The initial implementation of the MeshFederation controller only watches the system namespace (specifically, the clusterRegistriesNamespace).  We need to decide whether or not it should watch all namespaces in the mesh.  if we allow these resources to be created outside the system namespace, we should limit the scope of users who can create them.  We may also want to include RBAC checks to ensure the user creating them can also "use" the SMCP resource.  Any, this requires more thought.