feat: Support sync.toHost.namespaces via pro hook overrides

[jleeh]

What

Upstream gates sync.toHost.namespaces behind pro.GetNamespaceMapper / pro.GetWithSyncedNamespacesTranslator,
which return a license error in the OSS binary. vCluster Pro is not a plugin either: it is a separate binary that
overrides those hook variables. This does the same, so core stays almost untouched.

• pkg/linkpool/namespaces registers the overrides in init():
  • translator: mapped virtual namespaces sync to their own host namespace with raw object names; unmapped ones
    fall back to single-namespace rewriting in the control-plane namespace (documented Pro default).
  • Namespace mapper: resolves through the configured mappings (exact, single-wildcard patterns, ${name}); returns
    the control-plane namespace for unmapped virtual namespaces so lookups such as the kube-dns service keep working;
    treats matching host namespaces as managed so they are imported, unless another vCluster's marker label owns
    them. Deterministic, so not wrapped in the store recorder. mappingsOnly is not enforced and logs a warning.
• cmd/vcluster-linkpool/main.go is the upstream main with that package imported. The Dockerfile takes MAIN as a
  build arg (default unchanged); build with --build-arg MAIN=cmd/vcluster-linkpool/main.go.

Core changes, all small:

• namespace syncer implements ObjectExcluder: virtual namespaces that resolve to the vCluster's own host namespace
  are never synced as namespaces, and the host namespace itself is never touched.
• namespace syncer marks a host namespace it did not create as imported when adopting it, so deleting the virtual
  namespace never deletes a pre-existing host namespace.
• the Service create filter waits up to 10s for a host namespace the namespace syncer is still creating, instead of
  failing a kubectl apply that creates a namespace and a service in one go (seen on vcluster-test).

Not included: the Pro Importer (bulk import of pre-existing workloads inside a mapped host namespace) is still the
no-op stub. Only the Namespace object itself is imported.

Testing

go build ./... and go test ./pkg/... pass. Unit tests cover the mapping helpers, translator and mapper; the
mapper test goes through resources.CreateNamespacesMapper so the hook override is exercised.
Live test on vcluster-test via linkpoolio/infra-argocd-deployments (team-* mapping); the node-proxy plugin must be
built against this branch too (linkpoolio/vcluster-node-proxy#2) because the SDK re-runs config init in the plugin.

🤖 Generated with Claude Code

[jleeh]

Live test on vcluster-test (image feat-synced-namespaces-8303b725b, plugin 98f77f2, mapping "team-*": "${name}-team-*"):

• Virtual team-a -> host vcluster-test-team-a with marker labels; configmap, service, service accounts, pod and SA token secret all land there under raw names. Pod runs, exec/logs through the vcluster work, configmap env and volume mount resolve. Nothing leaks into the control-plane namespace and the control-plane namespace itself is not modified.
• kubectl apply of namespace + service in one file now succeeds (Service filter wait).
• Deleting the virtual namespace removes the host namespace within ~15s.
• Pre-created host vcluster-test-team-imported is imported as virtual team-imported within ~5s and survives deletion of the virtual namespace. Pre-existing objects inside it are not imported (Pro Importer stub, as documented).
• Existing smoke / kube-system workloads untouched. Syncer memory ~630-850Mi per replica (was ~450Mi) with the cluster-wide cache.

Known gap outside this repo: pods in mapped host namespaces sit outside the tenant CiliumNetworkPolicy (keyed on the control-plane namespace), so in-pod DNS to the vcluster coredns times out and they get default-pool IPs. Needs a chart follow-up (policy keyed on vcluster.loft.sh/managed-by, IPAM annotation on synced namespaces).

[jleeh]

Two more commits from the in-place switch of vcluster-test to workloadIsolation (static mappings, mappingsOnly: true):

• 73d992826 enforces mappingsOnly: unmapped virtual namespaces get no host namespace and their objects no host name; logged once per namespace. kube-system must be mapped.
• 3e25392e0 stops treating the control-plane namespace as a sync target under mappingsOnly. The mapping store verifies mappings against IsTargetedNamespace when it loads, so mappings recorded before namespace sync was enabled (kube-root-ca.crt, coredns, services pinned to the control-plane namespace) are dropped at leader start and the objects re-translate into their mapped namespace. Without this the recreated coredns pod referenced configmaps that only existed in the control-plane namespace. Old host copies are left for manual cleanup.

Images: feat-synced-namespaces-3e25392e0, plugin a7a8e09 (linkpoolio/vcluster-node-proxy#2). Rolling out via linkpoolio/infra-argocd-deployments#13576.

[jleeh]

05badd1fd: 3e25392e0 did not take effect on vcluster-test because the mapping store is created and loaded (with verification) inside initControllerContext, before the namespace mapper that set mappingsOnly on the translator existed. The flag is now set from a pro.LicenseInit wrapper, which runs right after the translator is built and before the controller context; the mapper still sets it for the plugin process. Unit test added for the hook. Images: feat-synced-namespaces-05badd1fd, plugin c90751a.

[jleeh]

81542a1e7 (core, pkg/mappings/store): the store verified only top-level mappings on load; references recorded under them (a pod's configmaps) were added to the name maps unverified, so kube-system/coredns and kube-root-ca.crt stayed pinned to the control-plane namespace even after 05badd1fd, until their owner mappings were garbage-collected. References are now filtered with the same verify function on load and on backend updates. On vcluster-test the remaining objects were unpinned by GC plus pod recreation; coredns now runs in vcluster-test-ns-kube-system with a tenant-pool IP.

[jleeh]

b3c874bda adds translate patches (sync.toHost.*.patches / sync.fromHost.*.patches), the second Pro feature done through the same hook overrides, in pkg/linkpool/patches:

• path: JSONPath subset over the object's unstructured form: dotted/quoted fields, [N], [*], [?(@.field=='x')] (also != and existence). Missing path → skipped; a missing final field in an existing map is a match with undefined so expressions can add fields.
• expression / reverseExpression: JavaScript via goja, value plus context.{vObject,hostObject,path}; undefined/null removes the field. Host objects get the forward expression, virtual objects the reverse one, swapped when the syncer passes reverseExpressions (fromHost resources).
• reference: name (and namespace via namespacePath) rewritten through the registered mapper for the kind, else the translator's short host name with the mapping recorded; reverse via mapper or mapping store.
• labels: plain label maps and metav1.LabelSelector translated like pod selectors.

Dependencies: github.com/dop251/goja vendored. Upstream's go.mod still requires github.com/loft-sh/e2e-framework, whose repository no longer exists, which blocked any go mod vendor; it is now replaced by hack/e2e-framework, a copy of the packages upstream had already vendored (used by e2e tests only). Unit tests cover path resolution, expressions both directions, add/remove, references and labels.