EnsureRBAC ensures all the necessary RBAC resources exist for the provided contour.

EnsureRBACDeleted ensures all the necessary RBAC resources for the provided contour are deleted if Contour owner labels exist.

NewUnprivilegedPodSecurity makes a a non-root PodSecurityContext object using 65534 as the user and group ID.

TagFromImage returns the tag from the provided image or an empty string if the image does not contain a tag.

CertGenRbacName is the name used for Contour certificate generation RBAC resources.

ContourRbacName is the name used for Contour RBAC resources.

ContourRoleBindingName is a special case RoleBinding name since the certgen RoleBinding name is "contour".

EnvoyRbacName is the name used for Envoy RBAC resources.