Merge pull request #430 from ctrought/feat-enhancelabelselectors

feat: Configmap/secret label selector & refactor namespace selector

README.md

@@ -144,6 +144,7 @@ spec:
 - you may override the secret annotation with the `--secret-annotation` flag
 - you may want to prevent watching certain namespaces with the `--namespaces-to-ignore` flag
 - you may want to watch only a set of namespaces with certain labels by using the `--namespace-selector` flag
+- you may want to watch only a set of secrets/configmaps with certain labels by using the `--resource-label-selector` flag
 - you may want to prevent watching certain resources with the `--resources-to-ignore` flag
 - you can configure logging in JSON format with the `--log-format=json` option
 - you can configure the "reload strategy" with the `--reload-strategy=<strategy-name>` option (details below)
@@ -181,26 +182,52 @@ Reloader can be configured to ignore the resources `secrets` and `configmaps` by
 | --resources-to-ignore=configMaps | To ignore configMaps |
 | --resources-to-ignore=secrets    | To ignore secrets    |
 
-`Note`: At one time only one of these resource can be ignored, trying to do it will cause error in Reloader. Workaround for ignoring both resources is by scaling down the reloader pods to `0`.
+**Note:** At one time only one of these resource can be ignored, trying to do it will cause error in Reloader. Workaround for ignoring both resources is by scaling down the reloader pods to `0`.
+
+Reloader can be configured to only watch secrets/configmaps with one or more labels using the `--resource-label-selector` parameter. Supported operators are `!, in, notin, ==, =, !=`, if no operator is found the 'exists' operator is inferred (ie. key only). Additional examples of these selectors can be found in the [Kubernetes Docs](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors). 
+
+**Note:** The old `:` delimited key value mappings are deprecated and if provided will be translated to `key=value`. Likewise, if a wildcard value is provided (e.g. `key:*`) it will be translated to the standalone `key` which checks for key existence.
+
+These selectors can be combined together, for example with:
 
-Reloader can be configured to watch only namespaces labeled with (one or more) labels of your choosing by using the `--namespace-selector` parameter, for example:
 ```
---namespace-selector=reloder:enabled,test:true
+--resource-label-selector=reloader=enabled,key-exists,another-label in (value1,value2,value3)
 ```
 
-Only namespaces labeled like the following namespace YAML will be watched:
+Only configmaps or secrets labeled like the following will be watched:
+```yaml
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  ...
+  labels:
+    reloader: enabled
+    key-exists: yes
+    another-label: value1
+
+  ...
+```
+
+Reloader can be configured to only watch namespaces labeled with one or more labels using the `--namespace-selector` parameter. Supported operators are `!, in, notin, ==, =, !=`, if no operator is found the 'exists' operator is inferred (ie. key only). Additional examples of these selectors can be found in the (Kubernetes Docs)[https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors]. 
+
+**Note:** The old `:` delimited key value mappings are deprecated and if provided will be translated to `key=value`. Likewise, if a wildcard value is provided (e.g. `key:*`) it will be translated to the standalone `key` which checks for key existence.
+
+These selectors can be combined together, for example with:
+```
+--namespace-selector=reloader=enabled,test=true
+```
+
+Only namespaces labeled as below would be watched and eligible for reloads:
 ```yaml
 kind: Namespace
 apiVersion: v1
 metadata:
   ...
   labels:
-    reloder: enabled
+    reloader: enabled
     test: true
   ...
 ```
-If you want to select namespace only by the key of the label use ```*``` as the value.
-For example, for ```--namespace-selector=select-this:*``` all namespaces with label-key "select-this" will be selected regardless of the labels value
 
 ### Vanilla kustomize
 
@@ -251,13 +278,21 @@ Reloader can be configured to ignore the resources `secrets` and `configmaps` by
 | ignoreSecrets    | To ignore secrets. Valid value are either `true` or `false`    | boolean |
 | ignoreConfigMaps | To ignore configMaps. Valid value are either `true` or `false` | boolean |
 
-`Note`: At one time only one of these resource can be ignored, trying to do it will cause error in helm template compilation.
+**Note:** At one time only one of these resource can be ignored, trying to do it will cause error in helm template compilation.
 
-Reloader can be configured to watch only namespaces labeled with (one or more) labels of your choosing by using the `namespaceSelector` parameter
+Reloader can be configured to only watch namespaces labeled with one or more labels using the `namespaceSelector` parameter
 
-| Parameter            | Description                                                    | Type    |
-| ----------------     | -------------------------------------------------------------- | ------- |
-| namespaceSelector    | list of comma separated key:value namespace                    | string  |
+| Parameter            | Description                                                                        | Type    |
+| ----------------     | ---------------------------------------------------------------------------------- | ------- |
+| namespaceSelector    | list of comma separated label selectors, if mulitple are provided they are ANDed   | string  |
+
+Reloader can be configured to only watch configmaps/secrets labeled with one or more labels using the `resourceLabelSelector` parameter
+
+| Parameter              | Description                                                                        | Type    |
+| ---------------------- | ---------------------------------------------------------------------------------- | ------- |
+| resourceLabelSelector  | list of comma separated label selectors, if mulitple are provided they are ANDed   | string  |
+
+**Note:** Both `namespaceSelector` & `resourceLabelSelector` can be used together. If they are then both conditions must be met for the configmap or secret to be eligible to trigger reload events. (e.g. If a configMap matches `resourceLabelSelector` but `namespaceSelector` does not match the namespace the configmap is in, it will be ignored)
 
 You can also set the log format of Reloader to json by setting `logFormat` to `json` in values.yaml and apply the chart
 
@@ -318,7 +353,7 @@ PRs are welcome. In general, we follow the "fork-and-pull" Git workflow.
 4.  **Push** your work back up to your fork
 5.  Submit a **Pull request** so that we can review your changes
 
-NOTE: Be sure to merge the latest from "upstream" before making a pull request!
+**NOTE:** Be sure to merge the latest from "upstream" before making a pull request!
 
 ## Changelog
 

deployments/kubernetes/chart/reloader/templates/clusterrole.yaml

@@ -38,6 +38,8 @@ rules:
       - namespaces
     verbs:
       - get
+      - list
+      - watch
 {{- end }}
 {{- if and (.Capabilities.APIVersions.Has "apps.openshift.io/v1") (.Values.reloader.isOpenshift) }}
   - apiGroups:

deployments/kubernetes/chart/reloader/templates/deployment.yaml

@@ -165,7 +165,7 @@ spec:
           - mountPath: /tmp/
             name: tmp-volume
       {{- end }}
-      {{- if or (.Values.reloader.logFormat) (.Values.reloader.ignoreSecrets) (.Values.reloader.ignoreNamespaces) (.Values.reloader.namespaceSelector) (.Values.reloader.ignoreConfigMaps) (.Values.reloader.custom_annotations) (eq .Values.reloader.isArgoRollouts true) (eq .Values.reloader.reloadOnCreate true) (ne .Values.reloader.reloadStrategy "default") (.Values.reloader.enableHA)}}
+      {{- if or (.Values.reloader.logFormat) (.Values.reloader.ignoreSecrets) (.Values.reloader.ignoreNamespaces) (.Values.reloader.namespaceSelector) (.Values.reloader.resourceLabelSelector) (.Values.reloader.ignoreConfigMaps) (.Values.reloader.custom_annotations) (eq .Values.reloader.isArgoRollouts true) (eq .Values.reloader.reloadOnCreate true) (ne .Values.reloader.reloadStrategy "default") (.Values.reloader.enableHA)}}
         args:
           {{- if .Values.reloader.logFormat }}
           - "--log-format={{ .Values.reloader.logFormat }}"
@@ -181,7 +181,10 @@ spec:
           {{- end }}
           {{- if .Values.reloader.namespaceSelector }}
           - "--namespace-selector={{ .Values.reloader.namespaceSelector }}"
-          {{- end }}          
+          {{- end }}    
+          {{- if .Values.reloader.resourceLabelSelector }}
+          - "--resource-label-selector={{ .Values.reloader.resourceLabelSelector }}"
+          {{- end }}             
           {{- if .Values.reloader.custom_annotations }}
             {{- if .Values.reloader.custom_annotations.configmap }}
           - "--configmap-annotation"

deployments/kubernetes/chart/reloader/values.yaml

@@ -20,7 +20,8 @@ reloader:
   syncAfterRestart: false
   reloadStrategy: default # Set to default, env-vars or annotations
   ignoreNamespaces: "" # Comma separated list of namespaces to ignore
-  namespaceSelector: "" # Comma separated list of 'key:value' labels for namespaces selection
+  namespaceSelector: "" # Comma separated list of k8s label selectors for namespaces selection
+  resourceLabelSelector: "" # Comma separated list of k8s label selectors for configmap/secret selection
   logFormat: "" #json
   watchGlobally: true
   # Set to true to enable leadership election allowing you to run multiple replicas

internal/pkg/cmd/reloader.go

@@ -19,6 +19,7 @@ import (
 	"github.com/stakater/Reloader/internal/pkg/util"
 	"github.com/stakater/Reloader/pkg/kube"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
 )
 
 // NewReloaderCommand starts the reloader controller
@@ -39,7 +40,8 @@ func NewReloaderCommand() *cobra.Command {
 	cmd.PersistentFlags().StringVar(&options.LogFormat, "log-format", "", "Log format to use (empty string for text, or JSON")
 	cmd.PersistentFlags().StringSlice("resources-to-ignore", []string{}, "list of resources to ignore (valid options 'configMaps' or 'secrets')")
 	cmd.PersistentFlags().StringSlice("namespaces-to-ignore", []string{}, "list of namespaces to ignore")
-	cmd.PersistentFlags().StringSlice("namespace-selector", []string{}, "list of key:vaule namespace labels to include")
+	cmd.PersistentFlags().StringSlice("namespace-selector", []string{}, "list of key:value labels to filter on for namespaces")
+	cmd.PersistentFlags().StringSlice("resource-label-selector", []string{}, "list of key:value labels to filter on for configmaps and secrets")
 	cmd.PersistentFlags().StringVar(&options.IsArgoRollouts, "is-Argo-Rollouts", "false", "Add support for argo rollouts")
 	cmd.PersistentFlags().StringVar(&options.ReloadStrategy, constants.ReloadStrategyFlag, constants.EnvVarsReloadStrategy, "Specifies the desired reload strategy")
 	cmd.PersistentFlags().StringVar(&options.ReloadOnCreate, "reload-on-create", "false", "Add support to watch create events")
@@ -140,19 +142,28 @@ func startReloader(cmd *cobra.Command, args []string) {
 		logrus.Fatal(err)
 	}
 
+	resourceLabelSelector, err := getResourceLabelSelector(cmd)
+	if err != nil {
+		logrus.Fatal(err)
+	}
+
 	if len(namespaceLabelSelector) > 0 {
-		logrus.Warnf("namespace-selector is set, will detect changes in namespaces with these labels: %s.", namespaceLabelSelector)
+		logrus.Warnf("namespace-selector is set, will only detect changes in namespaces with these labels: %s.", namespaceLabelSelector)
+	}
+
+	if len(resourceLabelSelector) > 0 {
+		logrus.Warnf("resource-label-selector is set, will only detect changes on resources with these labels: %s.", resourceLabelSelector)
 	}
 
 	collectors := metrics.SetupPrometheusEndpoint()
 
 	var controllers []*controller.Controller
 	for k := range kube.ResourceMap {
-		if ignoredResourcesList.Contains(k) {
+		if ignoredResourcesList.Contains(k) || (len(namespaceLabelSelector) == 0 && k == "namespaces") {
 			continue
 		}
 
-		c, err := controller.NewController(clientset, k, currentNamespace, ignoredNamespacesList, namespaceLabelSelector, collectors)
+		c, err := controller.NewController(clientset, k, currentNamespace, ignoredNamespacesList, namespaceLabelSelector, resourceLabelSelector, collectors)
 		if err != nil {
 			logrus.Fatalf("%s", err)
 		}
@@ -187,19 +198,72 @@ func getIgnoredNamespacesList(cmd *cobra.Command) (util.List, error) {
 	return getStringSliceFromFlags(cmd, "namespaces-to-ignore")
 }
 
-func getNamespaceLabelSelector(cmd *cobra.Command) (util.Map, error) {
+func getNamespaceLabelSelector(cmd *cobra.Command) (string, error) {
 	slice, err := getStringSliceFromFlags(cmd, "namespace-selector")
 	if err != nil {
 		logrus.Fatal(err)
 	}
 
-	var namespaceSelectorMap util.Map = make(util.Map)
-	for _, kv := range slice {
-		split := strings.Split(kv, ":")
-		namespaceSelectorMap[split[0]] = split[1]
+	for i, kv := range slice {
+		// Legacy support for ":" as a delimiter and "*" for wildcard.
+		if strings.Contains(kv, ":") {
+			split := strings.Split(kv, ":")
+			if split[1] == "*" {
+				slice[i] = split[0]
+			} else {
+				slice[i] = split[0] + "=" + split[1]
+			}
+		}
+		// Convert wildcard to valid apimachinery operator
+		if strings.Contains(kv, "=") {
+			split := strings.Split(kv, "=")
+			if split[1] == "*" {
+				slice[i] = split[0]
+			}
+		}
 	}
 
-	return namespaceSelectorMap, nil
+	namespaceLabelSelector := strings.Join(slice[:], ",")
+	_, err = labels.Parse(namespaceLabelSelector)
+	if err != nil {
+		logrus.Fatal(err)
+	}
+
+	return namespaceLabelSelector, nil
+}
+
+func getResourceLabelSelector(cmd *cobra.Command) (string, error) {
+	slice, err := getStringSliceFromFlags(cmd, "resource-label-selector")
+	if err != nil {
+		logrus.Fatal(err)
+	}
+
+	for i, kv := range slice {
+		// Legacy support for ":" as a delimiter and "*" for wildcard.
+		if strings.Contains(kv, ":") {
+			split := strings.Split(kv, ":")
+			if split[1] == "*" {
+				slice[i] = split[0]
+			} else {
+				slice[i] = split[0] + "=" + split[1]
+			}
+		}
+		// Convert wildcard to valid apimachinery operator
+		if strings.Contains(kv, "=") {
+			split := strings.Split(kv, "=")
+			if split[1] == "*" {
+				slice[i] = split[0]
+			}
+		}
+	}
+
+	resourceLabelSelector := strings.Join(slice[:], ",")
+	_, err = labels.Parse(resourceLabelSelector)
+	if err != nil {
+		logrus.Fatal(err)
+	}
+
+	return resourceLabelSelector, nil
 }
 
 func getStringSliceFromFlags(cmd *cobra.Command, flag string) ([]string, error) {

internal/pkg/controller/controller.go

@@ -1,7 +1,6 @@
 package controller
 
 import (
-	"context"
 	"fmt"
 	"time"
 
@@ -22,6 +21,7 @@ import (
 	"k8s.io/client-go/tools/record"
 	"k8s.io/client-go/util/workqueue"
 	"k8s.io/kubectl/pkg/scheme"
+	"k8s.io/utils/strings/slices"
 )
 
 // Controller for checking events
@@ -35,16 +35,18 @@ type Controller struct {
 	ignoredNamespaces util.List
 	collectors        metrics.Collectors
 	recorder          record.EventRecorder
-	namespaceSelector map[string]string
+	namespaceSelector string
+	resourceSelector  string
 }
 
 // controllerInitialized flag determines whether controlled is being initialized
 var secretControllerInitialized bool = false
 var configmapControllerInitialized bool = false
+var selectedNamespacesCache []string
 
 // NewController for initializing a Controller
 func NewController(
-	client kubernetes.Interface, resource string, namespace string, ignoredNamespaces []string, namespaceLabelSelector map[string]string, collectors metrics.Collectors) (*Controller, error) {
+	client kubernetes.Interface, resource string, namespace string, ignoredNamespaces []string, namespaceLabelSelector string, resourceLabelSelector string, collectors metrics.Collectors) (*Controller, error) {
 
 	if options.SyncAfterRestart {
 		secretControllerInitialized = true
@@ -56,6 +58,7 @@ func NewController(
 		namespace:         namespace,
 		ignoredNamespaces: ignoredNamespaces,
 		namespaceSelector: namespaceLabelSelector,
+		resourceSelector:  resourceLabelSelector,
 		resource:          resource,
 	}
 	eventBroadcaster := record.NewBroadcaster()
@@ -65,7 +68,18 @@ func NewController(
 	recorder := eventBroadcaster.NewRecorder(scheme.Scheme, v1.EventSource{Component: fmt.Sprintf("reloader-%s", resource)})
 
 	queue := workqueue.NewRateLimitingQueue(workqueue.DefaultControllerRateLimiter())
-	listWatcher := cache.NewListWatchFromClient(client.CoreV1().RESTClient(), resource, namespace, fields.Everything())
+
+	optionsModifier := func(options *metav1.ListOptions) {
+		if resource == "namespaces" {
+			options.LabelSelector = c.namespaceSelector
+		} else if len(c.resourceSelector) > 0 {
+			options.LabelSelector = c.resourceSelector
+		} else {
+			options.FieldSelector = fields.Everything().String()
+		}
+	}
+
+	listWatcher := cache.NewFilteredListWatchFromClient(client.CoreV1().RESTClient(), resource, namespace, optionsModifier)
 
 	indexer, informer := cache.NewIndexerInformer(listWatcher, kube.ResourceMap[resource], 0, cache.ResourceEventHandlerFuncs{
 		AddFunc:    c.Add,
@@ -84,8 +98,15 @@ func NewController(
 
 // Add function to add a new object to the queue in case of creating a resource
 func (c *Controller) Add(obj interface{}) {
+
+	switch object := obj.(type) {
+	case *v1.Namespace:
+		c.addSelectedNamespaceToCache(*object)
+		return
+	}
+
 	if options.ReloadOnCreate == "true" {
-		if !c.resourceInIgnoredNamespace(obj) && c.resourceInNamespaceSelector(obj) && secretControllerInitialized && configmapControllerInitialized {
+		if !c.resourceInIgnoredNamespace(obj) && c.resourceInSelectedNamespaces(obj) && secretControllerInitialized && configmapControllerInitialized {
 			c.queue.Add(handler.ResourceCreatedHandler{
 				Resource:   obj,
 				Collectors: c.collectors,
@@ -105,45 +126,47 @@ func (c *Controller) resourceInIgnoredNamespace(raw interface{}) bool {
 	return false
 }
 
-func (c *Controller) resourceInNamespaceSelector(raw interface{}) bool {
+func (c *Controller) resourceInSelectedNamespaces(raw interface{}) bool {
 	if len(c.namespaceSelector) == 0 {
 		return true
 	}
 
 	switch object := raw.(type) {
 	case *v1.ConfigMap:
-		return c.matchLabels(object.ObjectMeta.Namespace)
+		if slices.Contains(selectedNamespacesCache, object.GetNamespace()) {
+			return true
+		}
 	case *v1.Secret:
-		return c.matchLabels(object.ObjectMeta.Namespace)
+		if slices.Contains(selectedNamespacesCache, object.GetNamespace()) {
+			return true
+		}
 	}
-	return true
+	return false
 }
 
-func (c *Controller) matchLabels(resourceNamespace string) bool {
-	namespace, err := c.client.CoreV1().Namespaces().Get(context.Background(), resourceNamespace, metav1.GetOptions{})
-	if err != nil {
-		logrus.Warn(err)
-		return false
-	}
+func (c *Controller) addSelectedNamespaceToCache(namespace v1.Namespace) {
+	selectedNamespacesCache = append(selectedNamespacesCache, namespace.GetName())
+	logrus.Infof("added namespace to be watched: %s", namespace.GetName())
+}
 
-	for selectorKey, selectorVal := range c.namespaceSelector {
-
-		namespaceLabelVal, namespaceLabelKeyExists := namespace.ObjectMeta.Labels[selectorKey]
-
-		if namespaceLabelKeyExists && selectorVal == "*" {
-			continue
-		}
-
-		if !namespaceLabelKeyExists || selectorVal != namespaceLabelVal {
-			return false
+func (c *Controller) removeSelectedNamespaceFromCache(namespace v1.Namespace) {
+	for i, v := range selectedNamespacesCache {
+		if v == namespace.GetName() {
+			selectedNamespacesCache = append(selectedNamespacesCache[:i], selectedNamespacesCache[i+1:]...)
+			logrus.Infof("removed namespace from watch: %s", namespace.GetName())
+			return
 		}
 	}
-	return true
 }
 
 // Update function to add an old object and a new object to the queue in case of updating a resource
 func (c *Controller) Update(old interface{}, new interface{}) {
-	if !c.resourceInIgnoredNamespace(new) && c.resourceInNamespaceSelector(new) {
+	switch new.(type) {
+	case *v1.Namespace:
+		return
+	}
+
+	if !c.resourceInIgnoredNamespace(new) && c.resourceInSelectedNamespaces(new) {
 		c.queue.Add(handler.ResourceUpdatedHandler{
 			Resource:    new,
 			OldResource: old,
@@ -155,6 +178,12 @@ func (c *Controller) Update(old interface{}, new interface{}) {
 
 // Delete function to add an object to the queue in case of deleting a resource
 func (c *Controller) Delete(old interface{}) {
+	switch object := old.(type) {
+	case *v1.Namespace:
+		c.removeSelectedNamespaceFromCache(*object)
+		return
+	}
+
 	// Todo: Any future delete event can be handled here
 }
 

internal/pkg/controller/controller_test.go

@@ -45,7 +45,10 @@ func TestMain(m *testing.M) {
 
 	logrus.Infof("Creating controller")
 	for k := range kube.ResourceMap {
-		c, err := NewController(clients.KubernetesClient, k, namespace, []string{}, map[string]string{}, collectors)
+		if k == "namespaces" {
+			continue
+		}
+		c, err := NewController(clients.KubernetesClient, k, namespace, []string{}, "", "", collectors)
 		if err != nil {
 			logrus.Fatalf("%s", err)
 		}
@@ -2291,7 +2294,7 @@ func TestController_resourceInNamespaceSelector(t *testing.T) {
 		queue             workqueue.RateLimitingInterface
 		informer          cache.Controller
 		namespace         v1.Namespace
-		namespaceSelector util.Map
+		namespaceSelector string
 	}
 	type args struct {
 		raw interface{}
@@ -2305,10 +2308,7 @@ func TestController_resourceInNamespaceSelector(t *testing.T) {
 		{
 			name: "TestConfigMapResourceInNamespaceSelector",
 			fields: fields{
-				namespaceSelector: util.Map{
-					"select":  "this",
-					"select2": "this2",
-				},
+				namespaceSelector: "select=this,select2=this2",
 				namespace: v1.Namespace{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "selected-namespace",
@@ -2326,10 +2326,7 @@ func TestController_resourceInNamespaceSelector(t *testing.T) {
 		}, {
 			name: "TestConfigMapResourceNotInNamespaceSelector",
 			fields: fields{
-				namespaceSelector: util.Map{
-					"select":  "this",
-					"select2": "this2",
-				},
+				namespaceSelector: "select=this,select2=this2",
 				namespace: v1.Namespace{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:   "not-selected-namespace",
@@ -2345,10 +2342,7 @@ func TestController_resourceInNamespaceSelector(t *testing.T) {
 		{
 			name: "TestSecretResourceInNamespaceSelector",
 			fields: fields{
-				namespaceSelector: util.Map{
-					"select":  "this",
-					"select2": "this2",
-				},
+				namespaceSelector: "select=this,select2=this2",
 				namespace: v1.Namespace{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "selected-namespace",
@@ -2366,10 +2360,7 @@ func TestController_resourceInNamespaceSelector(t *testing.T) {
 		}, {
 			name: "TestSecretResourceNotInNamespaceSelector",
 			fields: fields{
-				namespaceSelector: util.Map{
-					"select":  "this",
-					"select2": "this2",
-				},
+				namespaceSelector: "select=this,select2=this2",
 				namespace: v1.Namespace{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:   "not-selected-namespace",
@@ -2382,11 +2373,9 @@ func TestController_resourceInNamespaceSelector(t *testing.T) {
 			},
 			want: false,
 		}, {
-			name: "TestSecretResourceInNamespaceSelectorWiledcardValue",
+			name: "TestSecretResourceInNamespaceSelectorKeyExists",
 			fields: fields{
-				namespaceSelector: util.Map{
-					"select": "*",
-				},
+				namespaceSelector: "select",
 				namespace: v1.Namespace{
 					ObjectMeta: metav1.ObjectMeta{
 						Name: "selected-namespace",
@@ -2400,6 +2389,59 @@ func TestController_resourceInNamespaceSelector(t *testing.T) {
 				raw: testutil.GetSecret("selected-namespace", "secret", "test"),
 			},
 			want: true,
+		}, {
+			name: "TestSecretResourceInNamespaceSelectorValueIn",
+			fields: fields{
+				namespaceSelector: "select in (select1, select2, select3)",
+				namespace: v1.Namespace{
+					ObjectMeta: metav1.ObjectMeta{
+						Name: "selected-namespace",
+						Labels: map[string]string{
+							"select": "select2",
+						},
+					},
+				},
+			},
+			args: args{
+				raw: testutil.GetSecret("selected-namespace", "secret", "test"),
+			},
+			want: true,
+		}, {
+			name: "TestSecretResourceInNamespaceSelectorKeyDoesNotExist",
+			fields: fields{
+				namespaceSelector: "!select2",
+				namespace: v1.Namespace{
+					ObjectMeta: metav1.ObjectMeta{
+						Name: "selected-namespace",
+						Labels: map[string]string{
+							"select": "this",
+						},
+					},
+				},
+			},
+			args: args{
+				raw: testutil.GetSecret("selected-namespace", "secret", "test"),
+			},
+			want: true,
+		}, {
+			name: "TestSecretResourceInNamespaceSelectorMultipleConditions",
+			fields: fields{
+				namespaceSelector: "select,select2=this2,select3!=this4",
+				namespace: v1.Namespace{
+					ObjectMeta: metav1.ObjectMeta{
+						Name: "selected-namespace",
+						Labels: map[string]string{
+							"select":  "this",
+							"select2": "this2",
+							"select3": "this3",
+						},
+					},
+				},
+			},
+			args: args{
+				raw: testutil.GetSecret("selected-namespace", "secret", "test"),
+			},
+			want: true,
 		},
 	}
 
@@ -2418,9 +2460,21 @@ func TestController_resourceInNamespaceSelector(t *testing.T) {
 				namespaceSelector: tt.fields.namespaceSelector,
 			}
 
-			if got := c.resourceInNamespaceSelector(tt.args.raw); got != tt.want {
+			listOptions := metav1.ListOptions{}
+			listOptions.LabelSelector = tt.fields.namespaceSelector
+			namespaces, _ := fakeClient.CoreV1().Namespaces().List(context.Background(), listOptions)
+
+			for _, ns := range namespaces.Items {
+				c.addSelectedNamespaceToCache(ns)
+			}
+
+			if got := c.resourceInSelectedNamespaces(tt.args.raw); got != tt.want {
 				t.Errorf("Controller.resourceInNamespaceSelector() = %v, want %v", got, tt.want)
 			}
+
+			for _, ns := range namespaces.Items {
+				c.removeSelectedNamespaceFromCache(ns)
+			}
 		})
 	}
 }

internal/pkg/leadership/leadership_test.go

@@ -119,7 +119,7 @@ func TestRunLeaderElectionWithControllers(t *testing.T) {
 	t.Logf("Creating controller")
 	var controllers []*controller.Controller
 	for k := range kube.ResourceMap {
-		c, err := controller.NewController(testutil.Clients.KubernetesClient, k, testutil.Namespace, []string{}, map[string]string{}, metrics.NewCollectors())
+		c, err := controller.NewController(testutil.Clients.KubernetesClient, k, testutil.Namespace, []string{}, "", "", metrics.NewCollectors())
 		if err != nil {
 			logrus.Fatalf("%s", err)
 		}

pkg/kube/resourcemapper.go

@@ -9,4 +9,5 @@ import (
 var ResourceMap = map[string]runtime.Object{
 	"configMaps": &v1.ConfigMap{},
 	"secrets":    &v1.Secret{},
+	"namespaces":    &v1.Namespace{},
 }