refactor: per-namespace model — namespace-scoped RBAC, no GatewayClass

- ClusterRole/ClusterRoleBinding → Role/RoleBinding (all operator
  resources are namespace-scoped, no cluster-wide permissions needed)
- Remove gatewayclass.yaml — Envoy Gateway installs the "eg" class
  automatically; chart now defaults to gateway.className=eg
- Operator always scoped to release namespace (--watch-namespace and
  --gateway-namespace hardwired to .Release.Namespace)
- gateway.allowedRouteNamespaces defaults to Same
- Removed gateway.namespace, operator.gatewayNamespace,
  operator.watchNamespace values and unused _helpers.tpl entries
- README: simplify to one helm install per namespace

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: obezpalko

README.md

@@ -30,14 +30,15 @@ helm install eg oci://docker.io/envoyproxy/gateway-helm \
 
 ## Install
 
+Run once per namespace. Each install is fully self-contained — operator + Gateway scoped to that namespace:
+
 ```bash
-# Install the operator + GatewayClass + Gateway from GHCR
 helm install envoy-router oci://ghcr.io/comet-ml/charts/envoy-router \
   --version 0.1.0 \
-  --namespace envoy-router --create-namespace
+  --namespace ns-1 --create-namespace
 ```
 
-This installs the operator, a `GatewayClass`, and a `Gateway` in the `envoy-router` namespace.
+The operator watches only its own namespace and attaches HTTPRoutes to the Gateway in the same namespace.
 
 ## Making a pod routable
 
@@ -58,43 +59,28 @@ Key Helm values:
 | Value | Default | Description |
 |---|---|---|
 | `operator.podPort` | `8080` | Port the pods listen on |
-| `operator.watchNamespace` | `""` | Restrict to one namespace (empty = all) |
-| `gateway.allowedRouteNamespaces` | `All` | Namespaces that can attach HTTPRoutes |
-| `gateway.create` | `true` | Set `false` to bring your own Gateway |
+| `gateway.create` | `true` | Set `false` to skip Gateway creation |
+| `gateway.className` | `eg` | GatewayClass name (Envoy Gateway installs `eg` by default) |
+| `gateway.port` | `80` | Listener port on the Gateway |
 
 ## Multi-namespace setup
 
-If you have multiple namespaces each with their own ALB, deploy one `Gateway` per namespace. A single Envoy Gateway controller and a single operator instance serve the whole cluster.
-
-```
-ns-1:  ALB-1 → Gateway (ns-1) → HTTPRoutes for pp-* in ns-1
-ns-2:  ALB-2 → Gateway (ns-2) → HTTPRoutes for pp-* in ns-2
-```
-
-**ALB configuration:** each ALB needs only one rule — forward `/*` to the Envoy Gateway service in that namespace. No per-pod rules.
-
-**Install the operator once** (cluster-wide, no Gateway):
+Each namespace is fully independent — just repeat the install:
 
 ```bash
 helm install envoy-router oci://ghcr.io/comet-ml/charts/envoy-router \
-  --version 0.1.0 \
-  --namespace envoy-router --create-namespace \
-  --set gateway.create=false \
-  --set operator.watchNamespace=""
-```
+  --version 0.1.0 --namespace ns-1 --create-namespace
 
-**Install a Gateway in each namespace:**
+helm install envoy-router oci://ghcr.io/comet-ml/charts/envoy-router \
+  --version 0.1.0 --namespace ns-2 --create-namespace
+```
 
-```bash
-helm install envoy-router-gateway oci://ghcr.io/comet-ml/charts/envoy-router \
-  --version 0.1.0 \
-  --namespace ns-1 --create-namespace \
-  --set gateway.create=true \
-  --set gateway.allowedRouteNamespaces=Same \
-  --set operator.watchNamespace=ns-1   # disable second operator — only one needed
+```
+ns-1:  ALB-1 → Gateway (ns-1) → HTTPRoutes for pp-* in ns-1
+ns-2:  ALB-2 → Gateway (ns-2) → HTTPRoutes for pp-* in ns-2
 ```
 
-> The operator uses the pod's namespace to find the local Gateway when `--gateway-namespace` is empty, so HTTPRoutes in `ns-1` attach to the Gateway in `ns-1` automatically.
+**ALB configuration:** one rule per ALB — forward `/*` to the Envoy Gateway service in that namespace. No per-pod rules needed.
 
 ## Development
 

charts/envoy-router/templates/_helpers.tpl

@@ -22,11 +22,3 @@
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
-
-{{- define "envoy-router.gatewayNamespace" -}}
-{{- default .Release.Namespace .Values.gateway.namespace }}
-{{- end }}
-
-{{- define "envoy-router.operatorGatewayNamespace" -}}
-{{- default .Release.Namespace .Values.operator.gatewayNamespace }}
-{{- end }}

charts/envoy-router/templates/deployment.yaml

@@ -25,12 +25,10 @@ spec:
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         args:
         - --gateway-name={{ .Values.operator.gatewayName }}
-        - --gateway-namespace={{ include "envoy-router.operatorGatewayNamespace" . }}
+        - --gateway-namespace={{ .Release.Namespace }}
         - --service-port={{ .Values.operator.servicePort }}
         - --pod-port={{ .Values.operator.podPort }}
-        {{- if .Values.operator.watchNamespace }}
-        - --watch-namespace={{ .Values.operator.watchNamespace }}
-        {{- end }}
+        - --watch-namespace={{ .Release.Namespace }}
         ports:
         - name: metrics
           containerPort: 8080

charts/envoy-router/templates/gateway.yaml

@@ -3,7 +3,7 @@ apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
   name: {{ .Values.gateway.name }}
-  namespace: {{ include "envoy-router.gatewayNamespace" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ include "envoy-router.name" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}

charts/envoy-router/templates/gatewayclass.yaml

@@ -1,7 +1,8 @@
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
+kind: Role
 metadata:
   name: {{ include "envoy-router.fullname" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ include "envoy-router.name" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}
@@ -15,7 +16,6 @@ rules:
 - apiGroups: ["gateway.networking.k8s.io"]
   resources: ["httproutes"]
   verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-# controller-runtime leader election and event recording
 - apiGroups: ["coordination.k8s.io"]
   resources: ["leases"]
   verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

…/envoy-router/templates/clusterrole.yaml charts/envoy-router/templates/role.yamlcharts/envoy-router/templates/clusterrole.yaml renamed to charts/envoy-router/templates/role.yaml charts/envoy-router/templates/clusterrole.yaml renamed to charts/envoy-router/templates/role.yaml

@@ -1,13 +1,14 @@
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
+kind: RoleBinding
 metadata:
   name: {{ include "envoy-router.fullname" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ include "envoy-router.name" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
+  kind: Role
   name: {{ include "envoy-router.fullname" . }}
 subjects:
 - kind: ServiceAccount

…router/templates/clusterrolebinding.yaml …/envoy-router/templates/rolebinding.yamlcharts/envoy-router/templates/clusterrolebinding.yaml renamed to charts/envoy-router/templates/rolebinding.yaml charts/envoy-router/templates/clusterrolebinding.yaml renamed to charts/envoy-router/templates/rolebinding.yaml

@@ -9,26 +9,20 @@ serviceAccount:
   create: true
   name: ""
 
-# Gateway API resources created by this chart
+# Gateway resource created in the same namespace as the operator.
+# Uses the "eg" GatewayClass that Envoy Gateway installs automatically.
 gateway:
-  # Set false if you manage GatewayClass/Gateway yourself
   create: true
-  className: envoy-router
+  className: eg
   name: envoy-router
-  # Defaults to .Release.Namespace when empty
-  namespace: ""
   port: 80
-  # Namespaces allowed to attach HTTPRoutes: All | Same | Selector
-  allowedRouteNamespaces: All
+  # Same: only HTTPRoutes from this namespace attach (per-namespace model)
+  allowedRouteNamespaces: Same
 
 operator:
   gatewayName: envoy-router
-  # Defaults to .Release.Namespace when empty
-  gatewayNamespace: ""
   servicePort: 80
   podPort: 8080
-  # Empty = watch all namespaces
-  watchNamespace: ""
 
 resources: {}
 nodeSelector: {}