Support selecting watched namespaces with a label selector

[fourhu]

Is your feature request related to a problem?

The controller currently supports limiting watched namespaces with --namespace-whitelist or --namespace-blacklist. Both options use namespace names configured when the controller starts.

In our clusters, namespaces are created or reassigned regularly, and we already use namespace labels to identify ownership. Keeping a separate whitelist in sync requires updating the controller arguments and restarting the controller whenever the selected namespaces change.

Describe the solution you'd like

We would like the controller to support selecting watched namespaces with a Kubernetes label selector. One possible interface could be:

--namespace-label-selector='team=backend'

When configured:

• Namespaces matching the selector would be watched when the controller starts.
• A namespace would be picked up automatically when it starts matching the selector.
• A namespace would no longer be watched when it stops matching, and its resources would be removed from the generated configuration.

The exact interaction with --namespace-whitelist and --namespace-blacklist could be discussed separately. Our main use case is updating namespace membership without restarting the controller.

Describe alternatives you've considered

As a workaround, we could generate --namespace-whitelist from namespace labels and redeploy the controller whenever the selected namespaces change. However, this would require additional automation and controller restarts.

Additional context

Are there any plans to support dynamic namespace selection based on namespace labels?