resolved comments

internal/pkg/config/validation.go

@@ -5,6 +5,7 @@ import (
 	"strings"
 
 	"k8s.io/apimachinery/pkg/labels"
+	apivalidation "k8s.io/apimachinery/pkg/util/validation"
 
 	"github.com/stakater/Reloader/internal/pkg/workload"
 )
@@ -97,6 +98,19 @@ func (c *Config) Validate() error {
 		)
 	}
 
+	// Watched namespaces must be valid DNS-1123 labels; an invalid entry would
+	// otherwise fail deep inside the controller-runtime cache with an opaque error.
+	for _, ns := range c.WatchedNamespaces {
+		if msgs := apivalidation.IsDNS1123Label(ns); len(msgs) > 0 {
+			errs = append(
+				errs, ValidationError{
+					Field:   "WatchedNamespaces",
+					Message: fmt.Sprintf("invalid namespace %q: %s", ns, strings.Join(msgs, "; ")),
+				},
+			)
+		}
+	}
+
 	c.IgnoredResources = normalizeToLower(c.IgnoredResources)
 
 	// Normalize ignored workloads to canonical Kind values (e.g., "cronjobs" -> "CronJob")

internal/pkg/config/validation_test.go

@@ -194,6 +194,40 @@ func TestConfig_Validate_InvalidIgnoredWorkload(t *testing.T) {
 	}
 }
 
+func TestConfig_Validate_WatchedNamespaces(t *testing.T) {
+	tests := []struct {
+		name       string
+		namespaces []string
+		wantErr    bool
+	}{
+		{"nil is valid (global mode)", nil, false},
+		{"empty is valid (global mode)", []string{}, false},
+		{"single valid label", []string{"team-a"}, false},
+		{"multiple valid labels", []string{"team-a", "team-b", "kube-system"}, false},
+		{"uppercase is invalid", []string{"Team-A"}, true},
+		{"underscore is invalid", []string{"team_a"}, true},
+		{"trailing dash is invalid", []string{"team-"}, true},
+		{"one invalid among valid", []string{"team-a", "Bad_NS!"}, true},
+	}
+
+	for _, tt := range tests {
+		t.Run(
+			tt.name, func(t *testing.T) {
+				cfg := NewDefault()
+				cfg.WatchedNamespaces = tt.namespaces
+
+				err := cfg.Validate()
+				if (err != nil) != tt.wantErr {
+					t.Fatalf("Validate() error = %v, wantErr %v", err, tt.wantErr)
+				}
+				if tt.wantErr && !strings.Contains(err.Error(), "WatchedNamespaces") {
+					t.Errorf("error should mention WatchedNamespaces, got: %v", err)
+				}
+			},
+		)
+	}
+}
+
 func TestConfig_Validate_MultipleErrors(t *testing.T) {
 	cfg := NewDefault()
 	cfg.ReloadStrategy = "invalid"