The helper only emits namespaceSelector when watchGlobally is true
(matches values.yaml and the chart README). The old comment said the
opposite and made the condition look inverted.
Fixes#1188
Signed-off-by: Dean Chen <862469039@qq.com>
Add a third RBAC posture between watch-globally (ClusterRole) and single
namespace: give Reloader an explicit list of namespaces to watch. The chart
creates a namespace-scoped Role + RoleBinding in each listed namespace (no
ClusterRole), and one install covers them all.
Go:
- new --namespaces flag / options.Namespaces
- resolveWatchNamespaces() picks list -> KUBERNETES_NAMESPACE -> all
- controller creation loops over the watched namespaces
- namespaces-to-ignore is now only honored in global mode (watchGlobally=true);
in single-namespace and scoped modes the watched set is already explicit
Helm:
- new reloader.namespaces value (active when watchGlobally=false); accepts either
a YAML list or a comma-separated string for consistency with the sibling
namespace options
- reloader-watchNamespaces helper (release ns always auto-included, deduped)
- shared reloader-namespaced-rules template reused per namespace
- role.yaml/rolebinding.yaml range over the list; deployment passes --namespaces
- --namespaces-to-ignore only rendered when watchGlobally=true
- fail guard for watchGlobally=true + namespaces set
Tests: unit test for resolveWatchNamespaces; scoped-namespaces e2e case.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Allow users to customise the annotation key used to mark ConfigMaps and
Secrets as ignored by Reloader, consistent with how every other annotation
key is already overridable via a dedicated CLI flag.
Changes:
- internal/pkg/util/util.go: register --ignore-annotation persistent flag
backed by options.IgnoreResourceAnnotation
- deployments/kubernetes/chart/reloader/templates/deployment.yaml: pass
--ignore-annotation when custom_annotations.ignore is set in Helm values
- deployments/kubernetes/chart/reloader/values.yaml: document the new
custom_annotations.ignore key in the example comment
- README.md: add --ignore-annotation to the Annotation Key Overrides table
and mention the flag alongside the Resource-Level Ignore Annotation section
Co-authored-by: Cursor <cursoragent@cursor.com>
PR #1061 renamed the configmap key in kube.ResourceMap from "configMaps"
(camelCase) to "configmaps" (lowercase) to fix controllers not being
able to mark themselves as initialized. However, two callers were not
updated to match the new canonical key:
1. The Helm chart's deployment template still emits
`--resources-to-ignore=configMaps` (camelCase) when
`reloader.ignoreConfigMaps: true` is set.
2. The validation in `GetIgnoredResourcesList` only accepts the legacy
camelCase spelling.
Because `ignoredResourcesList.Contains(k)` uses case-sensitive string
equality, the lookup against the new lowercase ResourceMap key never
matches. The configmaps controller is created and starts watching
ConfigMaps cluster-wide, even though the chart's ClusterRole template
(also gated on `ignoreConfigMaps`) does not grant permission for it.
The resulting pod logs are full of:
configmaps is forbidden: User "system:serviceaccount:reloader:reloader-reloader"
cannot list resource "configmaps" in API group "" at the cluster scope
This change:
- Updates the chart deployment template to emit the canonical lowercase
`configmaps` value.
- Normalizes the input in `GetIgnoredResourcesList`, accepting both
`configMaps` (legacy, for backward compatibility with users who pass
the flag directly) and `configmaps` (canonical), and emitting the
canonical form to the caller.
- Updates the flag help text and adds tests covering both spellings.
Extended Helm chart configuration to allow imagePullSecrets to be defined
either as a list of strings (e.g., `- my-pull-secret`) or as a list of
objects with `name` keys (e.g., `- name: my-pull-secret`).
This improves the compatibility and makes it easier to work with various tools,
which take advantake from the assumption of existence of those labels.
Keep the old labels for selectors for backward compatibility.
Also note there is slight change in behaviour of PDB which might
be backward-incompatible in some rare cases.
- Update the version number in the `Chart.yaml` file from `1.3.0` to `1.3.1`
- Update the image name and tag in the `deployment.yaml` file
- Add a new section for image details in the `values.yaml` file with repository, tag, and pull policy
- Remove the `image` section from the `reloader` block in the `values.yaml` file, since the image details were moved to a new image section
- Modify the `containerSecurityContext` section in the `deployment.yaml` file
Muhammad Safwan KarimandGitHub
somaz
Dean Chen
Sachin AvinaandGitHub
Michał MarszałekandClaude Opus 4.8
yvjessestephensandGitHub
t3mi
Smyslov MaximandCursor
Jesse Stephens
faizanahmad055
Michael VögeliandGitHub
Hlib Kalinchuk
Michael Vögeli
Pradeep Lakshmi NarasimhaandFelix
Nitin Verma
Safwan
Jiří Pinkava
Yoga Yu
Vincent Mizoules
Muneeb AijazandGitHub
Mikhail KoniakhinandGitHub
Xavier KrantzandGitHub
Mohamed SekourandGitHub
tom1299andGitHub
Dimitris4000
Bjorn StoutandGitHub
tom1299