Configure Envoy Proxy fleet in different namespaces

[arkodg]

          thinking out loud, potential API could look like

deploymentMode:
  watch:
    namespaces: .........
  deploy:
    envoy:
      namespaceType: GatewayNamespace  

• By default (when this field is unset), EG watches all resources in all namespaces, and depoys infra in the namespace where EG is running (ControllerNamespace)
• watch.namespaces can be used to set the specific namespaces to watch resources (Gateway, xRoute, Service etc)
• deploy.envoy.namespaceType can be used to specify to EG to deploy proxy infra to deploy envoy deployments in the namespace where the Gateway is created in. This option will need a helm knob too, to configure added permissions to be able to create deployments and services in other namespaces

Originally posted by @arkodg in #1117 (comment)

[cnvergence]

I would like to tackle this one

[cnvergence]

It will also be necessary to move away from mTLS for control plane auth to sTLS + JWT Authn to validate the envoy.
cc @arkodg

[arkodg]

yah @cnvergence, we can selectively do it for the case when the Gateway is running in a user namespace

[github-actions]

This issue has been automatically marked as stale because it has not had activity in the last 30 days.

[github-actions]

This issue has been automatically marked as stale because it has not had activity in the last 30 days.