Allow ClientSettingsPolicy to reference gateways in a different namespace?

[evanjarrett]

The current CRD for ClientSettingsPolicy uses a LocalPolicyTargetRef. I'd like to request implementing this as a NamespacedPolicyTargetReference.

I have my gateway deployed in a separate namespace to the rest of NGF. I'd like to be able to deploy a ClientSettingsPolicy in the NGF namespace, but reference a gateway in a separate namespace.

[mpstefan]

Hey @evanjarrett

I know the Gateway spec includes this field, but could you tell us a bit more about your use case? Why wouldn't you include the ClientSettingsPolicy that is applied to the Gateway in the same namespace as the Gateway? Is there a specific need to go across namespaces around access control or something similar?

[evanjarrett]

This started because it appears I have an older version of the CRD that defined a namespace field in the targetRef. I had a CSP already created, waiting for the final merge of the code, and when I updated NGF, it wasn't working. That was when I realized it has to be within the same namespace as the target resource.

My main reasoning is if I ever wanted to point my gateway to a different provider, I now have this CSP that is just dangling in that namespace. If it was able to be deployed alongside all the NGF resources, it would be easier to clean up.

If you are deploying routes alongside applications, service etc all in their own namespace, it would make sense to also keep the CSP there as that namespace can now be self contained. But global settings make more sense to me to be deployed alongside the rest of the NGF deployment.

I just want the flexibility to be able to have the CSP in a different namespaces just like httproutes and gateways can reference resources in other namespaces.

[mpstefan]

Thanks @evanjarrett, I totally get it. I'll bring this up in our next community meeting to see about why this restriction is in place and what it would take to remove it.