When KUBERNETES_NAMESPACE is unset, startReloader logged
"will detect changes in all namespaces." unconditionally, even when
--namespaces-to-ignore was set, which is misleading.
Extract the scope message into namespaceWatchScopeMessage(), move the log
after ignoredNamespacesList is resolved, and include the excluded
namespaces in the message when filtering is active.
Closes#1131
Assisted-by: Claude Code (Anthropic, Opus 4.x)
Add a third RBAC posture between watch-globally (ClusterRole) and single
namespace: give Reloader an explicit list of namespaces to watch. The chart
creates a namespace-scoped Role + RoleBinding in each listed namespace (no
ClusterRole), and one install covers them all.
Go:
- new --namespaces flag / options.Namespaces
- resolveWatchNamespaces() picks list -> KUBERNETES_NAMESPACE -> all
- controller creation loops over the watched namespaces
- namespaces-to-ignore is now only honored in global mode (watchGlobally=true);
in single-namespace and scoped modes the watched set is already explicit
Helm:
- new reloader.namespaces value (active when watchGlobally=false); accepts either
a YAML list or a comma-separated string for consistency with the sibling
namespace options
- reloader-watchNamespaces helper (release ns always auto-included, deduped)
- shared reloader-namespaced-rules template reused per namespace
- role.yaml/rolebinding.yaml range over the list; deployment passes --namespaces
- --namespaces-to-ignore only rendered when watchGlobally=true
- fail guard for watchGlobally=true + namespaces set
Tests: unit test for resolveWatchNamespaces; scoped-namespaces e2e case.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Michał Marszałek
Nikolaus Schuetz
