runtime-operator namespace scoping

[jfleitz]

Summary

This PR improves the runtime-operator Helm chart by introducing per-component ServiceAccount configuration and optional namespace-scoped watching.

Adds the property for operator.enabled (default true) in values.yaml to allow for just running the helm chart to install host groups only.

Per-Component ServiceAccounts

Each deployment (operator, gateway, runtime, NATS) now has its own serviceAccount block in values.yaml with create, name, and annotations fields. Previously, all deployments used a Service Account name with a prefix appended. This allows operators to:

• Define RBAC permissions and Service Accounts prior to doing a Helm install
• Disable automatic ServiceAccount creation per component when using pre-existing accounts

The _helpers.tpl has been updated with dedicated named templates for each component (operator.serviceAccountName, gateway.serviceAccountName, runtime.serviceAccountName, nats.serviceAccountName), each generating a unique default name by appending the component suffix to the release fullname.

Namespace-Scoped Watching

The operator.watchNamespaces value has been changed from a comma-delimited string to a YAML list. When namespaces are specified, the chart:

• Passes the namespaces as a comma-separated -watch-namespaces flag to the operator binary

When watchNamespaces is empty (the default), the chart creates a ClusterRole and ClusterRoleBinding as before, and the operator watches all namespaces.

Example

operator:
  serviceAccount:
    create: true
    name: "my-operator-sa"
  watchNamespaces:
    - production
    - staging

gateway:
  serviceAccount:
    create: true
    name: "my-gateway-sa"

runtime:
  serviceAccount:
    create: true
    name: ""  # auto-generated as <fullname>-runtime

nats:
  serviceAccount:
    create: true
    name: ""  # auto-generated as <fullname>-nats

Files Changed

File	Change
values.yaml	Added serviceAccount blocks for all components; changed watchNamespaces to a list
_helpers.tpl	Added operator.serviceAccountName, gateway.serviceAccountName, runtime.serviceAccountName, nats.serviceAccountName templates
templates/operator/deployment.yaml	Uses operator.serviceAccountName; joins watchNamespaces list with join ","
templates/operator/clusterrole.yaml	Only generated when watchNamespaces is empty
templates/operator/clusterrolebinding.yaml	Uses operator.serviceAccountName; only generated when watchNamespaces is empty
templates/operator/clusterrolebinding-metrics.yaml	Uses operator.serviceAccountName
templates/operator/serviceaccount.yaml	Uses operator.serviceAccountName
templates/operator/role-watchnamespace.yaml	Creates a Role per watched namespace
templates/operator/rolebinding-watchnamespace.yaml	Creates a RoleBinding per watched namespace
templates/gateway/*	Uses gateway.serviceAccountName
templates/runtime/*	Uses runtime.serviceAccountName
templates/nats/*	Uses nats.serviceAccountName
runtime-operator/cmd/main.go	Implements -watch-namespaces flag with cache.Options.DefaultNamespaces

Validation

Tested with local kind cluster, as well as doing a diff of the template outpur of the previous helm chart (RC7) with this version.