Add namespaces to different levels of deployable kustomizations (#1475)

`apiserver` and `controller` components now have:
- config/\<component\>/default/   - namespace+namePrefix only, emits no
                                  Namespace (used as a base)
- config/\<component\>/standalone/ - wraps default/ and adds the
                                  ironcore-system Namespace; use this for
                                  single-component deploys

Shared Namespace lives in config/namespaces/ironcore-system/. The combined
config/default and config/etcdless installs reference the bases and the
namespace kustomization directly, eliminating the previous
remove-namespace.yaml patch dance. Build output for both is byte-identical
to main (only kustomize deprecation-warning lines disappear, since the
patches that triggered them are gone).

The namespaces folder can be extended with additional namespaces, e.g. for
the pool leases.

Behavioral change for downstream consumers: users who previously ran
`kustomize build config/controller/default` for a complete deploy must
migrate to `config/controller/standalone`; same for
`config/apiserver/default` -> `config/apiserver/standalone` (or
`config/apiserver/standalone-etcdless` for the external-etcd variant).

Consumers must not apply namespace transformers in overlays, these
will fail once we have multiple namespaces.

The Makefile install/uninstall/deploy/undeploy targets are retargeted at
the standalone variants accordingly. hack/validate-kustomize.sh is also
made portable (GNU realpath --relative-to is unavailable on macOS).

---------

Signed-off-by: Felix Riegger <felix.riegger@sap.com>

Author: friegger

Makefile

@@ -227,20 +227,20 @@ docker-push: ## Push docker image with the manager.
 .PHONY: install
 install: manifests kustomize ## Install API server & API services into the K8s cluster specified in ~/.kube/config. This requires APISERVER_IMG to be available for the cluster.
 	cd config/apiserver/server && $(KUSTOMIZE) edit set image apiserver=${APISERVER_IMG}
-	kubectl apply -k config/apiserver/default
+	kubectl apply -k config/apiserver/standalone
 
 .PHONY: uninstall
 uninstall: manifests kustomize ## Uninstall API server & API services from the K8s cluster specified in ~/.kube/config.
-	kubectl delete -k config/apiserver/default
+	kubectl delete -k config/apiserver/standalone
 
 .PHONY: deploy
 deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
 	cd config/controller/manager && $(KUSTOMIZE) edit set image controller=${CONTROLLER_IMG}
-	kubectl apply -k config/controller/default
+	kubectl apply -k config/controller/standalone
 
 .PHONY: undeploy
 undeploy: ## Undeploy controller from the K8s cluster specified in ~/.kube/config.
-	kubectl delete -k config/controller/default
+	kubectl delete -k config/controller/standalone
 
 ##@ Kind Deployment plumbing
 

config/apiserver/kind/kustomization.yaml

@@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - ../default
+  - ../standalone
 
 patchesStrategicMerge:
   - patch-apiserver.yaml

config/apiserver/server/server.yaml

@@ -1,10 +1,3 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    control-plane: apiserver
-  name: system
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:

config/apiserver/standalone-etcdless/kustomization.yaml

@@ -0,0 +1,9 @@
+# Standalone install of the ironcore apiserver against an external etcd
+# (no in-cluster etcd StatefulSet): same content as config/apiserver/etcdless
+# plus the ironcore-system Namespace.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../etcdless
+  - ../../namespaces/ironcore-system

config/apiserver/standalone/kustomization.yaml

@@ -0,0 +1,10 @@
+# Standalone install of the ironcore apiserver (with the bundled etcd
+# StatefulSet): same content as config/apiserver/default plus the
+# ironcore-system Namespace. Use this when deploying the apiserver without
+# the controller manager.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../default
+  - ../../namespaces/ironcore-system

config/controller/kind/kustomization.yaml

@@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - ../default
+  - ../standalone
 
 patchesStrategicMerge:
   - patch-manager.yaml

config/controller/manager/manager.yaml

@@ -1,10 +1,3 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    control-plane: controller-manager
-  name: system
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:

config/controller/standalone/kustomization.yaml

@@ -0,0 +1,11 @@
+# Standalone install of the ironcore controller manager: same content as
+# config/controller/default plus the ironcore-system Namespace. Use this when
+# deploying the controller without the apiserver. The combined config/default
+# install references the Namespace kustomization directly, not via this
+# wrapper.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../default
+  - ../../namespaces/ironcore-system