review: NamespaceFromPodEnv helper, APIServiceName const, ateclient hardcodes

Three follow-ups from the self-review:

- Extract the POD_NAMESPACE-with-SystemNamespace-fallback pattern into
  installdefaults.NamespaceFromPodEnv() so ateapi and atenet share a
  single implementation (also makes a third call site one line instead
  of four if anyone needs one).
- Add installdefaults.PodNamespaceEnv ("POD_NAMESPACE") and APIServiceName
  ("api") so the constant set covers every name in the canonical install
  layout that's referenced by Go code.
- Route internal/ateclient/builder.go's previously-hardcoded "ate-system"
  and "api" lookups through installdefaults, so kubectl-ate's port-forward
  no longer bypasses the new single source of truth.

ate-controller (ServiceAccount), ate-api-server-deployment (Deployment),
and "api.ate-system.svc" (JWT audience) are still hardcoded but their
configurability needs a real flag/discovery story and is out of scope
for this PR.

Author: jjamroga

cmd/ateapi/main.go

@@ -136,13 +136,9 @@ func main() {
 	workerPoolLister := ateFactory.Api().V1alpha1().WorkerPools().Lister()
 	sandboxConfigLister := ateFactory.Api().V1alpha1().SandboxConfigs().Lister()
 
-	// atelet shares ateapi's namespace in every supported deployment topology.
-	// POD_NAMESPACE comes from Kubernetes' downward API; the install fallback
-	// keeps non-k8s invocations (tests, local dev) working.
-	ateletNamespace := os.Getenv("POD_NAMESPACE")
-	if ateletNamespace == "" {
-		ateletNamespace = installdefaults.SystemNamespace
-	}
+	// atelet shares ateapi's namespace in every supported deployment topology,
+	// so we read it from Kubernetes' downward API rather than expose a flag.
+	ateletNamespace := installdefaults.NamespaceFromPodEnv()
 	slog.InfoContext(ctx, "Resolved atelet namespace", slog.String("atelet-namespace", ateletNamespace))
 
 	workerPodInformerFactory, workerPodInformer := controlapi.WorkerPodInformer(clientset)

cmd/atenet/internal/dns.go

@@ -89,14 +89,10 @@ func NewDnsCmd() *cobra.Command {
 				return fmt.Errorf("failed to initialize cluster client: %w", err)
 			}
 
-			// atenet shares the system namespace with atenet-router and
-			// substrate's CoreDNS in every supported deployment topology.
-			// POD_NAMESPACE comes from Kubernetes' downward API; the install
-			// fallback keeps non-k8s invocations (tests, local dev) working.
-			systemNamespace := os.Getenv("POD_NAMESPACE")
-			if systemNamespace == "" {
-				systemNamespace = installdefaults.SystemNamespace
-			}
+			// atenet shares its namespace with atenet-router and substrate's
+			// CoreDNS in every supported deployment topology, so we read it
+			// from Kubernetes' downward API rather than expose a flag.
+			systemNamespace := installdefaults.NamespaceFromPodEnv()
 			slog.InfoContext(ctx, "Resolved system namespace", slog.String("system-namespace", systemNamespace))
 
 			dnsController := &dns.Controller{

internal/ateclient/builder.go

@@ -24,6 +24,7 @@ import (
 	"strings"
 	"sync"
 
+	"github.com/agent-substrate/substrate/internal/installdefaults"
 	"github.com/agent-substrate/substrate/pkg/proto/ateapipb"
 	"go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc"
 	"go.opentelemetry.io/otel"
@@ -132,22 +133,22 @@ func dialPortForward(ctx context.Context, kubeconfigPath, k8sContext string, tra
 		return nil, fmt.Errorf("failed to create k8s client: %w", err)
 	}
 
-	// Look up the 'api' Service to dynamically get its pod selector
-	svc, err := clientset.CoreV1().Services("ate-system").Get(ctx, "api", metav1.GetOptions{})
+	// Look up the ateapi Service to dynamically get its pod selector.
+	svc, err := clientset.CoreV1().Services(installdefaults.SystemNamespace).Get(ctx, installdefaults.APIServiceName, metav1.GetOptions{})
 	if err != nil {
-		return nil, fmt.Errorf("failed to get api service: %w", err)
+		return nil, fmt.Errorf("failed to get ateapi service %s/%s: %w", installdefaults.SystemNamespace, installdefaults.APIServiceName, err)
 	}
 	selector := labels.SelectorFromSet(svc.Spec.Selector).String()
 
 	// Find the pods backing the service
-	pods, err := clientset.CoreV1().Pods("ate-system").List(ctx, metav1.ListOptions{
+	pods, err := clientset.CoreV1().Pods(installdefaults.SystemNamespace).List(ctx, metav1.ListOptions{
 		LabelSelector: selector,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("failed to list ateapi pods: %w", err)
 	}
 	if len(pods.Items) == 0 {
-		return nil, fmt.Errorf("no ate-api-server pods found in ate-system namespace")
+		return nil, fmt.Errorf("no ate-api-server pods found in %q namespace", installdefaults.SystemNamespace)
 	}
 	targetPod := pods.Items[0]
 
@@ -254,7 +255,7 @@ func jwtDialOptions(ctx context.Context, clientset *kubernetes.Clientset) ([]grp
 			ExpirationSeconds: &expirationSeconds,
 		},
 	}
-	token, err := clientset.CoreV1().ServiceAccounts("ate-system").CreateToken(ctx, "ate-client", tokenRequest, metav1.CreateOptions{})
+	token, err := clientset.CoreV1().ServiceAccounts(installdefaults.SystemNamespace).CreateToken(ctx, "ate-client", tokenRequest, metav1.CreateOptions{})
 	if err != nil {
 		return nil, fmt.Errorf("failed to request ateapi bearer token: %w", err)
 	}
@@ -267,7 +268,7 @@ func jwtDialOptions(ctx context.Context, clientset *kubernetes.Clientset) ([]grp
 func isJWTMode(ctx context.Context, clientset *kubernetes.Clientset) (bool, error) {
 	// TODO: Replace deployment introspection with an explicit client-readable
 	// config file once ateapi auth mode is part of install/runtime config.
-	deployment, err := clientset.AppsV1().Deployments("ate-system").Get(ctx, "ate-api-server-deployment", metav1.GetOptions{})
+	deployment, err := clientset.AppsV1().Deployments(installdefaults.SystemNamespace).Get(ctx, "ate-api-server-deployment", metav1.GetOptions{})
 	if err != nil {
 		return false, fmt.Errorf("failed to get ate-api-server deployment: %w", err)
 	}

internal/installdefaults/installdefaults.go

@@ -18,12 +18,30 @@
 // the canonical layout pass actual values via the corresponding flags.
 package installdefaults
 
+import "os"
+
 const (
 	// SystemNamespace is the namespace where substrate's control-plane
 	// components and the atelet DaemonSet run.
 	SystemNamespace = "ate-system"
+	// APIServiceName is the Service name of ate-api-server.
+	APIServiceName = "api"
 	// RouterServiceName is the Service name of atenet-router.
 	RouterServiceName = "atenet-router"
 	// DNSServiceName is the Service name of substrate's CoreDNS.
 	DNSServiceName = "dns"
+
+	// PodNamespaceEnv is the conventional env var name for the namespace
+	// a pod is running in, exposed via Kubernetes' downward API.
+	PodNamespaceEnv = "POD_NAMESPACE"
 )
+
+// NamespaceFromPodEnv returns the namespace from the PodNamespaceEnv env
+// var when set (typically populated via Kubernetes' downward API), and
+// falls back to SystemNamespace for non-k8s invocations (tests, local dev).
+func NamespaceFromPodEnv() string {
+	if ns := os.Getenv(PodNamespaceEnv); ns != "" {
+		return ns
+	}
+	return SystemNamespace
+}