to the CRD List Watch options to limit
   what is cached.
3. We added an additional check when patching the CRD to ignore CRD's explicitly set with Spec.Conversion.Strategy == "None".

These three changes will ensure:

• we can limit memory usage of apiext with clusters with lots of CRD's installed
• we only patch the required CRD's
• accommodate custom installs for labels and namespaces

Related Issues

n/a

Testing

Manually tested in a cluster and added two new e2e tests for running apiext in a different namespace and modifying CRD labels.

Checklist

• Does my change need to be backported to a previous release?
• I made sure to update CHANGELOG.md.
• This is unlikely to impact how Ambassador performs at scale.
• My change is adequately tested.
• I updated DEVELOPING.md with any any special dev tricks I had to use to work on this code efficiently.
• The changes in this PR have been reviewed for security concerns and adherence to security best practices.