fix(substrate): scope Substrate reads and page tokens to the watched namespaces

go/core/internal/service/system/service.go

@@ -51,7 +51,7 @@ func NewService(
 ) *Service {
 	return &Service{
 		kubeClient:         kubeClient,
-		observedNamespaces: slices.Clone(observedNamespaces),
+		observedNamespaces: slices.Compact(slices.Sorted(slices.Values(observedNamespaces))),
 		authorizer:         authorizer,
 		ateClient:          ateClient,
 	}
@@ -148,16 +148,6 @@ func namespacesFromNames(names []string) []Namespace {
 	return result
 }
 
-func (s *Service) substrateNamespaces(requested string) []string {
-	if requested != "" {
-		return []string{requested}
-	}
-	if len(s.observedNamespaces) > 0 {
-		return slices.Clone(s.observedNamespaces)
-	}
-	return []string{""}
-}
-
 func (s *Service) listWorkerPools(ctx context.Context, namespace string) ([]atev1alpha1.WorkerPool, error) {
 	var options []client.ListOption
 	if namespace != "" {
@@ -173,22 +163,24 @@ func (s *Service) listWorkerPools(ctx context.Context, namespace string) ([]atev
 }
 
 // substrateActorTemplates drains upstream pagination for the configuration-sized list.
-func (s *Service) substrateActorTemplates(ctx context.Context, atespace string) ([]*ateapipb.ActorTemplate, error) {
-	templatesFromAPI, err := s.ateClient.ListActorTemplates(ctx, atespace)
-	if err != nil {
-		return nil, err
-	}
-	templates := make([]*ateapipb.ActorTemplate, 0, len(templatesFromAPI))
-	for _, template := range templatesFromAPI {
-		if template == nil {
-			continue
+func (s *Service) substrateActorTemplates(ctx context.Context, scope substrateScope) ([]*ateapipb.ActorTemplate, error) {
+	templates := []*ateapipb.ActorTemplate{}
+	for _, atespace := range scope.listNamespaces() {
+		templatesFromAPI, err := s.ateClient.ListActorTemplates(ctx, atespace)
+		if err != nil {
+			return nil, err
+		}
+		for _, template := range templatesFromAPI {
+			if template == nil {
+				continue
+			}
+			// Only expose inventory fields: containers can contain resolved credentials.
+			templates = append(templates, &ateapipb.ActorTemplate{
+				Metadata:       template.GetMetadata(),
+				Status:         template.GetStatus(),
+				WorkerSelector: template.GetWorkerSelector(),
+			})
 		}
-		// Only expose inventory fields: containers can contain resolved credentials.
-		templates = append(templates, &ateapipb.ActorTemplate{
-			Metadata:       template.GetMetadata(),
-			Status:         template.GetStatus(),
-			WorkerSelector: template.GetWorkerSelector(),
-		})
 	}
 
 	slices.SortStableFunc(templates, func(left, right *ateapipb.ActorTemplate) int {