From 3777305fb36e7814a0bb484304a06f249a98aa20 Mon Sep 17 00:00:00 2001 From: Safwan Date: Mon, 22 Jun 2026 20:40:39 +0500 Subject: [PATCH] updated readme and comments --- README.md | 1 + internal/pkg/controller/secretproviderclass_reconciler.go | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 7af2c133..1b17fbff 100644 --- a/README.md +++ b/README.md @@ -304,6 +304,7 @@ Reloader reacts to CSI status changes, not direct updates to external secret sto Secret rotation must be enabled in the CSI driver for updates to be detected CSI limitations (such as `subPath` mounts) still apply and may require pod restarts If secrets are synced to Kubernetes Secret objects, standard Reloader behavior applies and CSI support may not be required +`--resource-label-selector` is not applied to CSI watches: it scopes ConfigMaps/Secrets only, since `SecretProviderClassPodStatus` objects are managed by the CSI driver and cannot carry user labels. CSI reloads continue to work when a label selector is configured ## 🚀 Installation diff --git a/internal/pkg/controller/secretproviderclass_reconciler.go b/internal/pkg/controller/secretproviderclass_reconciler.go index a4c17511..710a1eb9 100644 --- a/internal/pkg/controller/secretproviderclass_reconciler.go +++ b/internal/pkg/controller/secretproviderclass_reconciler.go @@ -74,8 +74,8 @@ func resolveSecretProviderClassChange( } // secretProviderClassFilter omits the label selector (driver-owned SPCPS can't -// carry user labels) and the namespace cache (checked in Reconcile to avoid a -// startup race). See docs/manual-testing-csi.md. +// carry user labels, so applying it would silently disable CSI reloads) and the +// namespace cache (checked in Reconcile to avoid a startup race). func secretProviderClassFilter(cfg *config.Config, hasher *reload.Hasher) predicate.Predicate { return reload.CombinedPredicates( reload.NamespaceFilterPredicateWithCache(cfg, nil),