Add a third RBAC posture between watch-globally (ClusterRole) and single
namespace: give Reloader an explicit list of namespaces to watch. The chart
creates a namespace-scoped Role + RoleBinding in each listed namespace (no
ClusterRole), and one install covers them all.
Go:
- new --namespaces flag / options.Namespaces
- resolveWatchNamespaces() picks list -> KUBERNETES_NAMESPACE -> all
- controller creation loops over the watched namespaces
- namespaces-to-ignore is now only honored in global mode (watchGlobally=true);
in single-namespace and scoped modes the watched set is already explicit
Helm:
- new reloader.namespaces value (active when watchGlobally=false); accepts either
a YAML list or a comma-separated string for consistency with the sibling
namespace options
- reloader-watchNamespaces helper (release ns always auto-included, deduped)
- shared reloader-namespaced-rules template reused per namespace
- role.yaml/rolebinding.yaml range over the list; deployment passes --namespaces
- --namespaces-to-ignore only rendered when watchGlobally=true
- fail guard for watchGlobally=true + namespaces set
Tests: unit test for resolveWatchNamespaces; scoped-namespaces e2e case.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* separate methods
* basic refactoring
* moved common code to util package to use it in gateway
* common check for argo rollouts
* made code compilable with latest changes on master
* Moved options to separate package and created CommandLineOptions instance that will be in sync with options values.
* reverted extra changes
* initialize CommandLineOptions with default options in module init
* wait for paused at annotation before checking deployment paused
* moved things around to fix things
* reverted unnecessary changes
* reverted rolling_upgrade changes
* reverted extra change
* additional checks in reloader
* refactor: ShouldReloadInternal method. It will be called by Reloader
ShouldReload has some additional resource/namespace filter checks which are not needed for Reloader
* added test cases
* moved config to sharable packae
* moved resource selector and label selctor methods
* fixed pipeline
* removed map.yaml
* removed vague comment
* separate methods
* basic refactoring
* moved common code to util package to use it in gateway
* common check for argo rollouts
* made code compilable with latest changes on master
* Moved options to separate package and created CommandLineOptions instance that will be in sync with options values.
* reverted extra changes
* initialize CommandLineOptions with default options in module init
* wait for paused at annotation before checking deployment paused
* moved things around to fix things
* reverted unnecessary changes
* reverted rolling_upgrade changes
* reverted extra change
* add option to configure labelSelectors on configmaps & secrets
* support all labelSelectors
* label selector tests
* legacy support for ':' delimited selectors and wildcards
Signed-off-by: Craig Trought <k8s@trought.ca>
Previously, 9091 and 9090 both led to the same web server, meaning both
/metrics and /live were reachable and fully functional through both.
This commit changes that so that only port 9090 is used for both.
Closes#381.
Pull liveness into leadership to ease testing, logically the liveness
probe is directly affected by leadership so it makes sense here.
Moved some of the components of the controller tests into the testutil
package for reuse in my own tests.
Michał MarszałekandClaude Opus 4.8
faizanahmad055
Safwan
Muhammad Safwan KarimandGitHub
Yoga Yu
Zanis
deschmih
liuzhenwei
Piotr Andrzejewski
Utibeabasi Umanah
itaispiegel
ctrought
dhia-gharsallaouiandGitHub
d3adb5
avihuly
Alex Vest
aenima4six2
Vlad Losev
katainaka0503
Anthony Stanton
waseem
hstanley