review: centralize install defaults, derive atelet namespace from POD_NAMESPACE

Addresses review comments on agent-substrate#350:

- New internal/installdefaults package owns SystemNamespace,
  RouterServiceName, DNSServiceName. dns, router, and controlapi/informer
  drop their duplicate Default* constants and reference installdefaults
  via the matching flag declarations and tests.

- Drop the --atelet-namespace flag on ateapi. The namespace is now
  resolved at startup from the POD_NAMESPACE env var (Kubernetes' downward
  API), falling back to installdefaults.SystemNamespace for non-k8s
  invocations (tests, local dev). atelet and ateapi share a namespace in
  every supported deployment topology, so a separate knob was dead weight.

Author: jjamroga

charts/substrate/templates/ate-api-server.yaml

@@ -110,10 +110,6 @@ spec:
         - "--session-id-ca-pool=/run/session-id-ca-pool/pool.json"
         - "--client-jwt-ca-cert=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
 {{- end }}
-        # Pass the chart-resolved namespace so the atelet pod informer
-        # watches the correct namespace when substrate is installed as a
-        # subchart (the binary default is "ate-system").
-        - "--atelet-namespace={{ .Release.Namespace }}"
         env:
         - name: POD_NAME
           valueFrom:

cmd/ateapi/internal/controlapi/functional_test.go

@@ -29,6 +29,7 @@ import (
 	"github.com/agent-substrate/substrate/cmd/ateapi/internal/workercache"
 	"github.com/agent-substrate/substrate/internal/ateinterceptors"
 	"github.com/agent-substrate/substrate/internal/envtestbins"
+	"github.com/agent-substrate/substrate/internal/installdefaults"
 	"github.com/agent-substrate/substrate/internal/proto/ateletpb"
 	atev1alpha1 "github.com/agent-substrate/substrate/pkg/api/v1alpha1"
 	"github.com/agent-substrate/substrate/pkg/client/clientset/versioned"
@@ -273,7 +274,7 @@ func setupTest(t *testing.T, ns string) *testContext {
 
 	// 3. Initialize Informers
 	workerFactory, workerInformer := WorkerPodInformer(k8sClient)
-	ateletFactory, ateletInformer := AteletInformer(k8sClient, DefaultAteletNamespace)
+	ateletFactory, ateletInformer := AteletInformer(k8sClient, installdefaults.SystemNamespace)
 
 	substrateInformerFactory := externalversions.NewSharedInformerFactory(substrateClient, 0)
 	actorTemplateLister := substrateInformerFactory.Api().V1alpha1().ActorTemplates().Lister()

cmd/ateapi/internal/controlapi/informer.go

@@ -25,15 +25,10 @@ import (
 )
 
 const (
-	// DefaultAteletNamespace matches the atelet DaemonSet's namespace in
-	// the canonical install manifests under manifests/ate-install/.
-	// Deployments that run atelet elsewhere must override this via the
-	// --atelet-namespace flag on ateapi.
-	DefaultAteletNamespace = "ate-system"
-	byNamespaceAndName     = "by-namespace-and-name"
-	byWorkerPool           = "by-worker-pool"
-	byNode                 = "by-node"
-	workerPodLabel         = "ate.dev/worker-pool"
+	byNamespaceAndName = "by-namespace-and-name"
+	byWorkerPool       = "by-worker-pool"
+	byNode             = "by-node"
+	workerPodLabel     = "ate.dev/worker-pool"
 )
 
 // AteletInformer creates a SharedInformerFactory and SharedIndexInformer for

cmd/ateapi/main.go

@@ -34,6 +34,7 @@ import (
 	"github.com/agent-substrate/substrate/cmd/ateapi/internal/workercache"
 	"github.com/agent-substrate/substrate/internal/ateapiauth"
 	"github.com/agent-substrate/substrate/internal/ateinterceptors"
+	"github.com/agent-substrate/substrate/internal/installdefaults"
 	"github.com/agent-substrate/substrate/internal/k8sjwt"
 	"github.com/agent-substrate/substrate/internal/serverboot"
 	"github.com/agent-substrate/substrate/internal/version"
@@ -74,8 +75,6 @@ var (
 	showVersion     = pflag.Bool("version", false, "Print version and exit.")
 	authMode        = pflag.String("auth-mode", "mtls", "Auth mode for incoming gRPC: mtls|jwt. 'mtls' (default) relies on transport-level mTLS for client identity. 'jwt' additionally requires a Kubernetes ServiceAccount Bearer token on every RPC. Substrate will drop support for JWT auth mode once the Pod Certificates feature is enabled by default in the minimum supported Kubernetes version.")
 	clientJWTCAFile = pflag.String("client-jwt-ca-cert", ateapiauth.DefaultServiceAccountCAFile, "CA cert file used to verify TLS when fetching the OIDC discovery document and JWKS for JWT authentication. Defaults to the in-cluster service account CA.")
-
-	ateletNamespace = pflag.String("atelet-namespace", controlapi.DefaultAteletNamespace, "Namespace where atelet pods run. Override when the deployment runs atelet in a namespace other than the default.")
 )
 
 func main() {
@@ -137,8 +136,17 @@ func main() {
 	workerPoolLister := ateFactory.Api().V1alpha1().WorkerPools().Lister()
 	sandboxConfigLister := ateFactory.Api().V1alpha1().SandboxConfigs().Lister()
 
+	// atelet shares ateapi's namespace in every supported deployment topology.
+	// POD_NAMESPACE comes from Kubernetes' downward API; the install fallback
+	// keeps non-k8s invocations (tests, local dev) working.
+	ateletNamespace := os.Getenv("POD_NAMESPACE")
+	if ateletNamespace == "" {
+		ateletNamespace = installdefaults.SystemNamespace
+	}
+	slog.InfoContext(ctx, "Resolved atelet namespace", slog.String("atelet-namespace", ateletNamespace))
+
 	workerPodInformerFactory, workerPodInformer := controlapi.WorkerPodInformer(clientset)
-	ateletPodInformerFactory, ateletPodInformer := controlapi.AteletInformer(clientset, *ateletNamespace)
+	ateletPodInformerFactory, ateletPodInformer := controlapi.AteletInformer(clientset, ateletNamespace)
 
 	syncer := controlapi.NewWorkerPoolSyncer(redisPersistence, workerPodInformer)
 	syncer.Start(ctx)

cmd/atenet/internal/dns.go

@@ -30,6 +30,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client/config"
 
 	"github.com/agent-substrate/substrate/cmd/atenet/internal/dns"
+	"github.com/agent-substrate/substrate/internal/installdefaults"
 )
 
 type DnsConfig struct {
@@ -108,9 +109,9 @@ func NewDnsCmd() *cobra.Command {
 	cmd.Flags().StringVar(&cfg.Kubeconfig, "kubeconfig", "", "Absolute path to the kubeconfig configuration file")
 	cmd.Flags().DurationVar(&cfg.ReconcileInterval, "interval", 10*time.Second, "Interval for reconciling DNS configurations")
 	cmd.Flags().StringVar(&cfg.CorefilePath, "corefile-path", "/etc/coredns/Corefile", "Path to the local Corefile configuration on shared volume")
-	cmd.Flags().StringVar(&cfg.SystemNamespace, "system-namespace", dns.DefaultSystemNamespace, "Namespace where atenet-router and substrate's CoreDNS Service live. Override when the deployment uses a different namespace.")
-	cmd.Flags().StringVar(&cfg.RouterServiceName, "router-service-name", dns.DefaultRouterServiceName, "Service name of the atenet-router. Override when the deployment renames the Service.")
-	cmd.Flags().StringVar(&cfg.DNSServiceName, "dns-service-name", dns.DefaultDNSServiceName, "Service name of substrate's CoreDNS. Override when the deployment renames the Service.")
+	cmd.Flags().StringVar(&cfg.SystemNamespace, "system-namespace", installdefaults.SystemNamespace, "Namespace where atenet-router and substrate's CoreDNS Service live. Override when the deployment uses a different namespace.")
+	cmd.Flags().StringVar(&cfg.RouterServiceName, "router-service-name", installdefaults.RouterServiceName, "Service name of the atenet-router. Override when the deployment renames the Service.")
+	cmd.Flags().StringVar(&cfg.DNSServiceName, "dns-service-name", installdefaults.DNSServiceName, "Service name of substrate's CoreDNS. Override when the deployment renames the Service.")
 
 	return cmd
 }

cmd/atenet/internal/dns/dns.go

@@ -33,17 +33,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
-// Default resource names match the canonical install manifests in
-// manifests/ate-install/ (atenet-router and dns Services in the
-// ate-system namespace). Deployments that use a different namespace or
-// rename these Services must pass the actual values via the matching
-// flags on the dns command.
-const (
-	DefaultSystemNamespace   = "ate-system"
-	DefaultRouterServiceName = "atenet-router"
-	DefaultDNSServiceName    = "dns"
-)
-
 // Controller manages the DNS configuration for the ATE.
 type Controller struct {
 	Client       client.Client
@@ -52,14 +41,14 @@ type Controller struct {
 	Reloader     ConfigReloader
 
 	// SystemNamespace is the namespace where atenet-router and the substrate
-	// CoreDNS Service live. Defaults to DefaultSystemNamespace.
+	// CoreDNS Service live. Defaults to installdefaults.SystemNamespace.
 	SystemNamespace string
 	// RouterServiceName is the Service name of the atenet-router that the
 	// CoreDNS Corefile forwards actor traffic to. Defaults to
-	// DefaultRouterServiceName.
+	// installdefaults.RouterServiceName.
 	RouterServiceName string
 	// DNSServiceName is the Service name of substrate's CoreDNS. Defaults to
-	// DefaultDNSServiceName.
+	// installdefaults.DNSServiceName.
 	DNSServiceName string
 }
 

cmd/atenet/internal/dns/dns_test.go

@@ -28,6 +28,8 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	"github.com/agent-substrate/substrate/internal/installdefaults"
 )
 
 type mockConfigReloader struct {
@@ -98,9 +100,9 @@ func TestReconcile(t *testing.T) {
 		Interval:          1 * time.Second,
 		CorefilePath:      corefilePath,
 		Reloader:          reloader,
-		SystemNamespace:   DefaultSystemNamespace,
-		RouterServiceName: DefaultRouterServiceName,
-		DNSServiceName:    DefaultDNSServiceName,
+		SystemNamespace:   installdefaults.SystemNamespace,
+		RouterServiceName: installdefaults.RouterServiceName,
+		DNSServiceName:    installdefaults.DNSServiceName,
 	}
 
 	// Run one reconciliation loop
@@ -192,9 +194,9 @@ func TestReconcileKubeDNSNotFound(t *testing.T) {
 		Interval:          1 * time.Second,
 		CorefilePath:      corefilePath,
 		Reloader:          &mockConfigReloader{},
-		SystemNamespace:   DefaultSystemNamespace,
-		RouterServiceName: DefaultRouterServiceName,
-		DNSServiceName:    DefaultDNSServiceName,
+		SystemNamespace:   installdefaults.SystemNamespace,
+		RouterServiceName: installdefaults.RouterServiceName,
+		DNSServiceName:    installdefaults.DNSServiceName,
 	}
 
 	ctx := context.Background()

cmd/atenet/internal/router.go

@@ -22,6 +22,7 @@ import (
 
 	"github.com/agent-substrate/substrate/cmd/atenet/internal/router"
 	"github.com/agent-substrate/substrate/internal/ateapiauth"
+	"github.com/agent-substrate/substrate/internal/installdefaults"
 )
 
 func NewRouterCmd() *cobra.Command {
@@ -45,7 +46,7 @@ func NewRouterCmd() *cobra.Command {
 	cmd.Flags().StringVar(&cfg.MetricsAddr, "metrics-listen-addr", ":9090", "Address and port the prometheus metrics server should listen on.")
 	cmd.Flags().BoolVar(&cfg.Standalone, "standalone", false, "Run in standalone mode, bypassing creation of managed deployment and services in Kubernetes cluster")
 	cmd.Flags().StringVar(&cfg.Namespace, "namespace", "default", "Target operations namespace")
-	cmd.Flags().StringVar(&cfg.RouterServiceName, "router-service-name", router.DefaultRouterServiceName, "Service name of this atenet-router in the operations namespace. Override when the deployment renames the Service.")
+	cmd.Flags().StringVar(&cfg.RouterServiceName, "router-service-name", installdefaults.RouterServiceName, "Service name of this atenet-router in the operations namespace. Override when the deployment renames the Service.")
 	cmd.Flags().StringVar(&cfg.Kubeconfig, "kubeconfig", "", "Absolute path to the kubeconfig configuration file")
 	cmd.Flags().StringVar(&cfg.AteapiAddr, "ateapi-address", "api.ate-system.svc:443", "gRPC host address of the cluster ateapi Control instance")
 	cmd.Flags().IntVar(&cfg.HttpPort, "port-http", 8080, "TCP port for workload traffic entering through the Envoy Router")

cmd/atenet/internal/router/router.go

@@ -62,19 +62,13 @@ func init() {
 	utilruntime.Must(v1alpha1.AddToScheme(scheme))
 }
 
-// DefaultRouterServiceName matches the atenet-router Service name in the
-// canonical install manifests under manifests/ate-install/. Deployments
-// that rename the Service must pass the actual name via
-// --router-service-name.
-const DefaultRouterServiceName = "atenet-router"
-
 // RouterConfig holds deployment setup and endpoint options for the router node instance.
 type RouterConfig struct {
 	Standalone bool
 	Namespace  string
 	// RouterServiceName is the Service name of this atenet-router in the
 	// operations namespace, used by /statusz to look up its own ClusterIP.
-	// Defaults to DefaultRouterServiceName.
+	// Defaults to installdefaults.RouterServiceName.
 	RouterServiceName string
 	Kubeconfig        string
 	AteapiAddr        string

internal/installdefaults/installdefaults.go

@@ -0,0 +1,29 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package installdefaults holds the default namespace and Service names
+// that match the canonical install layout in manifests/ate-install/.
+// Binaries use these as flag defaults; deployments that diverge from
+// the canonical layout pass actual values via the corresponding flags.
+package installdefaults
+
+const (
+	// SystemNamespace is the namespace where substrate's control-plane
+	// components and the atelet DaemonSet run.
+	SystemNamespace = "ate-system"
+	// RouterServiceName is the Service name of atenet-router.
+	RouterServiceName = "atenet-router"
+	// DNSServiceName is the Service name of substrate's CoreDNS.
+	DNSServiceName = "dns"
+)