AlinsRan opened a new pull request, #2891: URL: https://github.com/apache/apisix-ingress-controller/pull/2891
### Type of change: - [x] New feature provided ### What this PR does / why we need it: The 1.x controller could limit the namespaces it watches with `kubernetes.namespace_selector`. 2.x has no equivalent, which blocks users that run several controllers in one cluster against a shared set of `ApisixRoute`/`Ingress` resources and split the work by namespace labels, as well as users migrating such a 1.x setup: a 2.x controller configured as the default IngressClass picks up resources from every namespace. This PR adds a top-level `namespace_selector` option: ```yaml namespace_selector: - "team=a" - "team=b" - "env=prod" ``` - Same semantics as 1.x (`MultiValueLabels.IsSubsetOf`): every entry must match, and entries holding a single equality or `in` requirement on the same key are merged. The example selects namespaces labeled `team in (a,b)` **and** `env=prod`. - Each entry also accepts the full label selector syntax (`env in (prod,staging)`, `!legacy`, `version!=v1`). Within one entry, comma-separated requirements keep the standard semantics, so `team=a,team=b` matches nothing. - Empty entries are ignored, so the 1.x default `[""]` keeps the selector off. An empty list selects all namespaces, which is the current behavior. - Scope: `Ingress`, `ApisixRoute`, `ApisixTls`, `ApisixConsumer`, `ApisixGlobalRule` (plus status-only handling of `ApisixPluginConfig`/`ApisixUpstream`). Referenced resources such as Services, Secrets and GatewayProxies are still read from any namespace. Gateway API resources are not filtered; the `allowedRoutes` of the Gateway listeners covers that. #### How - The namespace check is part of `FindMatchingIngressClass`. An object outside the selected namespaces is treated like one bound to another controller's IngressClass: it is filtered out by the `For` predicate, its reconcile retracts any previously synced configuration, its status is not written, the webhooks skip it, and the SSL conflict detector ignores it. - `ApisixTls` previously only skipped on an IngressClass mismatch. It now also retracts on `ErrNamespaceNotWatched`, so certificates are removed when a namespace stops being selected. - `Ingress`, `ApisixRoute` and `ApisixGlobalRule` now retract only when the IngressClass selection is absent (`isIngressClassSelectionAbsent`), and requeue on other lookup errors, like `ApisixConsumer` already does. A transient read error no longer drops routes. - When a selector is configured, the five controllers above watch Namespaces and requeue a namespace's objects only when it moves into or out of the selected set. - The readiness check skips objects in unselected namespaces, so startup does not wait for objects that will never be reconciled. - An invalid selector fails config validation at startup. #### Differences from 1.x (documented in the upgrade guide) - When a namespace stops matching, 2.x removes the configuration of its resources from the data plane; 1.x left the synced routes in place. - Gateway API resources are not filtered. - There is no `--namespace-selector` flag; set the option in the configuration file. #### Tests - Unit tests: selector parsing, including the cases ported from 1.x `TestMultiValueLabelsIsSubsetOf`; `IsWatchedNamespace`; `FindMatchingIngressClass`; the Namespace predicate; `ApisixRoute`/`ApisixTls` retraction outside selected namespaces. - E2E `Test Namespace Selector`: routes in selected and unselected namespaces, a namespace carrying only one of two selected labels stays unselected, labeling a namespace syncs its routes, unlabeling retracts them, relabeling restores them. Passed locally with `apisix-standalone`. ### Pre-submission checklist: - [x] Did you explain what problem does this PR solve? Or what new features have been added? - [x] Have you added corresponding test cases? - [x] Have you modified the corresponding document? - [x] Is this PR backward compatible? **If it is not backward compatible, please discuss on the [mailing list](https://github.com/apache/apisix-ingress-controller#community) first** -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
