GEP-1762 enforces resources to be created in the Gateway namespace

[arkodg]

What happened:

The Automated Deployments section with GEP-1762 mentions the following

MUST provision generated resources in the same namespace as the Gateway if they are namespace scoped resources.

What you expected to happen:

My suggestion is to modify the MUST to SHOULD . Some implementations such as Envoy Gateway dont have write access into user namespaces and can write into an infrastructure namespace

How to reproduce it (as minimally and precisely as possible):

Anything else we need to know?:

[arkodg]

discussed this issue in the community meeting today, here's a summary

• Debugging is convenient if generated resources live in the same namespace, however this doesnt need to be enforced, since some implementations may not have privileges to write into other namespaces, so moving the statement to SHOULD should be okay.
• To fix the discoverability issue of finding the generated resources if they exist in a different namespace, can be solved by adding an additional label like gateway.networking.k8s.io/gateway-namespace
• The above GEP statements havent yet made their way into the API docs but the GatewayInfrastructure conformance test tests this out, so this test can be marked as Provisional until the GEP and API docs reflect the updated changes
  cc @youngnick @robscott

[rouke-broersma]

Some implementations such as Envoy Gateway dont have write access into user namespaces and can write into an infrastructure namespace

I'm curious what in this model a user and an infrastructure namespace entails. In my mind with the design goal of gateway api and it's personas a gateway resource would never live in a 'user' namespace, this would always live in some kind of infrastructure namespace (depending on definitions of these types of namespaces).

[arkodg]

Some implementations such as Envoy Gateway dont have write access into user namespaces and can write into an infrastructure namespace

I'm curious what in this model a user and an infrastructure namespace entails. In my mind with the design goal of gateway api and it's personas a gateway resource would never live in a 'user' namespace, this would always live in some kind of infrastructure namespace (depending on definitions of these types of namespaces).

@rouke-broersma, the user here is the platform engineer/admin. The point this GH issue is trying to make is that both the deployment models are valid, some implementations support both these models, but will default to 1. or 2.

1. deploying generated resources in a separate infrastructure namespace to limit write access to the controller/implementation, troubleshooting can still be achieved by analyzing Gateway.Status
2. deploying generated resources in the Gateway namespace for more control of the generated resource

so the MUST enforcement should be relaxed to a SHOULD

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

[k8s-ci-robot]

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.