[CFP-39876]: Implement global namespace support for CEP, identities and slices by anubhabMajumdar · Pull Request #42905 · cilium/cilium

anubhabMajumdar · 2025-11-20T23:39:22Z

Description

This PR is laying the foundation for cilium/design-cfps#74 .

Adds namespace-level filtering for a subset of ClusterMesh resource synchronization using the clustermesh.cilium.io/global annotation, allowing administrators to control which namespaces export resources to the kvstore. Resources handled in this PR are CiliumEndpoints, CiliumIdentities and CiliumEndpointSlices.

Key changes

New clustermesh.cilium.io/global annotation to mark namespaces for export
Namespace manager tracks global status with --clustermesh-default-global-namespace flag (default: true)
Resource synchronizers filter resource events based on namespace global status
Automatic cleanup when resources move out of global namespaces
Namespace event handling triggers resynchronization of affected resources (ex: annotating namespace as global or local)

Behavior

All namespaces are global by default (backward compatible), i.e., --clustermesh-default-global-namespace=true by default
Opt-out: add clustermesh.cilium.io/global: "false" to namespace
When flag is false, namespaces must opt-in with annotation set to "true"
Resources automatically removed from kvstore when namespace becomes non-global
The flag is currently hidden from users as feature is incomplete

Testing Done

Setup two kind clusters using make kind-clustermesh
Build and install clustermesh with enable-default-global-namespace=false
Exec into kvstoremesh container k exec -it deploy/clustermesh-apiserver -c kvstoremesh --context=kind-clustermesh2 --namespace=kube-system -- clustermesh-apiserver shell
Check clustermesh kvstore using kvstore/list --keys-only --output=string (no identities or endpoints)
Annotate default namespace in both cluster
Check clustermesh kvstore using kvstore/list --keys-only --output=string (identities and endpoints present now)
Created/Deleted deployments to check kvstore is updated accordingly
Deployed Hubble to make sure during cross cluster communication, flow logs are accurate (with annotation, I see pod -> pod flows, but w/o annotation pod->IP flows)
New unit tests
New E2E tests using the Hive script

Please ensure your pull request adheres to the following guidelines:

For first time contributors, read Submitting a pull request
All code is covered by unit and/or runtime tests where feasible.
All commits contain a well written commit description including a title,
description and a Fixes: #XXX line if the commit addresses a particular
GitHub issue.
If your commit description contains a Fixes: <commit-id> tag, then
please add the commit author[s] as reviewer[s] to this issue.
All commits are signed off. See the section Developer’s Certificate of Origin
Provide a title or release-note blurb suitable for the release notes.
Are you a user of Cilium? Please add yourself to the Users doc
Thanks for contributing!

Fixes: #issue-number

<!-- Enter the release note text here if needed or remove this section! -->

anubhabMajumdar · 2025-11-22T00:48:30Z

Fixing the lint issues.

youngnick · 2025-11-24T03:33:41Z

Still some lint issues remaining, you'll need to fix both the goimports and slog fields not being constant errors.

MrFreezeex

Thanks! 🙏 The approach seems to make sense to me overall, I left an initial review with some comment inline.

Also I think it would makes sense to split a bit more your commits, the namespace helpers seems to be an obvious candidate for this at least 🤔,

clustermesh-apiserver/clustermesh/synchronizer.go

clustermesh-apiserver/clustermesh/k8s/namespace.go

pkg/clustermesh/namespace/namespace.go

giorio94

Thanks @anubhabMajumdar for iterating on this!

I've started reviewing the new approach, and left a few initial high level comments. Overall it looks better to me compared to the previous ones, but I still have a few reservations detailed inline.

A few more general comments:

Make sure that the commits pass the basic linting checks before marking a PR ready for review, as there are currently multiple failures (and also compilation errors in tests)
Make sure that the implementation is actually working; the clustermesh-apiserver is currently crashing due to unmet hive dependencies;
The clustermesh-apiserver package makes already use of script tests. Please introduce one or more new script test file to validate the correct functioning of the new namespace filtering E2E, to increase confidence in the correctness of the implementation and prevent future regressions.
The current implementation is entirely included in a single large commit, which makes the review process complex. Please split it into multiple commits, each complemented by a commit message to detail the rationale behind each set of changes. See the amazing split done by @jshr-w in #38388 as an example.

pkg/clustermesh/namespace/namespace.go

pkg/clustermesh/namespace/namespace_test.go

pkg/clustermesh/namespace/cell.go

clustermesh-apiserver/clustermesh/synchronizer.go

clustermesh-apiserver/clustermesh/converters.go

anubhabMajumdar · 2025-12-02T21:27:29Z

Fixing the lint issues and will add one more commit for the script tests.

anubhabMajumdar · 2025-12-03T04:45:04Z

@MrFreezeex @giorio94

Thanks for your reviews. I have:

addressed all comments
split changes into granular commits
added new e2e tests for cluster mesh

Cheers!

gandro

Helm structure-wise this looks okay to me. I do have some concerns regarding the naming and enabling this by default

install/kubernetes/cilium/values.yaml.tmpl

anubhabMajumdar · 2025-12-03T16:36:05Z

/test

anubhabMajumdar · 2025-12-03T17:56:35Z

/test

Fixed one test issues. Rest seems to stem from the configurations to the helm chart, but that was removed.

anubhabMajumdar · 2025-12-17T00:24:13Z

/test

anubhabMajumdar · 2025-12-17T02:05:17Z

/test

Had to rebase to fix the last commit length. Will restart the tests again.

anubhabMajumdar · 2025-12-17T02:06:37Z

/test

MrFreezeex

Thanks the PR seems to be in a great shape overall, I left some minor question/comments about a few things in the code that I spotted

clustermesh-apiserver/clustermesh/synchronizer.go

anubhabMajumdar · 2025-12-17T17:24:23Z

@giorio94 @MrFreezeex
Addressed your comments, let me know if this looks good. Thanks :-)

giorio94

Addressed your comments, let me know if this looks good. Thanks :-)

There's still one bug introduced in the last iteration, but looks good to me otherwise.

clustermesh-apiserver/clustermesh/synchronizer.go

clustermesh-apiserver/clustermesh/testdata/ciliumendpointslices.txtar

…onizer Add namespace filtering to synchronizer to only sync resources from global namespaces. - Add Namespacer interface and implementations for namespace extraction - Integrate namespace manager into synchronizer to filter events - Watch namespace changes and resynchronize affected resources - Mark CiliumIdentity, CiliumEndpoint, and CiliumEndpointSlice as namespaced Signed-off-by: Anubhab Majumdar <anmajumdar@microsoft.com>

Add integration tests for global namespace filtering behavior. - Add globalnamespace.txtar to test clustermesh-default-global-namespace=false - Update existing tests with namespace resources - Test namespace annotation changes and deletions Signed-off-by: Anubhab Majumdar <anmajumdar@microsoft.com>

anubhabMajumdar · 2025-12-17T18:38:22Z

Addressed your comments, let me know if this looks good. Thanks :-)

There's still one bug introduced in the last iteration, but looks good to me otherwise.

Thanks for reviewing this multiple times!

anubhabMajumdar · 2025-12-17T19:26:03Z

/test

anubhabMajumdar · 2025-12-17T21:27:59Z

/ci-delegated-ipam

giorio94

/lgtm, thanks!

MrFreezeex

Thanks!

anubhabMajumdar · 2025-12-19T17:39:56Z

Thanks @MrFreezeex @giorio94 @youngnick for repeated reviews. Cheers!

anubhabMajumdar requested review from a team as code owners November 20, 2025 23:39

anubhabMajumdar requested review from MrFreezeex and youngnick November 20, 2025 23:39

maintainer-s-little-helper bot added the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label Nov 20, 2025

anubhabMajumdar mentioned this pull request Nov 20, 2025

feat(clustermesh): Implement namespace watcher required for CFP-39876 #42527

Closed

8 tasks

giorio94 self-requested a review November 21, 2025 17:54

anubhabMajumdar force-pushed the topic/anmajumdar/cm-ns-sync branch from ec54724 to 537a310 Compare November 24, 2025 21:20

MrFreezeex requested changes Nov 24, 2025

View reviewed changes

giorio94 requested changes Dec 1, 2025

View reviewed changes

anubhabMajumdar force-pushed the topic/anmajumdar/cm-ns-sync branch from f0f962c to 2dfc21c Compare December 2, 2025 21:06

anubhabMajumdar requested review from a team as code owners December 2, 2025 21:06

anubhabMajumdar requested review from gandro and tommyp1ckles December 2, 2025 21:06

anubhabMajumdar force-pushed the topic/anmajumdar/cm-ns-sync branch 5 times, most recently from d5a6db0 to 5d6176c Compare December 3, 2025 03:34

anubhabMajumdar requested review from MrFreezeex and giorio94 December 3, 2025 04:45

gandro reviewed Dec 3, 2025

View reviewed changes

install/kubernetes/cilium/values.yaml.tmpl Outdated Show resolved Hide resolved

anubhabMajumdar force-pushed the topic/anmajumdar/cm-ns-sync branch from 5d6176c to 5bd00d4 Compare December 3, 2025 17:46

maintainer-s-little-helper bot requested a review from giorio94 December 17, 2025 01:08

anubhabMajumdar force-pushed the topic/anmajumdar/cm-ns-sync branch from bb895a6 to 9eefe9f Compare December 17, 2025 02:02

MrFreezeex reviewed Dec 17, 2025

View reviewed changes

anubhabMajumdar force-pushed the topic/anmajumdar/cm-ns-sync branch from 9eefe9f to b117415 Compare December 17, 2025 17:22

anubhabMajumdar requested a review from MrFreezeex December 17, 2025 17:23

giorio94 requested changes Dec 17, 2025

View reviewed changes

anubhabMajumdar added 2 commits December 17, 2025 12:37

anubhabMajumdar force-pushed the topic/anmajumdar/cm-ns-sync branch from b117415 to b9a43dc Compare December 17, 2025 18:37

maintainer-s-little-helper bot requested a review from giorio94 December 17, 2025 20:10

giorio94 approved these changes Dec 18, 2025

View reviewed changes

MrFreezeex approved these changes Dec 19, 2025

View reviewed changes

maintainer-s-little-helper bot added the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label Dec 19, 2025

MrFreezeex added this pull request to the merge queue Dec 19, 2025

Merged via the queue into cilium:main with commit b5d3df3 Dec 19, 2025
78 checks passed

anubhabMajumdar deleted the topic/anmajumdar/cm-ns-sync branch December 19, 2025 17:44

anubhabMajumdar mentioned this pull request Jan 22, 2026

clustermesh: Enable global namespace default configuration option #43918

Merged

8 tasks

jimassa mentioned this pull request Jan 27, 2026

[CFP-39876]: Add namespace filtering conditions to ServiceImport controller #44040

Merged

2 tasks

cilium-release-bot bot moved this to Released in cilium v1.19.0 Feb 3, 2026

cilium-release-bot bot added this to cilium v1.19.0 Feb 3, 2026

jimassa mentioned this pull request Feb 19, 2026

[CFP-39876]: Add connectivity test for non-global namespace isolation #44450

Draft

Conversation

anubhabMajumdar commented Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Key changes

Behavior

Testing Done

Uh oh!

anubhabMajumdar commented Nov 22, 2025

Uh oh!

youngnick commented Nov 24, 2025

Uh oh!

MrFreezeex left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

giorio94 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

anubhabMajumdar commented Dec 2, 2025

Uh oh!

anubhabMajumdar commented Dec 3, 2025

Uh oh!

gandro left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

anubhabMajumdar commented Dec 3, 2025

Uh oh!

anubhabMajumdar commented Dec 3, 2025

Uh oh!

anubhabMajumdar commented Dec 17, 2025

Uh oh!

anubhabMajumdar commented Dec 17, 2025

Uh oh!

anubhabMajumdar commented Dec 17, 2025

Uh oh!

MrFreezeex left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

anubhabMajumdar commented Dec 17, 2025

Uh oh!

giorio94 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

anubhabMajumdar commented Dec 17, 2025

Uh oh!

anubhabMajumdar commented Dec 17, 2025

Uh oh!

anubhabMajumdar commented Dec 17, 2025

Uh oh!

giorio94 left a comment

Choose a reason for hiding this comment

Uh oh!

MrFreezeex left a comment

Choose a reason for hiding this comment

Uh oh!

anubhabMajumdar commented Nov 20, 2025 •

edited

Loading