Merge branch 'main' into kcl/konnect-eventgateway

Author: alacuku

.github/workflows/__kongintegration_tests.yaml

@@ -89,7 +89,7 @@ jobs:
         env:
           GOTESTSUM_JUNITFILE: ${{ env.GOTESTSUM_JUNITFILE }}
           KONG_CUSTOM_DOMAIN: konghq.tech
-          TEST_KONG_KONNECT_ACCESS_TOKEN: ${{ secrets.KONG_TEST_KONNECT_ACCESS_TOKEN }}
+          KONG_TEST_KONNECT_ACCESS_TOKEN: ${{ secrets.KONG_TEST_KONNECT_ACCESS_TOKEN }}
           KONG_LICENSE_DATA: ${{ steps.license.outputs.license }}
           TEST_KONG_ENTERPRISE: ${{ matrix.enterprise }}
 

.github/workflows/release-bot.yaml

@@ -105,7 +105,7 @@ jobs:
         uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
         with:
           egress-policy: audit
-      - uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1.20.0
+      - uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
         with:
           body: |
             #### Download Kong Operator ${{ needs.semver.outputs.version }}:

CHANGELOG.md

@@ -130,6 +130,8 @@
   now include a hash of rule's other field to avoid naming collisions with other
   rules that also have no BackendRefs.
   [#3576](https://github.com/Kong/kong-operator/pull/3576)
+- Do not try to list `Gateway`s for namespaces that are not being watched by controller
+  [#3625](https://github.com/Kong/kong-operator/pull/3625)
 
 ## [v2.1.2]
 

controller/gateway/controller.go

@@ -73,6 +73,7 @@ type Reconciler struct {
 	KonnectEnabled          bool
 	AnonymousReportsEnabled bool
 	LoggingMode             logging.Mode
+	WatchNamespaces         []string
 }
 
 // provisionDataPlaneFailRequeueAfter is the time duration after which we retry provisioning

controller/gateway/controller_watch.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"reflect"
+	"slices"
 
 	"github.com/samber/lo"
 	corev1 "k8s.io/api/core/v1"
@@ -350,6 +351,11 @@ func (r *Reconciler) listManagedGatewaysInNamespace(ctx context.Context, obj cli
 		)
 		return nil
 	}
+	if len(r.WatchNamespaces) > 0 && !slices.Contains(r.WatchNamespaces, ns.Name) {
+		log.Trace(logger, "namespace is not configured to be watched by controller, skipping", "namespace", ns.Name)
+		return nil
+	}
+
 	gateways := &gatewayv1.GatewayList{}
 	if err := r.List(ctx, gateways, &client.ListOptions{
 		Namespace: ns.Name,

ingress-controller/test/helpers/konnect/access.go

@@ -1,26 +1,11 @@
 package konnect
 
 import (
-	"os"
-	"testing"
-
 	sdkkonnectgo "github.com/Kong/sdk-konnect-go"
 
 	"github.com/kong/kong-operator/v2/ingress-controller/test"
 )
 
-// SkipIfMissingRequiredKonnectEnvVariables skips the test if the required Konnect environment variables are missing.
-func SkipIfMissingRequiredKonnectEnvVariables(t *testing.T) {
-	if accessToken() == "" {
-		t.Skip("missing TEST_KONG_KONNECT_ACCESS_TOKEN")
-	}
-}
-
-// accessToken returns the access token to be used for Konnect API requests.
-func accessToken() string {
-	return os.Getenv("TEST_KONG_KONNECT_ACCESS_TOKEN")
-}
-
 // konnectControlPlaneAdminAPIBaseURL returns the base URL for Konnect Control Plane Admin API.
 // NOTE: This is a temporary solution until we migrate all the Konnect API calls to the new SDK.
 func konnectControlPlaneAdminAPIBaseURL() string {

ingress-controller/test/helpers/konnect/certificates.go

@@ -16,6 +16,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/kong/kong-operator/v2/ingress-controller/internal/konnect/sdk"
+	"github.com/kong/kong-operator/v2/test"
 	"github.com/kong/kong-operator/v2/test/helpers/certificate"
 )
 
@@ -37,7 +38,7 @@ func CreateClientCertificate(ctx context.Context, t *testing.T, cpID string, tok
 
 	var s *sdkkonnectgo.SDK
 	if len(token) == 0 {
-		s = sdk.New(accessToken(), serverURLOpt(), retryConfig)
+		s = sdk.New(test.KonnectAccessToken(), serverURLOpt(), retryConfig)
 	} else {
 		s = sdk.New(token[0], serverURLOpt(), retryConfig)
 	}

ingress-controller/test/helpers/konnect/control_plane.go

@@ -20,6 +20,7 @@ import (
 	managercfg "github.com/kong/kong-operator/v2/ingress-controller/pkg/manager/config"
 	"github.com/kong/kong-operator/v2/ingress-controller/test"
 	"github.com/kong/kong-operator/v2/ingress-controller/test/testenv"
+	testhelpers "github.com/kong/kong-operator/v2/test"
 	"github.com/kong/kong-operator/v2/test/helpers/deploy"
 )
 
@@ -32,7 +33,7 @@ func CreateTestControlPlane(ctx context.Context, t *testing.T, token ...string)
 
 	var s *sdkkonnectgo.SDK
 	if len(token) == 0 {
-		s = sdk.New(accessToken(), serverURLOpt())
+		s = sdk.New(testhelpers.KonnectAccessToken(), serverURLOpt())
 	} else {
 		s = sdk.New(token[0], serverURLOpt())
 	}

ingress-controller/test/helpers/konnect/personal_access_tokens.go

@@ -13,6 +13,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/kong/kong-operator/v2/ingress-controller/internal/konnect/sdk"
+	testhelpers "github.com/kong/kong-operator/v2/test"
 )
 
 // CreateTestPersonalAccessToken creates a personal access token for the user
@@ -23,7 +24,7 @@ import (
 func CreateTestPersonalAccessToken(ctx context.Context, t *testing.T) string {
 	t.Helper()
 
-	s := sdk.New(accessToken(), serverURLOpt())
+	s := sdk.New(testhelpers.KonnectAccessToken(), serverURLOpt())
 
 	me, err := s.Me.GetUsersMe(ctx)
 	require.NoError(t, err)

ingress-controller/test/helpers/konnect/system_account_tokens.go

@@ -13,12 +13,13 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/kong/kong-operator/v2/ingress-controller/internal/konnect/sdk"
+	testhelpers "github.com/kong/kong-operator/v2/test"
 )
 
 func CreateTestSystemAccountToken(ctx context.Context, t *testing.T, systemAccountID string) (string, string) {
 	t.Helper()
 
-	s := sdk.New(accessToken(), serverURLOpt())
+	s := sdk.New(testhelpers.KonnectAccessToken(), serverURLOpt())
 
 	var (
 		systemAccountToken     string