Make resource names (like service + namespace) configurable

[jjamroga]

Summary

Makes substrate's component Service names operator-overrideable via flags and wires Kubernetes' downward API through the Helm chart so atenet, ateapi, and atelet pick up their pod's namespace automatically. The canonical chart render and manifests/ate-install/ remain byte-identical at the default release name and namespace.

Motivated by deploying substrate as a Helm subchart of kagent (OSS), where the parent release prefixes substrate resource names with its release name and runs everything in the parent's namespace. With hardcoded values in the substrate code, the components silently fail to find each other after install:

• dns-controller can't locate atenet-router or substrate's CoreDNS Service (forbidden / not found in ate-system).
• ate-controller dials dns:///api.ate-system.svc:443 and gets NXDOMAIN — the chart never passed --ateapi-conn-spec either.
• ate-api-server's atelet pod informer watches a hardcoded ate-system namespace and finds no atelet pods.

What changed

New package internal/installdefaults

Single source of truth for the canonical install names:

• SystemNamespace = "ate-system"
• APIServiceName = "api"
• RouterServiceName = "atenet-router"
• DNSServiceName = "dns"
• PodNamespaceEnv = "POD_NAMESPACE"
• NamespaceFromPodEnv() helper for env-var-with-fallback resolution.

dns/, router/, and controlapi/ no longer duplicate the same string literals.

Binary changes

• atenet dns:
  • --router-service-name (default installdefaults.RouterServiceName)
  • --dns-service-name (default installdefaults.DNSServiceName)
  • Namespace derived from POD_NAMESPACE env (downward API), no flag.
• atenet router:
  • --router-service-name (default installdefaults.RouterServiceName) — used by /statusz.
• ateapi:
  • AteletInformer takes the namespace as a parameter; main.go resolves it from POD_NAMESPACE.
• internal/ateclient/builder.go:
  • kubectl-ate's port-forward helper now references installdefaults.SystemNamespace / APIServiceName instead of literal "ate-system" / "api".

Tests in cmd/atenet/internal/dns and cmd/ateapi/internal/controlapi updated to set the new fields explicitly.

Chart templates

• charts/substrate/templates/atenet-dns.yaml — passes --router-service-name, --dns-service-name resolved via substrate.fullname; injects POD_NAMESPACE via downward API.
• charts/substrate/templates/atenet-router.yaml — passes --router-service-name.
• charts/substrate/templates/ate-controller.yaml — also adds --ateapi-conn-spec (the binary already accepts it; the chart had only been passing --ateapi-server-name, which is just SNI, not the dial target).
• charts/substrate/templates/ate-api-server.yaml — injects POD_NAMESPACE via downward API.

At the canonical render (release name substrate, namespace ate-system) every flag resolves to the same value the code previously hardcoded, so existing top-level installs are byte-identical before and after.

Manifests catch-up

The chart regen commit also picks up unrelated chart drift that had accumulated but never been reconciled (s3-backed atelet storage, rustfs, trimmed valkey, etc.). A follow-up commit restores sandboxconfig-gvisor.yaml and sandboxconfig-validation.yaml — those aren't chart-rendered but are hand-maintained and depended on by the SandboxConfig ValidatingAdmissionPolicy test and the e2e installer.

Related

A separate issue tracks the next templating gap surfaced during testing — dns-controller only patches the GKE-style kube-dns ConfigMap and silently no-ops on kubeadm/kind clusters that use kube-system/coredns: agent-substrate#348. Out of scope for this PR.

Validation

End-to-end on a local kind cluster consuming substrate as a Helm subchart of a parent release:

• ✅ dns-controller can locate atenet-router and substrate's dns Services in the release namespace (was: services "atenet-router" is forbidden ... in namespace "ate-system")
• ✅ ate-controller dials ate-api-server (was: NXDOMAIN on api.ate-system.svc:443)
• ✅ ate-api-server finds atelet in the release namespace (was: found 0 atelet pods on node)
• ✅ CreateActor → ResumeActor → AssignWorker succeeds
• ✅ atelet receives SandboxAssets, downloads runsc, gVisor sandbox starts, actor reaches STATUS_RUNNING

(Past that point, gVisor's runsc checkpoint fails on Apple Silicon kind due to a separate linuxkit-kernel limitation; unrelated to this PR.)

Compatibility

Backward compatible. Every new flag has a default matching the previously hardcoded value. The chart's existing one-shot install path (helm install substrate ... -n ate-system) renders identically before and after.

Test plan

• go build ./...
• go vet ./...
• go test ./cmd/atenet/internal/... ./cmd/ateapi/internal/... ./internal/installdefaults/... (all pass)
• helm lint charts/substrate clean
• End-to-end demo (SandboxAgent on substrate) reconciles past the originally-failing dial steps when substrate is installed as a subchart

[iplay88keys]

Have you run the manifest generation? I ran make verify-helm-template and it looks like the manifests/ate-install folder is out-of-date.