Add namespace attribute on IngressRouteTCP service

[jbdoumenjou]

What does this PR do?

Add a namespace attribute on IngressRouteTCP service.

Motivation

Allow to specify a namespace to reference a Kubernetes service from IngressRouteTCP.

More

• Added/updated tests
• Added/updated documentation

[juliens]

LGTM

[dtomcej]

Cross namespace referencing is discouraged due to fishing, and security/accountability reasons.

Is there a use case where an IngressRouteTCP could not be created in the target namespace?

Also, this does not take into account that the target namespace may not be watched/allowed via RBAC, and the informers may not be up to date with the endpoints...

[dduportal]

There is a long dicussion in Kubernetes tracker about this if you want to deep dive the subject: kubernetes/kubernetes#17088 .

Nginx usage for solving this is interesting though: they have the concept of "merged Ingress": https://github.com/nginxinc/kubernetes-ingress/tree/master/examples-of-custom-resources/cross-namespace-configuration .

[dtomcej]

I think that if this was enabled by a feature flag, it would be fine.

--provider.kubernetescrd.crossnamespacereferences=true with a default of false would be enough.

It would keep the current behavior, and allow the defaults to be secure, and allow users to allow references if required. This would require users to explicitly allow cross references, and would be unlikely to complain of the risks of enabling it explicitly.

This could be implemented to the ingressRoute and ingressRouteTCP crds IMO if that feature flag were implemented.

[ldez]

The namespace is already available for the services in IngressRoute, so we cannot introduce the option with the expected behavior without breaking.

[dtomcej]

LGTM

[mpl]

LGTM after formatting fix.