fix: setting namespace in team-admin services

[merll]

📌 Summary

Since the Gateway API implementation, setting the namespace field in the team-admin's Services has no effect. This PR fixes that issue.

🔍 Reviewer Notes

🧹 Checklist

• Code is readable, maintainable, and robust.
• Unit tests added/updated

[svcAPLBot]

Comparison of Helm chart templating output:

# kube-prometheus-stack/templates/prometheus/additionalScrapeConfigs.yaml

@@ data.additional-scrape-configs.yaml @@
! ± value change
- LSBqb2JfbmFtZTogcHJvYmUtc2VydmljZXMtYWRtaW4KICBtZXRyaWNzX3BhdGg6IC9wcm9iZQogIHBhcmFtczoKICAgIG1vZHVsZToKICAgIC0gaHR0cF8yeHgKICByZWxhYmVsX2NvbmZpZ3M6CiAgLSBzb3VyY2VfbGFiZWxzOgogICAgLSBfX2FkZHJlc3NfXwogICAgdGFyZ2V0X2xhYmVsOiBfX3BhcmFtX3RhcmdldAogIC0gc291cmNlX2xhYmVsczoKICAgIC0gX19wYXJhbV90YXJnZXQKICAgIHRhcmdldF9sYWJlbDogaW5zdGFuY2UKICAtIHJlcGxhY2VtZW50OiBwcm9tZXRoZXVzLWJsYWNrYm94LWV4cG9ydGVyLm1vbml0b3Jpbmc6OTExNQogICAgdGFyZ2V0X2xhYmVsOiBfX2FkZHJlc3NfXwogIHNjcmFwZV9pbnRlcnZhbDogMW0KICBzdGF0aWNfY29uZmlnczoKICAtIGxhYmVsczoKICAgICAgbmFtZXNwYWNlOiB0ZWFtLWFkbWluCiAgICB0YXJnZXRzOgogICAgLSBodHRwczovL2hlbGxvLnRlYW0tYWRtaW4uZGV2Lmxpbm9kZS1hcGwubmV0LwotIGpvYl9uYW1lOiBwcm9iZS1zZXJ2aWNlcy1kZW1vCiAgbWV0cmljc19wYXRoOiAvcHJvYmUKICBwYXJhbXM6CiAgICBtb2R1bGU6CiAgICAtIGh0dHBfMnh4CiAgcmVsYWJlbF9jb25maWdzOgogIC0gc291cmNlX2xhYmVsczoKICAgIC0gX19hZGRyZXNzX18KICAgIHRhcmdldF9sYWJlbDogX19wYXJhbV90YXJnZXQKICAtIHNvdXJjZV9sYWJlbHM6CiAgICAtIF9fcGFyYW1fdGFyZ2V0CiAgICB0YXJnZXRfbGFiZWw6IGluc3RhbmNlCiAgLSByZXBsYWNlbWVudDogcHJvbWV0aGV1cy1ibGFja2JveC1leHBvcnRlci5tb25pdG9yaW5nOjkxMTUKICAgIHRhcmdldF9sYWJlbDogX19hZGRyZXNzX18KICBzY3JhcGVfaW50ZXJ2YWw6IDFtCiAgc3RhdGljX2NvbmZpZ3M6CiAgLSBsYWJlbHM6CiAgICAgIG5hbWVzcGFjZTogdGVhbS1kZW1vCiAgICB0YXJnZXRzOgogICAgLSBodHRwczovL2hhcy1jZXJ0LXN2Yy1kZW1vLmRldi5saW5vZGUtYXBsLm5ldC9qZWhvCiAgICAtIGh0dHBzOi8vaGVsbG8tZGVtby5kZXYubGlub2RlLWFwbC5uZXQvCiAgICAtIGh0dHBzOi8vdGxzcGFzcy5kZXYubGlub2RlLWFwbC5uZXQvCiAgICAtIGh0dHBzOi8vaGVsbG8tYmx1ZS1ncmVlbi1kZW1vLmRldi5saW5vZGUtYXBsLm5ldC8KICAgIC0gaHR0cHM6Ly9zZXJ2aWNlLWEtZGVtby5kZXYubGlub2RlLWFwbC5uZXQvCiAgICAtIGh0dHBzOi8vc2VydmljZS1lLWRlbW8uZGV2Lmxpbm9kZS1hcGwubmV0LwotIGpvYl9uYW1lOiBwcm9iZS1zZXJ2aWNlcy1kZXYKICBtZXRyaWNzX3BhdGg6IC9wcm9iZQogIHBhcmFtczoKICAgIG1vZHVsZToKICAgIC0gaHR0cF8yeHgKICByZWxhYmVsX2NvbmZpZ3M6CiAgLSBzb3VyY2VfbGFiZWxzOgogICAgLSBfX2FkZHJlc3NfXwogICAgdGFyZ2V0X2xhYmVsOiBfX3BhcmFtX3RhcmdldAogIC0gc291cmNlX2xhYmVsczoKICAgIC0gX19wYXJhbV90YXJnZXQKICAgIHRhcmdldF9sYWJlbDogaW5zdGFuY2UKICAtIHJlcGxhY2VtZW50OiBwcm9tZXRoZXVzLWJsYWNrYm94LWV4cG9ydGVyLm1vbml0b3Jpbmc6OTExNQogICAgdGFyZ2V0X2xhYmVsOiBfX2FkZHJlc3NfXwogIHNjcmFwZV9pbnRlcnZhbDogMW0KICBzdGF0aWNfY29uZmlnczoKICAtIGxhYmVsczoKICAgICAgbmFtZXNwYWNlOiB0ZWFtLWRldgogICAgdGFyZ2V0czogbnVsbA==
+ LSBqb2JfbmFtZTogcHJvYmUtc2VydmljZXMtYWRtaW4KICBtZXRyaWNzX3BhdGg6IC9wcm9iZQogIHBhcmFtczoKICAgIG1vZHVsZToKICAgIC0gaHR0cF8yeHgKICByZWxhYmVsX2NvbmZpZ3M6CiAgLSBzb3VyY2VfbGFiZWxzOgogICAgLSBfX2FkZHJlc3NfXwogICAgdGFyZ2V0X2xhYmVsOiBfX3BhcmFtX3RhcmdldAogIC0gc291cmNlX2xhYmVsczoKICAgIC0gX19wYXJhbV90YXJnZXQKICAgIHRhcmdldF9sYWJlbDogaW5zdGFuY2UKICAtIHJlcGxhY2VtZW50OiBwcm9tZXRoZXVzLWJsYWNrYm94LWV4cG9ydGVyLm1vbml0b3Jpbmc6OTExNQogICAgdGFyZ2V0X2xhYmVsOiBfX2FkZHJlc3NfXwogIHNjcmFwZV9pbnRlcnZhbDogMW0KICBzdGF0aWNfY29uZmlnczoKICAtIGxhYmVsczoKICAgICAgbmFtZXNwYWNlOiB0ZWFtLWFkbWluCiAgICB0YXJnZXRzOgogICAgLSBodHRwczovL2hlbGxvLnRlYW0tYWRtaW4uZGV2Lmxpbm9kZS1hcGwubmV0LwogICAgLSBodHRwczovL21pc2MtYWRtaW4uZGV2Lmxpbm9kZS1hcGwubmV0LwotIGpvYl9uYW1lOiBwcm9iZS1zZXJ2aWNlcy1kZW1vCiAgbWV0cmljc19wYXRoOiAvcHJvYmUKICBwYXJhbXM6CiAgICBtb2R1bGU6CiAgICAtIGh0dHBfMnh4CiAgcmVsYWJlbF9jb25maWdzOgogIC0gc291cmNlX2xhYmVsczoKICAgIC0gX19hZGRyZXNzX18KICAgIHRhcmdldF9sYWJlbDogX19wYXJhbV90YXJnZXQKICAtIHNvdXJjZV9sYWJlbHM6CiAgICAtIF9fcGFyYW1fdGFyZ2V0CiAgICB0YXJnZXRfbGFiZWw6IGluc3RhbmNlCiAgLSByZXBsYWNlbWVudDogcHJvbWV0aGV1cy1ibGFja2JveC1leHBvcnRlci5tb25pdG9yaW5nOjkxMTUKICAgIHRhcmdldF9sYWJlbDogX19hZGRyZXNzX18KICBzY3JhcGVfaW50ZXJ2YWw6IDFtCiAgc3RhdGljX2NvbmZpZ3M6CiAgLSBsYWJlbHM6CiAgICAgIG5hbWVzcGFjZTogdGVhbS1kZW1vCiAgICB0YXJnZXRzOgogICAgLSBodHRwczovL2hhcy1jZXJ0LXN2Yy1kZW1vLmRldi5saW5vZGUtYXBsLm5ldC9qZWhvCiAgICAtIGh0dHBzOi8vaGVsbG8tZGVtby5kZXYubGlub2RlLWFwbC5uZXQvCiAgICAtIGh0dHBzOi8vdGxzcGFzcy5kZXYubGlub2RlLWFwbC5uZXQvCiAgICAtIGh0dHBzOi8vaGVsbG8tYmx1ZS1ncmVlbi1kZW1vLmRldi5saW5vZGUtYXBsLm5ldC8KICAgIC0gaHR0cHM6Ly9zZXJ2aWNlLWEtZGVtby5kZXYubGlub2RlLWFwbC5uZXQvCiAgICAtIGh0dHBzOi8vc2VydmljZS1lLWRlbW8uZGV2Lmxpbm9kZS1hcGwubmV0LwotIGpvYl9uYW1lOiBwcm9iZS1zZXJ2aWNlcy1kZXYKICBtZXRyaWNzX3BhdGg6IC9wcm9iZQogIHBhcmFtczoKICAgIG1vZHVsZToKICAgIC0gaHR0cF8yeHgKICByZWxhYmVsX2NvbmZpZ3M6CiAgLSBzb3VyY2VfbGFiZWxzOgogICAgLSBfX2FkZHJlc3NfXwogICAgdGFyZ2V0X2xhYmVsOiBfX3BhcmFtX3RhcmdldAogIC0gc291cmNlX2xhYmVsczoKICAgIC0gX19wYXJhbV90YXJnZXQKICAgIHRhcmdldF9sYWJlbDogaW5zdGFuY2UKICAtIHJlcGxhY2VtZW50OiBwcm9tZXRoZXVzLWJsYWNrYm94LWV4cG9ydGVyLm1vbml0b3Jpbmc6OTExNQogICAgdGFyZ2V0X2xhYmVsOiBfX2FkZHJlc3NfXwogIHNjcmFwZV9pbnRlcnZhbDogMW0KICBzdGF0aWNfY29uZmlnczoKICAtIGxhYmVsczoKICAgICAgbmFtZXNwYWNlOiB0ZWFtLWRldgogICAgdGFyZ2V0czogbnVsbA==

# rabbitmq-cluster-operator/templates/messaging-topology-operator/validating-webhook-configuration.yaml

# team-ns/templates/routes.yaml

@@ (root level) @@
# gateway.networking.k8s.io/v1/HTTPRoute/misc/misc
! + one document added:
+ ---
+ # Source: team-ns/templates/routes.yaml
+ apiVersion: gateway.networking.k8s.io/v1
+ kind: HTTPRoute
+ metadata:
+   name: misc
+   namespace: misc
+   annotations:
+     external-dns.alpha.kubernetes.io/hostname: "*.dev.linode-apl.net"
+     externaldns: "true"
+   labels:
+     otomi.io/app: misc
+ spec:
+   hostnames:
+   - misc-admin.dev.linode-apl.net
+   - misc-admin.cname.com
+   parentRefs:
+   - name: platform-workloads
+     kind: XListenerSet
+     group: gateway.networking.x-k8s.io
+   - name: platform
+     namespace: istio-system
+     kind: Gateway
+     group: gateway.networking.k8s.io
+   rules:
+   - backendRefs:
+     - name: misc
+       port: 80
+     matches:
+     - path:
+         type: PathPrefix
+         value: /

@@ (root level) @@
# gateway.networking.k8s.io/v1/HTTPRoute/platform-http-https-redirect
! + one document added:
+ ---
+ # Source: team-ns/templates/routes.yaml
+ apiVersion: gateway.networking.k8s.io/v1
+ kind: HTTPRoute
+ metadata:
+   name: platform-http-https-redirect
+ spec:
+   hostnames:
+   - misc-admin.cname.com
+   parentRefs:
+   - name: platform-workloads
+     group: gateway.networking.x-k8s.io
+     kind: XListenerSet
+     sectionName: http-cname-misc
+   rules:
+   - filters:
+     - type: RequestRedirect
+       requestRedirect:
+         scheme: https
+         statusCode: 301
+     matches:
+     - path:
+         type: PathPrefix
+         value: /

@@ (root level) @@
# networking.istio.io/v1/ServiceEntry/misc/misc-internal
! + one document added:
+ ---
+ # Source: team-ns/templates/routes.yaml
+ apiVersion: networking.istio.io/v1
+ kind: ServiceEntry
+ metadata:
+   name: misc-internal
+   namespace: misc
+ spec:
+   hosts:
+   - misc-admin.dev.linode-apl.net
+   - misc-admin.cname.com
+   location: MESH_INTERNAL
+   ports:
+   - name: http
+     number: 80
+     protocol: HTTP
+   - name: https
+     number: 443
+     protocol: TLS
+   resolution: DNS

@@ (root level) @@
# gateway.networking.x-k8s.io/v1alpha1/XListenerSet/platform-workloads
! + one document added:
+ ---
+ # Source: team-ns/templates/routes.yaml
+ apiVersion: gateway.networking.x-k8s.io/v1alpha1
+ kind: XListenerSet
+ metadata:
+   name: platform-workloads
+ spec:
+   parentRef:
+     name: platform
+     namespace: istio-system
+     kind: Gateway
+     group: gateway.networking.k8s.io
+   listeners:
+   - name: http-cname-misc
+     hostname: misc-admin.cname.com
+     protocol: HTTP
+     port: 80
+     allowedRoutes:
+       namespaces:
+         from: Same
+   - name: https-cname-misc
+     hostname: misc-admin.cname.com
+     protocol: HTTPS
+     port: 443
+     tls:
+       certificateRefs:
+       - name: hello-cert
+     allowedRoutes:
+       namespaces:
+         from: All

# values-repo.yaml

@@ teamConfig.demo.services.hello @@
! + one map entry added:
+ namespace: should-be-ignored

@@ teamConfig.admin.services @@
! + one list entry added:
+ - name: misc
+   port: 80
+   namespace: misc
+   useCname: true
+   cname:
+     domain: misc-admin.cname.com
+     tlsSecretName: hello-cert