review: centralize install defaults, derive atelet namespace from POD_NAMESPACE

Addresses review comments on agent-substrate#350:

- New internal/installdefaults package owns SystemNamespace,
  RouterServiceName, DNSServiceName. dns, router, and controlapi/informer
  drop their duplicate Default* constants and reference installdefaults
  via the matching flag declarations and tests.

- Drop the --atelet-namespace flag on ateapi. The namespace is now
  resolved at startup from the POD_NAMESPACE env var (Kubernetes' downward
  API), falling back to installdefaults.SystemNamespace for non-k8s
  invocations (tests, local dev). atelet and ateapi share a namespace in
  every supported deployment topology, so a separate knob was dead weight.

Author: jjamroga

charts/substrate/templates/ate-api-server.yaml

@@ -110,10 +110,6 @@ spec:
         - "--session-id-ca-pool=/run/session-id-ca-pool/pool.json"
         - "--client-jwt-ca-cert=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
 {{- end }}
-        # Pass the chart-resolved namespace so the atelet pod informer
-        # watches the correct namespace when substrate is installed as a
-        # subchart (the binary default is "ate-system").
-        - "--atelet-namespace={{ .Release.Namespace }}"
         env:
         - name: POD_NAME
           valueFrom:

cmd/ateapi/internal/controlapi/functional_test.go

@@ -29,6 +29,7 @@ import (
 	"github.com/agent-substrate/substrate/cmd/ateapi/internal/workercache"
 	"github.com/agent-substrate/substrate/internal/ateinterceptors"
 	"github.com/agent-substrate/substrate/internal/envtestbins"
+	"github.com/agent-substrate/substrate/internal/installdefaults"
 	"github.com/agent-substrate/substrate/internal/proto/ateletpb"
 	atev1alpha1 "github.com/agent-substrate/substrate/pkg/api/v1alpha1"
 	"github.com/agent-substrate/substrate/pkg/client/clientset/versioned"
@@ -270,7 +271,7 @@ func setupTest(t *testing.T, ns string) *testContext {
 
 	// 3. Initialize Informers
 	workerFactory, workerInformer := WorkerPodInformer(k8sClient)
-	ateletFactory, ateletInformer := AteletInformer(k8sClient, DefaultAteletNamespace)
+	ateletFactory, ateletInformer := AteletInformer(k8sClient, installdefaults.SystemNamespace)
 
 	substrateInformerFactory := externalversions.NewSharedInformerFactory(substrateClient, 0)
 	actorTemplateLister := substrateInformerFactory.Api().V1alpha1().ActorTemplates().Lister()

cmd/ateapi/internal/controlapi/informer.go

@@ -25,15 +25,10 @@ import (
 )
 
 const (
-	// DefaultAteletNamespace matches the atelet DaemonSet's namespace in
-	// the canonical install manifests under manifests/ate-install/.
-	// Deployments that run atelet elsewhere must override this via the
-	// --atelet-namespace flag on ateapi.
-	DefaultAteletNamespace = "ate-system"
-	byNamespaceAndName     = "by-namespace-and-name"
-	byWorkerPool           = "by-worker-pool"
-	byNode                 = "by-node"
-	workerPodLabel         = "ate.dev/worker-pool"
+	byNamespaceAndName = "by-namespace-and-name"
+	byWorkerPool       = "by-worker-pool"
+	byNode             = "by-node"
+	workerPodLabel     = "ate.dev/worker-pool"
 )
 
 // AteletInformer creates a SharedInformerFactory and SharedIndexInformer for

cmd/ateapi/main.go

@@ -33,6 +33,7 @@ import (
 	"github.com/agent-substrate/substrate/cmd/ateapi/internal/workercache"
 	"github.com/agent-substrate/substrate/internal/ateapiauth"
 	"github.com/agent-substrate/substrate/internal/ateinterceptors"
+	"github.com/agent-substrate/substrate/internal/installdefaults"
 	"github.com/agent-substrate/substrate/internal/serverboot"
 	"github.com/agent-substrate/substrate/internal/version"
 	"github.com/agent-substrate/substrate/pkg/client/clientset/versioned"
@@ -72,8 +73,6 @@ var (
 	showVersion     = pflag.Bool("version", false, "Print version and exit.")
 	authMode        = pflag.String("auth-mode", "mtls", "Auth mode for incoming gRPC: mtls|jwt. 'mtls' (default) relies on transport-level mTLS for client identity. 'jwt' additionally requires a Kubernetes ServiceAccount Bearer token on every RPC.")
 	clientJWTCAFile = pflag.String("client-jwt-ca-cert", "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt", "CA cert file used to verify TLS when fetching the OIDC discovery document and JWKS for JWT authentication. Defaults to the in-cluster service account CA.")
-
-	ateletNamespace = pflag.String("atelet-namespace", controlapi.DefaultAteletNamespace, "Namespace where atelet pods run. Override when the deployment runs atelet in a namespace other than the default.")
 )
 
 func main() {
@@ -135,8 +134,17 @@ func main() {
 	workerPoolLister := ateFactory.Api().V1alpha1().WorkerPools().Lister()
 	sandboxConfigLister := ateFactory.Api().V1alpha1().SandboxConfigs().Lister()
 
+	// atelet shares ateapi's namespace in every supported deployment topology.
+	// POD_NAMESPACE comes from Kubernetes' downward API; the install fallback
+	// keeps non-k8s invocations (tests, local dev) working.
+	ateletNamespace := os.Getenv("POD_NAMESPACE")
+	if ateletNamespace == "" {
+		ateletNamespace = installdefaults.SystemNamespace
+	}
+	slog.InfoContext(ctx, "Resolved atelet namespace", slog.String("atelet-namespace", ateletNamespace))
+
 	workerPodInformerFactory, workerPodInformer := controlapi.WorkerPodInformer(clientset)
-	ateletPodInformerFactory, ateletPodInformer := controlapi.AteletInformer(clientset, *ateletNamespace)
+	ateletPodInformerFactory, ateletPodInformer := controlapi.AteletInformer(clientset, ateletNamespace)
 
 	syncer := controlapi.NewWorkerPoolSyncer(redisPersistence, workerPodInformer)
 	syncer.Start(ctx)

cmd/atenet/internal/dns.go

@@ -30,6 +30,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client/config"
 
 	"github.com/agent-substrate/substrate/cmd/atenet/internal/dns"
+	"github.com/agent-substrate/substrate/internal/installdefaults"
 )
 
 type DnsConfig struct {
@@ -108,9 +109,9 @@ func NewDnsCmd() *cobra.Command {
 	cmd.Flags().StringVar(&cfg.Kubeconfig, "kubeconfig", "", "Absolute path to the kubeconfig configuration file")
 	cmd.Flags().DurationVar(&cfg.ReconcileInterval, "interval", 10*time.Second, "Interval for reconciling DNS configurations")
 	cmd.Flags().StringVar(&cfg.CorefilePath, "corefile-path", "/etc/coredns/Corefile", "Path to the local Corefile configuration on shared volume")
-	cmd.Flags().StringVar(&cfg.SystemNamespace, "system-namespace", dns.DefaultSystemNamespace, "Namespace where atenet-router and substrate's CoreDNS Service live. Override when the deployment uses a different namespace.")
-	cmd.Flags().StringVar(&cfg.RouterServiceName, "router-service-name", dns.DefaultRouterServiceName, "Service name of the atenet-router. Override when the deployment renames the Service.")
-	cmd.Flags().StringVar(&cfg.DNSServiceName, "dns-service-name", dns.DefaultDNSServiceName, "Service name of substrate's CoreDNS. Override when the deployment renames the Service.")
+	cmd.Flags().StringVar(&cfg.SystemNamespace, "system-namespace", installdefaults.SystemNamespace, "Namespace where atenet-router and substrate's CoreDNS Service live. Override when the deployment uses a different namespace.")
+	cmd.Flags().StringVar(&cfg.RouterServiceName, "router-service-name", installdefaults.RouterServiceName, "Service name of the atenet-router. Override when the deployment renames the Service.")
+	cmd.Flags().StringVar(&cfg.DNSServiceName, "dns-service-name", installdefaults.DNSServiceName, "Service name of substrate's CoreDNS. Override when the deployment renames the Service.")
 
 	return cmd
 }

cmd/atenet/internal/dns/dns.go

@@ -33,17 +33,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
-// Default resource names match the canonical install manifests in
-// manifests/ate-install/ (atenet-router and dns Services in the
-// ate-system namespace). Deployments that use a different namespace or
-// rename these Services must pass the actual values via the matching
-// flags on the dns command.
-const (
-	DefaultSystemNamespace   = "ate-system"
-	DefaultRouterServiceName = "atenet-router"
-	DefaultDNSServiceName    = "dns"
-)
-
 // Controller manages the DNS configuration for the ATE.
 type Controller struct {
 	Client       client.Client
@@ -52,14 +41,14 @@ type Controller struct {
 	Reloader     ConfigReloader
 
 	// SystemNamespace is the namespace where atenet-router and the substrate
-	// CoreDNS Service live. Defaults to DefaultSystemNamespace.
+	// CoreDNS Service live. Defaults to installdefaults.SystemNamespace.
 	SystemNamespace string
 	// RouterServiceName is the Service name of the atenet-router that the
 	// CoreDNS Corefile forwards actor traffic to. Defaults to
-	// DefaultRouterServiceName.
+	// installdefaults.RouterServiceName.
 	RouterServiceName string
 	// DNSServiceName is the Service name of substrate's CoreDNS. Defaults to
-	// DefaultDNSServiceName.
+	// installdefaults.DNSServiceName.
 	DNSServiceName string
 }
 

cmd/atenet/internal/dns/dns_test.go

@@ -28,6 +28,8 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	"github.com/agent-substrate/substrate/internal/installdefaults"
 )
 
 type mockConfigReloader struct {
@@ -98,9 +100,9 @@ func TestReconcile(t *testing.T) {
 		Interval:          1 * time.Second,
 		CorefilePath:      corefilePath,
 		Reloader:          reloader,
-		SystemNamespace:   DefaultSystemNamespace,
-		RouterServiceName: DefaultRouterServiceName,
-		DNSServiceName:    DefaultDNSServiceName,
+		SystemNamespace:   installdefaults.SystemNamespace,
+		RouterServiceName: installdefaults.RouterServiceName,
+		DNSServiceName:    installdefaults.DNSServiceName,
 	}
 
 	// Run one reconciliation loop
@@ -192,9 +194,9 @@ func TestReconcileKubeDNSNotFound(t *testing.T) {
 		Interval:          1 * time.Second,
 		CorefilePath:      corefilePath,
 		Reloader:          &mockConfigReloader{},
-		SystemNamespace:   DefaultSystemNamespace,
-		RouterServiceName: DefaultRouterServiceName,
-		DNSServiceName:    DefaultDNSServiceName,
+		SystemNamespace:   installdefaults.SystemNamespace,
+		RouterServiceName: installdefaults.RouterServiceName,
+		DNSServiceName:    installdefaults.DNSServiceName,
 	}
 
 	ctx := context.Background()

cmd/atenet/internal/router.go

@@ -21,6 +21,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/agent-substrate/substrate/cmd/atenet/internal/router"
+	"github.com/agent-substrate/substrate/internal/installdefaults"
 )
 
 func NewRouterCmd() *cobra.Command {
@@ -44,7 +45,7 @@ func NewRouterCmd() *cobra.Command {
 	cmd.Flags().StringVar(&cfg.MetricsAddr, "metrics-listen-addr", ":9090", "Address and port the prometheus metrics server should listen on.")
 	cmd.Flags().BoolVar(&cfg.Standalone, "standalone", false, "Run in standalone mode, bypassing creation of managed deployment and services in Kubernetes cluster")
 	cmd.Flags().StringVar(&cfg.Namespace, "namespace", "default", "Target operations namespace")
-	cmd.Flags().StringVar(&cfg.RouterServiceName, "router-service-name", router.DefaultRouterServiceName, "Service name of this atenet-router in the operations namespace. Override when the deployment renames the Service.")
+	cmd.Flags().StringVar(&cfg.RouterServiceName, "router-service-name", installdefaults.RouterServiceName, "Service name of this atenet-router in the operations namespace. Override when the deployment renames the Service.")
 	cmd.Flags().StringVar(&cfg.Kubeconfig, "kubeconfig", "", "Absolute path to the kubeconfig configuration file")
 	cmd.Flags().StringVar(&cfg.AteapiAddr, "ateapi-address", "api.ate-system.svc:443", "gRPC host address of the cluster ateapi Control instance")
 	cmd.Flags().IntVar(&cfg.HttpPort, "port-http", 8080, "TCP port for workload traffic entering through the Envoy Router")

cmd/atenet/internal/router/router.go

@@ -62,19 +62,13 @@ func init() {
 	utilruntime.Must(v1alpha1.AddToScheme(scheme))
 }
 
-// DefaultRouterServiceName matches the atenet-router Service name in the
-// canonical install manifests under manifests/ate-install/. Deployments
-// that rename the Service must pass the actual name via
-// --router-service-name.
-const DefaultRouterServiceName = "atenet-router"
-
 // RouterConfig holds deployment setup and endpoint options for the router node instance.
 type RouterConfig struct {
 	Standalone bool
 	Namespace  string
 	// RouterServiceName is the Service name of this atenet-router in the
 	// operations namespace, used by /statusz to look up its own ClusterIP.
-	// Defaults to DefaultRouterServiceName.
+	// Defaults to installdefaults.RouterServiceName.
 	RouterServiceName string
 	Kubeconfig        string
 	AteapiAddr        string

internal/installdefaults/installdefaults.go

@@ -0,0 +1,29 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package installdefaults holds the default namespace and Service names
+// that match the canonical install layout in manifests/ate-install/.
+// Binaries use these as flag defaults; deployments that diverge from
+// the canonical layout pass actual values via the corresponding flags.
+package installdefaults
+
+const (
+	// SystemNamespace is the namespace where substrate's control-plane
+	// components and the atelet DaemonSet run.
+	SystemNamespace = "ate-system"
+	// RouterServiceName is the Service name of atenet-router.
+	RouterServiceName = "atenet-router"
+	// DNSServiceName is the Service name of substrate's CoreDNS.
+	DNSServiceName = "dns"
+)