Make the driver seed function respect the watch namespace filter (#771)

Author: alex-bezek

cmd/api-manager.go

@@ -539,7 +539,11 @@ func getK8sResourceDriver(ctx context.Context, mgr manager.Manager, options apiM
 		d.WithNgrokMetadata(customMetadata)
 	}
 
-	if err := d.Seed(ctx, mgr.GetAPIReader()); err != nil {
+	var seedOpts []client.ListOption
+	if options.ingressWatchNamespace != "" {
+		seedOpts = append(seedOpts, client.InNamespace(options.ingressWatchNamespace))
+	}
+	if err := d.Seed(ctx, mgr.GetAPIReader(), seedOpts...); err != nil {
 		return nil, fmt.Errorf("unable to seed cache store: %w", err)
 	}
 

pkg/managerdriver/driver.go

@@ -194,31 +194,31 @@ func (d *Driver) setNgrokMetadataOwner(owner string, customNgrokMetadata map[str
 	return string(jsonString), nil
 }
 
-func listObjectsForType(ctx context.Context, client client.Reader, v interface{}) ([]client.Object, error) {
+func listObjectsForType(ctx context.Context, client client.Reader, v interface{}, listOpts ...client.ListOption) ([]client.Object, error) {
 	switch v.(type) {
 
 	// ----------------------------------------------------------------------------
 	// Kubernetes Core API Support
 	// ----------------------------------------------------------------------------
 	case *corev1.Service:
 		services := &corev1.ServiceList{}
-		err := client.List(ctx, services)
+		err := client.List(ctx, services, listOpts...)
 		return util.ToClientObjects(services.Items), err
 	case *corev1.Secret:
 		secrets := &corev1.SecretList{}
-		err := client.List(ctx, secrets)
+		err := client.List(ctx, secrets, listOpts...)
 		return util.ToClientObjects(secrets.Items), err
 	case *corev1.ConfigMap:
 		configmaps := &corev1.ConfigMapList{}
-		err := client.List(ctx, configmaps)
+		err := client.List(ctx, configmaps, listOpts...)
 		return util.ToClientObjects(configmaps.Items), err
 	case *corev1.Namespace:
 		namespaces := &corev1.NamespaceList{}
 		err := client.List(ctx, namespaces)
 		return util.ToClientObjects(namespaces.Items), err
 	case *netv1.Ingress:
 		ingresses := &netv1.IngressList{}
-		err := client.List(ctx, ingresses)
+		err := client.List(ctx, ingresses, listOpts...)
 		return util.ToClientObjects(ingresses.Items), err
 	case *netv1.IngressClass:
 		ingressClasses := &netv1.IngressClassList{}
@@ -234,43 +234,43 @@ func listObjectsForType(ctx context.Context, client client.Reader, v interface{}
 		return util.ToClientObjects(gatewayClasses.Items), err
 	case *gatewayv1.Gateway:
 		gateways := &gatewayv1.GatewayList{}
-		err := client.List(ctx, gateways)
+		err := client.List(ctx, gateways, listOpts...)
 		return util.ToClientObjects(gateways.Items), err
 	case *gatewayv1.HTTPRoute:
 		httproutes := &gatewayv1.HTTPRouteList{}
-		err := client.List(ctx, httproutes)
+		err := client.List(ctx, httproutes, listOpts...)
 		return util.ToClientObjects(httproutes.Items), err
 	case *gatewayv1alpha2.TCPRoute:
 		tcpRoutes := &gatewayv1alpha2.TCPRouteList{}
-		err := client.List(ctx, tcpRoutes)
+		err := client.List(ctx, tcpRoutes, listOpts...)
 		return util.ToClientObjects(tcpRoutes.Items), err
 	case *gatewayv1alpha2.TLSRoute:
 		tlsRoutes := &gatewayv1alpha2.TLSRouteList{}
-		err := client.List(ctx, tlsRoutes)
+		err := client.List(ctx, tlsRoutes, listOpts...)
 		return util.ToClientObjects(tlsRoutes.Items), err
 	case *gatewayv1beta1.ReferenceGrant:
 		referenceGrants := &gatewayv1beta1.ReferenceGrantList{}
-		err := client.List(ctx, referenceGrants)
+		err := client.List(ctx, referenceGrants, listOpts...)
 		return util.ToClientObjects(referenceGrants.Items), err
 
 	// ----------------------------------------------------------------------------
 	// Ngrok API Support
 	// ----------------------------------------------------------------------------
 	case *ingressv1alpha1.Domain:
 		domains := &ingressv1alpha1.DomainList{}
-		err := client.List(ctx, domains)
+		err := client.List(ctx, domains, listOpts...)
 		return util.ToClientObjects(domains.Items), err
 	case *ngrokv1alpha1.NgrokTrafficPolicy:
 		policies := &ngrokv1alpha1.NgrokTrafficPolicyList{}
-		err := client.List(ctx, policies)
+		err := client.List(ctx, policies, listOpts...)
 		return util.ToClientObjects(policies.Items), err
 	case *ngrokv1alpha1.AgentEndpoint:
 		agentEndpoints := &ngrokv1alpha1.AgentEndpointList{}
-		err := client.List(ctx, agentEndpoints)
+		err := client.List(ctx, agentEndpoints, listOpts...)
 		return util.ToClientObjects(agentEndpoints.Items), err
 	case *ngrokv1alpha1.CloudEndpoint:
 		cloudEndpoints := &ngrokv1alpha1.CloudEndpointList{}
-		err := client.List(ctx, cloudEndpoints)
+		err := client.List(ctx, cloudEndpoints, listOpts...)
 		return util.ToClientObjects(cloudEndpoints.Items), err
 	}
 	return nil, fmt.Errorf("unsupported type %T", v)
@@ -298,7 +298,7 @@ func listObjectsForType(ctx context.Context, client client.Reader, v interface{}
 // - AgentEndpoints
 // - CloudEndpoints
 // When the sync method becomes a background process, this likely won't be needed anymore
-func (d *Driver) Seed(ctx context.Context, c client.Reader) error {
+func (d *Driver) Seed(ctx context.Context, c client.Reader, listOpts ...client.ListOption) error {
 	typesToSeed := []interface{}{
 		&netv1.Ingress{},
 		&netv1.IngressClass{},
@@ -331,7 +331,7 @@ func (d *Driver) Seed(ctx context.Context, c client.Reader) error {
 	}
 
 	for _, v := range typesToSeed {
-		objects, err := listObjectsForType(ctx, c, v)
+		objects, err := listObjectsForType(ctx, c, v, listOpts...)
 		if err != nil {
 			return err
 		}

pkg/managerdriver/driver_test.go

@@ -87,6 +87,64 @@ var _ = Describe("Driver", func() {
 				Expect(foundObj).To(Equal(obj))
 			}
 		})
+		It("Should not seed namespace-scoped resources from outside the watched namespace", func() {
+			watchedNS := "watched-ns"
+			otherNS := "other-ns"
+
+			// Resources in the watched namespace
+			watchedIngress := testutils.NewTestIngressV1("ingress-watched", watchedNS)
+			watchedDomain := testutils.NewDomainV1("watched.example.com", watchedNS)
+			watchedService := testutils.NewTestServiceV1("svc-watched", watchedNS)
+
+			// Resources in another namespace (should be excluded when namespace-scoped)
+			otherIngress := testutils.NewTestIngressV1("ingress-other", otherNS)
+			otherDomain := testutils.NewDomainV1("other.example.com", otherNS)
+			otherService := testutils.NewTestServiceV1("svc-other", otherNS)
+
+			// Cluster-scoped resources (should always be included)
+			ic := testutils.NewTestIngressClass("ngrok-class", true, true)
+
+			allObjs := []runtime.Object{
+				watchedIngress, watchedDomain, watchedService,
+				otherIngress, otherDomain, otherService,
+				ic,
+			}
+
+			c := fake.NewClientBuilder().WithScheme(scheme).WithRuntimeObjects(allObjs...).Build()
+			err := driver.Seed(GinkgoT().Context(), c, client.InNamespace(watchedNS))
+			Expect(err).ToNot(HaveOccurred())
+
+			// Watched namespace resources should be in the store
+			_, found, err := driver.store.Get(watchedIngress)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(found).To(BeTrue(), "watched ingress should be in store")
+
+			_, found, err = driver.store.Get(watchedDomain)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(found).To(BeTrue(), "watched domain should be in store")
+
+			_, found, err = driver.store.Get(watchedService)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(found).To(BeTrue(), "watched service should be in store")
+
+			// Other namespace resources should NOT be in the store
+			_, found, err = driver.store.Get(otherIngress)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(found).To(BeFalse(), "other-ns ingress should NOT be in store")
+
+			_, found, err = driver.store.Get(otherDomain)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(found).To(BeFalse(), "other-ns domain should NOT be in store")
+
+			_, found, err = driver.store.Get(otherService)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(found).To(BeFalse(), "other-ns service should NOT be in store")
+
+			// Cluster-scoped resources should still be in the store
+			_, found, err = driver.store.Get(ic)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(found).To(BeTrue(), "cluster-scoped IngressClass should be in store")
+		})
 	})
 
 	Describe("DeleteIngress", func() {