GEP-1762 enforces resources to be created in the Gateway namespace

[arkodg]

What happened:

The Automated Deployments section with GEP-1762 mentions the following

MUST provision generated resources in the same namespace as the Gateway if they are namespace scoped resources.

What you expected to happen:

My suggestion is to modify the MUST to SHOULD . Some implementations such as Envoy Gateway dont have write access into user namespaces and can write into an infrastructure namespace

How to reproduce it (as minimally and precisely as possible):

Anything else we need to know?:

[arkodg]

discussed this issue in the community meeting today, here's a summary

• Debugging is convenient if generated resources live in the same namespace, however this doesnt need to be enforced, since some implementations may not have privileges to write into other namespaces, so moving the statement to SHOULD should be okay.
• To fix the discoverability issue of finding the generated resources if they exist in a different namespace, can be solved by adding an additional label like gateway.networking.k8s.io/gateway-namespace
• The above GEP statements havent yet made their way into the API docs but the GatewayInfrastructure conformance test tests this out, so this test can be marked as Provisional until the GEP and API docs reflect the updated changes
  cc @youngnick @robscott

[rouke-broersma]

Some implementations such as Envoy Gateway dont have write access into user namespaces and can write into an infrastructure namespace

I'm curious what in this model a user and an infrastructure namespace entails. In my mind with the design goal of gateway api and it's personas a gateway resource would never live in a 'user' namespace, this would always live in some kind of infrastructure namespace (depending on definitions of these types of namespaces).

[arkodg]

Some implementations such as Envoy Gateway dont have write access into user namespaces and can write into an infrastructure namespace

I'm curious what in this model a user and an infrastructure namespace entails. In my mind with the design goal of gateway api and it's personas a gateway resource would never live in a 'user' namespace, this would always live in some kind of infrastructure namespace (depending on definitions of these types of namespaces).

@rouke-broersma, the user here is the platform engineer/admin. The point this GH issue is trying to make is that both the deployment models are valid, some implementations support both these models, but will default to 1. or 2.

1. deploying generated resources in a separate infrastructure namespace to limit write access to the controller/implementation, troubleshooting can still be achieved by analyzing Gateway.Status
2. deploying generated resources in the Gateway namespace for more control of the generated resource

so the MUST enforcement should be relaxed to a SHOULD