Shared helper for package namespaces

General MR

Summary

Reduces duplication across package namespace templates by introducing a shared `bigbang.namespace` helper.

The helper centralizes:

• Namespace resource rendering
• Common application labels
• Package-specific labels
• Istio sidecar-injection labels
• Istio ambient dataplane enrollment

The helper validates required namespace arguments at template time. Missing or empty name and appName values now fail with a targeted error instead of producing an invalid namespace or silently omitting the application label.

The optional meshMode argument is also validated for type and supported values.

Explicit mesh exclusion

Thirty-five package namespace templates now call the shared helper instead of duplicating the same resource and label logic.

Namespace mesh behavior

The helper supports two modes:

Mode	Behavior
`auto`	Default. Uses `istio.io/dataplane-mode: ambient` when ambient mode is enabled; otherwise calculates `istio-injection` from the global and package Istio settings.
`none`	Explicitly excludes the namespace from both Istio dataplanes by setting `istio-injection: disabled` and `istio.io/dataplane-mode: none`.

Most packages omit `meshMode` and use the default `auto` behavior.

Gatekeeper and Kyverno explicitly use `meshMode: none` because they must remain outside the service mesh.

Package-specific metadata

The helper accepts `extraLabels` for namespaces that require additional metadata while retaining the shared behavior.

Examples include:

• Gatekeeper admission and system labels
• External Secrets and Headlamp Helm ownership labels

Mattermost application label

Templates with user-provided namespace metadata or multiple namespace resources remain outside the helper.

Intentional behavior changes

Gatekeeper

Gatekeeper was already excluded from sidecar injection but did not explicitly opt out of the ambient dataplane.

It now renders:

istio-injection: disabled
istio.io/dataplane-mode: none

This makes its intended mesh exclusion explicit and consistent with Kyverno.

Renovate

Renovate previously always rendered an istio-injection label, even when ambient mode was enabled. There was no documented sidecar-only requirement, and its package values already include ambient HBONE network-policy handling.

Renovate now follows the same automatic mesh behavior as the other integrated packages:

• Sidecar injection outside ambient mode
• Ambient dataplane enrollment when ambient mode is enabled

Relevant logs/screenshots

n/a

Linked Issue

Closes issue

Upgrade Notices

N/A