added support for multiple watch namespaces

deployments/kubernetes/chart/reloader/templates/_helpers.tpl

@@ -89,13 +89,12 @@ Create the namespace selector if it does not watch globally
 {{- end -}}
 
 {{/*
-Effective set of namespaces to watch in scoped mode: the release namespace
-(always included so the meta-info ConfigMap, HA leases and events keep working)
-plus the user-supplied reloader.namespaces, deduped and sorted.
+Namespaces to watch in scoped mode: exactly the user-supplied reloader.namespaces,
+trimmed, de-duped and sorted. The release namespace is intentionally NOT added here
+— Reloader watches only what the user asked for (an empty result means global mode).
 Returns a JSON-encoded list; consumers use mustFromJson to iterate.
 */}}
 {{- define "reloader-watchNamespaces" -}}
-{{- $relNs := .Values.namespace | default .Release.Namespace -}}
 {{- $ns := .Values.reloader.namespaces | default list -}}
 {{- if kindIs "string" $ns -}}
 {{- $ns = splitList "," $ns -}}
@@ -107,8 +106,7 @@ Returns a JSON-encoded list; consumers use mustFromJson to iterate.
 {{- $clean = append $clean $t -}}
 {{- end -}}
 {{- end -}}
-{{- $all := concat (list $relNs) $clean | uniq | sortAlpha -}}
-{{- $all | toJson -}}
+{{- $clean | uniq | sortAlpha | toJson -}}
 {{- end -}}
 
 {{/*
@@ -118,6 +116,18 @@ Comma-joined form of reloader-watchNamespaces, for the --namespaces CLI flag.
 {{- include "reloader-watchNamespaces" . | mustFromJson | join "," -}}
 {{- end -}}
 
+{{/*
+Namespaces that need namespaced RBAC in scoped mode: the watched namespaces plus
+the release namespace, so leader-election leases, the meta-info ConfigMap and
+events keep working there even though it is not watched for reloads.
+Returns a JSON-encoded list; consumers use mustFromJson to iterate.
+*/}}
+{{- define "reloader-rbacNamespaces" -}}
+{{- $relNs := .Values.namespace | default .Release.Namespace -}}
+{{- $watch := include "reloader-watchNamespaces" . | mustFromJson -}}
+{{- concat (list $relNs) $watch | uniq | sortAlpha | toJson -}}
+{{- end -}}
+
 {{/*
 The namespaced RBAC rules granted to Reloader in every watched namespace.
 Shared between the single-namespace Role and the per-namespace scoped Roles so

deployments/kubernetes/chart/reloader/templates/clusterrole.yaml

@@ -56,7 +56,6 @@ rules:
 {{- if and (.Capabilities.APIVersions.Has "argoproj.io/v1alpha1") (.Values.reloader.isArgoRollouts) }}
   - apiGroups:
       - "argoproj.io"
-      - ""
     resources:
       - rollouts
     verbs:

deployments/kubernetes/chart/reloader/templates/deployment.yaml

@@ -241,7 +241,7 @@ spec:
           - "--namespaces-to-ignore={{ .Values.reloader.ignoreNamespaces }}"
           {{- end }}
           {{- if (include "reloader-namespaceSelector" .) }}
-          - "--namespace-selector=\"{{ include "reloader-namespaceSelector" . }}\""
+          - "--namespace-selector={{ include "reloader-namespaceSelector" . }}"
           {{- end }}
           {{- if .Values.reloader.resourceLabelSelector }}
           - "--resource-label-selector={{ .Values.reloader.resourceLabelSelector }}"
@@ -275,6 +275,26 @@ spec:
             {{- if .Values.reloader.custom_annotations.configmap_auto }}
           - "--configmap-auto-annotation"
           - "{{ .Values.reloader.custom_annotations.configmap_auto }}"
+            {{- end }}
+            {{- if .Values.reloader.custom_annotations.configmap_exclude }}
+          - "--configmap-exclude-annotation"
+          - "{{ .Values.reloader.custom_annotations.configmap_exclude }}"
+            {{- end }}
+            {{- if .Values.reloader.custom_annotations.secret_exclude }}
+          - "--secret-exclude-annotation"
+          - "{{ .Values.reloader.custom_annotations.secret_exclude }}"
+            {{- end }}
+            {{- if .Values.reloader.custom_annotations.secretproviderclass }}
+          - "--secretproviderclass-annotation"
+          - "{{ .Values.reloader.custom_annotations.secretproviderclass }}"
+            {{- end }}
+            {{- if .Values.reloader.custom_annotations.secretproviderclass_auto }}
+          - "--secretproviderclass-auto-annotation"
+          - "{{ .Values.reloader.custom_annotations.secretproviderclass_auto }}"
+            {{- end }}
+            {{- if .Values.reloader.custom_annotations.secretproviderclass_exclude }}
+          - "--secretproviderclass-exclude-annotation"
+          - "{{ .Values.reloader.custom_annotations.secretproviderclass_exclude }}"
             {{- end }}
             {{- if .Values.reloader.custom_annotations.search }}
           - "--auto-search-annotation"

deployments/kubernetes/chart/reloader/templates/role.yaml

@@ -7,7 +7,7 @@
 {{- $apiVersion = "rbac.authorization.k8s.io/v1beta1" }}
 {{- end }}
 {{- if .Values.reloader.namespaces }}
-{{- range $ns := (include "reloader-watchNamespaces" . | mustFromJson) }}
+{{- range $ns := (include "reloader-rbacNamespaces" . | mustFromJson) }}
 apiVersion: {{ $apiVersion }}
 kind: Role
 metadata:

deployments/kubernetes/chart/reloader/templates/rolebinding.yaml

@@ -4,7 +4,7 @@
 {{- $apiVersion = "rbac.authorization.k8s.io/v1beta1" }}
 {{- end }}
 {{- if .Values.reloader.namespaces }}
-{{- range $ns := (include "reloader-watchNamespaces" . | mustFromJson) }}
+{{- range $ns := (include "reloader-rbacNamespaces" . | mustFromJson) }}
 apiVersion: {{ $apiVersion }}
 kind: RoleBinding
 metadata:

deployments/kubernetes/chart/reloader/values.yaml

@@ -223,6 +223,11 @@ reloader:
   #   custom_annotations:
   #     configmap: "my.company.com/configmap"
   #     secret: "my.company.com/secret"
+  #     configmap_exclude: "my.company.com/configmap-exclude"
+  #     secret_exclude: "my.company.com/secret-exclude"
+  #     secretproviderclass: "my.company.com/secretproviderclass"
+  #     secretproviderclass_auto: "my.company.com/secretproviderclass-auto"
+  #     secretproviderclass_exclude: "my.company.com/secretproviderclass-exclude"
   #     ignore: "my.company.com/reloader-ignore"
   custom_annotations: {}