The helper only emits namespaceSelector when watchGlobally is true
(matches values.yaml and the chart README). The old comment said the
opposite and made the condition look inverted.
Fixes#1188
Signed-off-by: Dean Chen <862469039@qq.com>
Upgrades the golang.org/x/* module family in lockstep. Fixes the HIGH
severity DoS vulnerability in golang.org/x/text v0.37.0 that fails the
Trivy security gate in the enterprise release pipeline.
Per review: instead of logging the skipped pattern inside ShouldReload
(which lacks workload identity), collect the compile errors on
ReloadCheckResult.Errors and log them at the upgrade call site, where the
resource name, type, and namespace are known. Add a test for the
multi-value case where one comma-separated pattern is malformed and a
valid one still matches.
ShouldReload compiled each comma-separated value of a named reload
annotation (e.g. secret.reloader.stakater.com/reload) with
regexp.MustCompile, which panics on an invalid pattern. The value comes
straight from a user-set annotation on a watched workload, and the queue
worker has no recover(), so a single malformed annotation (e.g.
"app-config[") on any workload in any watched namespace crashes Reloader
and stops reloads cluster-wide.
Use regexp.Compile and, on error, log and skip that pattern instead of
panicking.
The alert send functions (Slack/Teams/GChat/raw) return `[]error`, but
`SendWebhookAlert` discarded them, so a failing webhook — e.g. a Teams
alert returning a non-2xx status — produced no output at all, even at
trace level (#949).
Capture the returned errors and log each with `logrus.Errorf`, as
suggested by the maintainer on the issue. Adds a regression test that
drives a failing (500) webhook and asserts the error is logged.
Closes#949
Assisted-by: Claude Code (Anthropic, Opus 4.x)
The CSI e2e tests wait for the SPCPS version change before calling
WaitReloaded/WaitEnvVar, but Reloader reacts to that same SPCPS update.
When Reloader won the race, WaitReloaded captured the already-reloaded
annotation as its baseline and then timed out waiting for a further
change (seen in CI: "Init container with CSI volume should reload...").
Add WaitReloadedFrom/WaitEnvVarFrom adapter variants that take a
caller-supplied baseline, and have the CSI tests capture that baseline
before updating the Vault secret. Negative tests also benefit: an
erroneous reload that lands during the CSI sync wait is now detected
instead of silently absorbed into the baseline.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
When KUBERNETES_NAMESPACE is unset, startReloader logged
"will detect changes in all namespaces." unconditionally, even when
--namespaces-to-ignore was set, which is misleading.
Extract the scope message into namespaceWatchScopeMessage(), move the log
after ignoredNamespacesList is resolved, and include the excluded
namespaces in the message when filtering is active.
Closes#1131
Assisted-by: Claude Code (Anthropic, Opus 4.x)
Add a third RBAC posture between watch-globally (ClusterRole) and single
namespace: give Reloader an explicit list of namespaces to watch. The chart
creates a namespace-scoped Role + RoleBinding in each listed namespace (no
ClusterRole), and one install covers them all.
Go:
- new --namespaces flag / options.Namespaces
- resolveWatchNamespaces() picks list -> KUBERNETES_NAMESPACE -> all
- controller creation loops over the watched namespaces
- namespaces-to-ignore is now only honored in global mode (watchGlobally=true);
in single-namespace and scoped modes the watched set is already explicit
Helm:
- new reloader.namespaces value (active when watchGlobally=false); accepts either
a YAML list or a comma-separated string for consistency with the sibling
namespace options
- reloader-watchNamespaces helper (release ns always auto-included, deduped)
- shared reloader-namespaced-rules template reused per namespace
- role.yaml/rolebinding.yaml range over the list; deployment passes --namespaces
- --namespaces-to-ignore only rendered when watchGlobally=true
- fail guard for watchGlobally=true + namespaces set
Tests: unit test for resolveWatchNamespaces; scoped-namespaces e2e case.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Use strings.ToLower so any casing (configMaps, ConfigMaps, sEcrets)
normalizes to the canonical lowercase ResourceMap key, and simplify the
flag help text. Addresses PR review feedback.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Muhammad Safwan KarimandGitHub
SyedaFatimaKazmi
somaz
Dean Chen
Felix TonnvikandGitHub
Nikolaus Schuetz
Sachin AvinaandGitHub
Michał MarszałekandClaude Fable 5
Safwan
yvjessestephensandGitHub
Jesse StephensandClaude Opus 4.8
faizanahmad055
Smyslov Maxim
t3mi