GatewayClass with custom configuration and ReferenceGrant to narrow cross-namespace access

[programmer04]

This is an open question, food for thought, which I encountered during work on

• ☔ Custom plugin distribution Kong/gateway-operator#371

Below is a simplified description that includes the core problem.

GatewayClass is a cluster-scoped resource that allows a field ParametersRef filled with an arbitrarily chosen K8s object in any namespace, e.g. custom CRD GatewayConfiguration which is namespace scoped. For this ReferenceGrant can be easily implemented to narrow access.

But imagine (this is a real case) that GatewayConfiguration can also reference some other namespace-scoped Kubernetes resources (e.g. let's assume it's CustomPlugin), which would be in another namespace. Furthermore, Gateway can be configured in any namespace based on GatewayClass and needs those namespace-scoped objects configured in it.

The open question is how ReferenceGrant should be implemented and evaluated in such a situation. Also is it possible to implement it robustly? I mean that malicious actors won't be able to bypass it. Or maybe the most reasonable thing to do is to give up and document that for those cross-namespace access is allowed and not restricted...