Per review: instead of logging the skipped pattern inside ShouldReload
(which lacks workload identity), collect the compile errors on
ReloadCheckResult.Errors and log them at the upgrade call site, where the
resource name, type, and namespace are known. Add a test for the
multi-value case where one comma-separated pattern is malformed and a
valid one still matches.
The alert send functions (Slack/Teams/GChat/raw) return `[]error`, but
`SendWebhookAlert` discarded them, so a failing webhook — e.g. a Teams
alert returning a non-2xx status — produced no output at all, even at
trace level (#949).
Capture the returned errors and log each with `logrus.Errorf`, as
suggested by the maintainer on the issue. Adds a regression test that
drives a failing (500) webhook and asserts the error is logged.
Closes#949
Assisted-by: Claude Code (Anthropic, Opus 4.x)
When KUBERNETES_NAMESPACE is unset, startReloader logged
"will detect changes in all namespaces." unconditionally, even when
--namespaces-to-ignore was set, which is misleading.
Extract the scope message into namespaceWatchScopeMessage(), move the log
after ignoredNamespacesList is resolved, and include the excluded
namespaces in the message when filtering is active.
Closes#1131
Assisted-by: Claude Code (Anthropic, Opus 4.x)
Add a third RBAC posture between watch-globally (ClusterRole) and single
namespace: give Reloader an explicit list of namespaces to watch. The chart
creates a namespace-scoped Role + RoleBinding in each listed namespace (no
ClusterRole), and one install covers them all.
Go:
- new --namespaces flag / options.Namespaces
- resolveWatchNamespaces() picks list -> KUBERNETES_NAMESPACE -> all
- controller creation loops over the watched namespaces
- namespaces-to-ignore is now only honored in global mode (watchGlobally=true);
in single-namespace and scoped modes the watched set is already explicit
Helm:
- new reloader.namespaces value (active when watchGlobally=false); accepts either
a YAML list or a comma-separated string for consistency with the sibling
namespace options
- reloader-watchNamespaces helper (release ns always auto-included, deduped)
- shared reloader-namespaced-rules template reused per namespace
- role.yaml/rolebinding.yaml range over the list; deployment passes --namespaces
- --namespaces-to-ignore only rendered when watchGlobally=true
- fail guard for watchGlobally=true + namespaces set
Tests: unit test for resolveWatchNamespaces; scoped-namespaces e2e case.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Use strings.ToLower so any casing (configMaps, ConfigMaps, sEcrets)
normalizes to the canonical lowercase ResourceMap key, and simplify the
flag help text. Addresses PR review feedback.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Allow users to customise the annotation key used to mark ConfigMaps and
Secrets as ignored by Reloader, consistent with how every other annotation
key is already overridable via a dedicated CLI flag.
Changes:
- internal/pkg/util/util.go: register --ignore-annotation persistent flag
backed by options.IgnoreResourceAnnotation
- deployments/kubernetes/chart/reloader/templates/deployment.yaml: pass
--ignore-annotation when custom_annotations.ignore is set in Helm values
- deployments/kubernetes/chart/reloader/values.yaml: document the new
custom_annotations.ignore key in the example comment
- README.md: add --ignore-annotation to the Annotation Key Overrides table
and mention the flag alongside the Resource-Level Ignore Annotation section
Co-authored-by: Cursor <cursoragent@cursor.com>
PR #1061 renamed the configmap key in kube.ResourceMap from "configMaps"
(camelCase) to "configmaps" (lowercase) to fix controllers not being
able to mark themselves as initialized. However, two callers were not
updated to match the new canonical key:
1. The Helm chart's deployment template still emits
`--resources-to-ignore=configMaps` (camelCase) when
`reloader.ignoreConfigMaps: true` is set.
2. The validation in `GetIgnoredResourcesList` only accepts the legacy
camelCase spelling.
Because `ignoredResourcesList.Contains(k)` uses case-sensitive string
equality, the lookup against the new lowercase ResourceMap key never
matches. The configmaps controller is created and starts watching
ConfigMaps cluster-wide, even though the chart's ClusterRole template
(also gated on `ignoreConfigMaps`) does not grant permission for it.
The resulting pod logs are full of:
configmaps is forbidden: User "system:serviceaccount:reloader:reloader-reloader"
cannot list resource "configmaps" in API group "" at the cluster scope
This change:
- Updates the chart deployment template to emit the canonical lowercase
`configmaps` value.
- Normalizes the input in `GetIgnoredResourcesList`, accepting both
`configMaps` (legacy, for backward compatibility with users who pass
the flag directly) and `configmaps` (canonical), and emitting the
canonical form to the caller.
- Updates the flag help text and adds tests covering both spellings.
* separate methods
* basic refactoring
* moved common code to util package to use it in gateway
* common check for argo rollouts
* made code compilable with latest changes on master
* Moved options to separate package and created CommandLineOptions instance that will be in sync with options values.
* reverted extra changes
* initialize CommandLineOptions with default options in module init
* wait for paused at annotation before checking deployment paused
* moved things around to fix things
* reverted unnecessary changes
* reverted rolling_upgrade changes
* reverted extra change
* additional checks in reloader
* refactor: ShouldReloadInternal method. It will be called by Reloader
ShouldReload has some additional resource/namespace filter checks which are not needed for Reloader
* added test cases
* moved config to sharable packae
* moved resource selector and label selctor methods
* fixed pipeline
* removed map.yaml
* removed vague comment
* separate methods
* basic refactoring
* moved common code to util package to use it in gateway
* common check for argo rollouts
* made code compilable with latest changes on master
* Moved options to separate package and created CommandLineOptions instance that will be in sync with options values.
* reverted extra changes
* initialize CommandLineOptions with default options in module init
* wait for paused at annotation before checking deployment paused
* moved things around to fix things
* reverted unnecessary changes
* reverted rolling_upgrade changes
* reverted extra change
Muhammad Safwan KarimandGitHub
Nikolaus Schuetz
Michał Marszałek
yvjessestephensandGitHub
Jesse StephensandClaude Opus 4.8
faizanahmad055
Smyslov MaximandCursor
Safwan
TheiLLeniumStudios
Pradeep Lakshmi Narasimha
