PodSecurity: update webhook manifest to use named port

staging/src/k8s.io/pod-security-admission/webhook/manifests/50-deployment.yaml

@@ -31,7 +31,11 @@ spec:
           image: k8s.gcr.io/sig-auth/pod-security-webhook:v1.23-beta.0
           terminationMessagePolicy: FallbackToLogsOnError
           ports:
-            - containerPort: 8443
+            - name: webhook
+              # A port > 1024 avoids needing low port bind privileges.
+              # Using the same port as the kubelet is likely to already be permitted in apiserver -> node firewall rules.
+              # The pod has its own IP and doesn't run with hostNetwork, so there's no port conflict with the kubelet.
+              containerPort: 10250
           args:
             [
               "--config",
@@ -41,7 +45,7 @@ spec:
               "--tls-private-key-file",
               "/etc/pki/tls.key",
               "--secure-port",
-              "8443",
+              "10250",
             ]
           resources:
             requests:

staging/src/k8s.io/pod-security-admission/webhook/manifests/60-service.yaml

@@ -8,7 +8,7 @@ metadata:
 spec:
   ports:
     - port: 443
-      targetPort: 8443
+      targetPort: webhook
       protocol: TCP
       name: https
   selector: