Watch handler namespace to revert external modifications

In addition to the periodic resync, watch the handler namespace and map
its events to NMState reconcile requests so externally modified
namespace metadata (e.g. annotations) is restored immediately. The
manager cache is restricted to the handler namespace for Namespace
objects to avoid caching every namespace in the cluster.

Assisted-By: Claude Fable 5
Signed-off-by: Mat Kowalski <mko@redhat.com>

Author: mkowalski

cmd/operator/main.go

@@ -25,11 +25,13 @@ import (
 	"time"
 
 	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/fields"
 	"k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	_ "k8s.io/client-go/plugin/pkg/client/auth/gcp"
 	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/cache"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
@@ -88,6 +90,16 @@ func main() {
 			BindAddress: "0", // disable metrics
 		},
 		HealthProbeBindAddress: ":8081",
+		Cache: cache.Options{
+			// The operator watches the handler namespace to revert external
+			// modifications to its metadata. Restrict the cache to just that
+			// namespace so we do not cache/watch every namespace in the cluster.
+			ByObject: map[client.Object]cache.ByObject{
+				&corev1.Namespace{}: {
+					Field: fields.OneTermEqualSelector("metadata.name", os.Getenv("HANDLER_NAMESPACE")),
+				},
+			},
+		},
 	}
 
 	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrlOptions)

controllers/operator/nmstate_controller.go

@@ -34,6 +34,7 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/handler"
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -152,13 +153,39 @@ func (r *NMStateReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct
 }
 
 func (r *NMStateReconciler) SetupWithManager(mgr ctrl.Manager) error {
+	// Watch the handler namespace so that externally modified metadata
+	// (e.g. annotations) is restored without waiting for the periodic
+	// resync. The manager cache is restricted to the handler namespace
+	// for Namespace objects, but we filter here too in case that ever
+	// changes.
+	handlerNamespaceFunc := r.nmstateRequestsFromHandlerNamespace
 	return ctrl.NewControllerManagedBy(mgr).
 		For(&nmstatev1.NMState{}).
 		Owns(&appsv1.Deployment{}).
 		Owns(&appsv1.DaemonSet{}).
+		Watches(&corev1.Namespace{}, handler.EnqueueRequestsFromMapFunc(handlerNamespaceFunc)).
 		Complete(r)
 }
 
+// nmstateRequestsFromHandlerNamespace maps events on the handler namespace to
+// reconcile requests for the deployed NMState CRs so that externally modified
+// namespace metadata (e.g. annotations) is restored.
+func (r *NMStateReconciler) nmstateRequestsFromHandlerNamespace(ctx context.Context, obj client.Object) []ctrl.Request {
+	if obj.GetName() != os.Getenv("HANDLER_NAMESPACE") {
+		return nil
+	}
+	nmstateList := &nmstatev1.NMStateList{}
+	if err := r.List(ctx, nmstateList); err != nil {
+		r.Log.Error(err, "failed listing NMState CRs to enqueue from namespace event")
+		return nil
+	}
+	requests := []ctrl.Request{}
+	for i := range nmstateList.Items {
+		requests = append(requests, ctrl.Request{NamespacedName: types.NamespacedName{Name: nmstateList.Items[i].Name}})
+	}
+	return requests
+}
+
 func (r *NMStateReconciler) applyManifests(instance *nmstatev1.NMState, ctx context.Context) error {
 	if err := r.applyCRDs(ctx, instance); err != nil {
 		return errors.Wrap(err, "failed applying CRDs")

controllers/operator/nmstate_controller_test.go

@@ -224,6 +224,19 @@ var _ = Describe("NMState controller reconcile", func() {
 			Expect(result).To(Equal(ctrl.Result{RequeueAfter: ResyncPeriod}))
 		})
 	})
+	Context("when handler namespace events are mapped to reconcile requests", func() {
+		newNamespace := func(name string) *corev1.Namespace {
+			return &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: name}}
+		}
+		It("should enqueue a request for the NMState CR on handler namespace events", func() {
+			requests := reconciler.nmstateRequestsFromHandlerNamespace(context.Background(), newNamespace(handlerNamespace))
+			Expect(requests).To(ConsistOf(ctrl.Request{NamespacedName: types.NamespacedName{Name: existingNMStateName}}))
+		})
+		It("should not enqueue requests for other namespaces", func() {
+			requests := reconciler.nmstateRequestsFromHandlerNamespace(context.Background(), newNamespace("some-other-namespace"))
+			Expect(requests).To(BeEmpty())
+		})
+	})
 	Context("when one of manifest directory is empty", func() {
 		var (
 			request ctrl.Request