feat(source)!: support multiple namespaces in --namespace

[mloiseleur]

What does it do ?

Makes --namespace repeatable and comma-separated:

--namespace=team-a --namespace=team-b
--namespace=team-a,team-b
EXTERNAL_DNS_NAMESPACE=team-a,team-b

One informer factory per namespace, so it works under namespace-scoped RBAC.

Supported: service, crd, ingress, ambassador-host, contour-httpproxy, f5-transportserver, f5-virtualserver, kong-tcpingress, openshift-route, traefik-proxy, unstructured.

Several namespaces with a source not yet migrated fails at startup, instead of silently watching the first:

--namespace accepts a single value with the following sources: istio-gateway, pod

⚠️ Breaking: Config.Namespace string becomes Namespaces []string. Compile-time break for out-of-tree consumers of pkg/apis/externaldns. No config change for operators.

Also adds --crd-registry-namespace, decoupling the CRD registry storage namespace from --namespace. Defaults to the namespace ExternalDNS runs in instead of default. That registry is unreleased, so no migration.

Motivation

Fixes #3565. Scoped multi-tenant deployments currently need one ExternalDNS instance per namespace.

Supersedes #6387 by @AryanSharma9917, which added --service-namespace for the Service source only. Extending --namespace avoids a namespace flag per source and covers every source at once.

Follow-ups

• istio-gateway, istio-virtualservice, pod
• skipper-routegroup, gateway-*
• deprecate --gloo-namespace and --gateway-namespace
• multi-namespace tests for the 9 sources beyond service and crd

More

• Yes, this PR title follows Conventional Commits
• Yes, I added unit tests — dedicated multi-namespace tests for service and crd; the other 9 rely on their existing suites
• Yes, I updated end user documentation accordingly

Validation:

• go test -race ./...
• golangci-lint run ./...
• make licensecheck
• make generate-flags-documentation generate-sources-documentation

Fixes #3565
Supersedes #6387

[kubernetes-prow]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign szuecs for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coveralls]

Coverage Report for CI Build 30672105678

Coverage increased (+0.1%) to 81.818%

Details

• Coverage increased (+0.1%) from the base build.
• Patch coverage: No coverable lines changed in this PR.
• 338 coverage regressions across 18 files.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

338 previously-covered lines in 18 files lost coverage.

Top 10 Files by Coverage Loss	Lines Losing Coverage	Coverage
traefik_proxy.go	89	68.26%
kong_tcpingress.go	47	51.85%
gateway.go	31	87.23%
service.go	28	94.24%
crd/crd.go	23	90.48%
ambassador_host.go	18	86.18%
f5_transportserver.go	15	84.11%
f5_virtualserver.go	15	84.68%
istio_virtualservice.go	14	87.92%
contour_httpproxy.go	13	86.72%

---

Coverage Stats

Relevant Lines:	21604
Covered Lines:	17676
Line Coverage:	81.82%
Coverage Strength:	723.76 hits per line

---

💛 - Coveralls