[CFP-39876]: Add namespace filtering to service sync and MCS API service exports by jimassa · Pull Request #43385 · cilium/cilium

jimassa · 2025-12-16T20:28:29Z

Description

Follow-up to #42905, continuing the implementation of CFP-74.

Adds namespace filtering to service sync and MCS-API ServiceExport sync. Services and ServiceExports are only synced to the kvstore when they belong to a "global" namespace.

By default all namespaces are global. Set --clustermesh-default-global-namespace=false to require explicit clustermesh.cilium.io/global="true" annotation.

Changes

operator/watchers/service_sync.go

Add namespace event watcher to re-sync services when namespace global status changes
Filter services based on namespace global status before syncing

pkg/clustermesh/mcsapi/serviceexportsync.go

Add namespace event watcher to re-sync ServiceExports when namespace global status changes
Filter ServiceExports based on namespace global status before syncing

Tests

operator/watchers/testdata/globalnamespace-services.txtar: Script test for service sync filtering (including dynamic namespace changes)
pkg/clustermesh/mcsapi/serviceexportsync_test.go: Unit test for ServiceExport sync filtering

Manual Testing on Kind Clusters

Tested on two kind clusters with ClusterMesh enabled and --clustermesh-default-global-namespace=false:

Setup

Two kind clusters using make kind-clustermesh and make kind-clustermesh-images
Cilium installed with ClusterMesh enabled, namespace filtering flag, and MCS API enabled

Service Namespace Filtering Results

Test	Result
Created global service in default namespace (without namespace annotation)	NOT synced to kvstore
Annotated namespace with `clustermesh.cilium.io/global=true`	Service synced to kvstore
Created another global service	Immediately synced to kvstore
Removed namespace annotation	Services removed from kvstore

ServiceExport Namespace Filtering Results (MCS API)

Test	Result
Created ServiceExport in default namespace (without namespace annotation)	NOT synced to kvstore
Annotated namespace with `clustermesh.cilium.io/global=true`	ServiceExport synced to kvstore
Removed namespace annotation	ServiceExport removed from kvstore

Verification Commands Used

# Check services in kvstore
kubectl exec deploy/clustermesh-apiserver -c kvstoremesh \
    --context=kind-clustermesh1 --namespace=kube-system -- \
    clustermesh-apiserver shell kvstore/list cilium/state/services

# Check serviceexports in kvstore
kubectl exec deploy/clustermesh-apiserver -c kvstoremesh \
    --context=kind-clustermesh1 --namespace=kube-system -- \
    clustermesh-apiserver shell kvstore/list cilium/state/serviceexports

Please ensure your pull request adheres to the following guidelines:

For first time contributors, read Submitting a pull request
All code is covered by unit and/or runtime tests where feasible.
All commits contain a well written commit description including a title,
description and a Fixes: #XXX line if the commit addresses a particular
GitHub issue.
All commits are signed off. See the section Developer's Certificate of Origin
Provide a title or release-note blurb suitable for the release notes.
Thanks for contributing!

Add global namespace filtering support to service sync and MCS API service exports for improved ClusterMesh scalability

maintainer-s-little-helper · 2025-12-16T20:28:32Z

Commit 6a96074 does not match "(?m)^Signed-off-by:".

Please follow instructions provided in https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#developer-s-certificate-of-origin

maintainer-s-little-helper · 2025-12-16T22:35:08Z

Commit 6a96074 does not match "(?m)^Signed-off-by:".

Please follow instructions provided in https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#developer-s-certificate-of-origin

maintainer-s-little-helper · 2025-12-18T22:20:31Z

Commit ec7ea5b does not match "(?m)^Signed-off-by:".

Please follow instructions provided in https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#developer-s-certificate-of-origin

maintainer-s-little-helper · 2025-12-19T17:50:47Z

Commit d569d22 does not match "(?m)^Signed-off-by:".

Please follow instructions provided in https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#developer-s-certificate-of-origin

MrFreezeex

Hi 👋, thanks for the PR, could you cleanup your git history so that it only includes the relevant commit, thanks!

anubhabMajumdar

Left comments for service_sync.go. Lot of the comments apply for serviceexportsync.go too.
Also, can you add new tests under testdata to cover the new scenarios?
Thanks!

operator/watchers/service_sync.go

anubhabMajumdar · 2026-01-21T18:17:17Z

/ci-kpr

giorio94

Please apply the patch from the inline comment to fix the unreliable test. Looks good to me otherwise.

pkg/clustermesh/mcsapi/serviceexportsync_test.go

giorio94

Thanks!

giorio94 · 2026-01-22T10:40:36Z

/test

giorio94 · 2026-01-26T11:17:24Z

@jimassa It looks like this PR picked a conflict, and will need to be rebased.

Filter services synced to the kvstore based on namespace annotations. By default all namespaces are global; set clustermesh-default-global-namespace=false to require explicit clustermesh.cilium.io/global="true" annotation. Signed-off-by: Jacques Massa <jac.massa0908@gmail.com>

Extend namespace filtering to MCS-API ServiceExport sync, using the same global namespace logic as service sync. ServiceExports in non-global namespaces are not synced to the kvstore. Signed-off-by: Jacques Massa <jac.massa0908@gmail.com>

giorio94 · 2026-01-26T14:03:54Z

/test

giorio94 · 2026-01-26T14:04:25Z

@cilium/operator Gentle ping 🙏

pkg/clustermesh/mcsapi/serviceexportsync.go

anubhabMajumdar · 2026-01-26T22:58:42Z

/ci-l3-l4

operator/watchers/service_sync.go

maintainer-s-little-helper bot added dont-merge/needs-sign-off The author needs to add signoff to their commits before merge. dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. labels Dec 16, 2025

github-actions bot added the kind/community-contribution This was a contribution made by a community member. label Dec 16, 2025

jimassa force-pushed the topic/jimassa/cm-ns-sync-services branch from 433c605 to b0d5524 Compare December 16, 2025 22:38

maintainer-s-little-helper bot removed the dont-merge/needs-sign-off The author needs to add signoff to their commits before merge. label Dec 16, 2025

jimassa force-pushed the topic/jimassa/cm-ns-sync-services branch from b0d5524 to ec7ea5b Compare December 18, 2025 22:20

maintainer-s-little-helper bot added the dont-merge/needs-sign-off The author needs to add signoff to their commits before merge. label Dec 18, 2025

jimassa force-pushed the topic/jimassa/cm-ns-sync-services branch from ec7ea5b to f7228b6 Compare December 18, 2025 22:22

maintainer-s-little-helper bot removed the dont-merge/needs-sign-off The author needs to add signoff to their commits before merge. label Dec 18, 2025

jimassa force-pushed the topic/jimassa/cm-ns-sync-services branch from f7228b6 to 78a01e0 Compare December 18, 2025 22:32

maintainer-s-little-helper bot added the dont-merge/needs-sign-off The author needs to add signoff to their commits before merge. label Dec 19, 2025

jimassa force-pushed the topic/jimassa/cm-ns-sync-services branch from d569d22 to cc6941f Compare December 19, 2025 18:00

maintainer-s-little-helper bot removed the dont-merge/needs-sign-off The author needs to add signoff to their commits before merge. label Dec 19, 2025

jimassa marked this pull request as ready for review December 19, 2025 18:02

jimassa requested review from a team as code owners December 19, 2025 18:02

jimassa requested review from MrFreezeex and squeed December 19, 2025 18:02

MrFreezeex added area/clustermesh Relates to multi-cluster routing functionality in Cilium. release-note/misc This PR makes changes that have no direct user impact. and removed dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. labels Dec 19, 2025

MrFreezeex requested changes Dec 19, 2025

View reviewed changes

anubhabMajumdar reviewed Dec 19, 2025

View reviewed changes

jimassa force-pushed the topic/jimassa/cm-ns-sync-services branch from cc6941f to c507889 Compare December 19, 2025 22:20

jimassa requested a review from a team as a code owner December 19, 2025 22:20

jimassa force-pushed the topic/jimassa/cm-ns-sync-services branch from c507889 to f5155fc Compare December 19, 2025 22:25

anubhabMajumdar approved these changes Jan 21, 2026

View reviewed changes

giorio94 requested changes Jan 22, 2026

View reviewed changes

pkg/clustermesh/mcsapi/serviceexportsync_test.go Show resolved Hide resolved

jimassa force-pushed the topic/jimassa/cm-ns-sync-services branch from 3f2c807 to e8c5d43 Compare January 22, 2026 10:10

giorio94 approved these changes Jan 22, 2026

View reviewed changes

giorio94 enabled auto-merge January 22, 2026 10:40

giorio94 requested a review from squeed January 22, 2026 10:41

anubhabMajumdar mentioned this pull request Jan 22, 2026

clustermesh: Enable global namespace default configuration option #43918

Merged

8 tasks

giorio94 added the dont-merge/needs-rebase This PR needs to be rebased because it has merge conflicts. label Jan 26, 2026

giorio94 disabled auto-merge January 26, 2026 11:17

jimassa added 2 commits January 26, 2026 08:48

jimassa force-pushed the topic/jimassa/cm-ns-sync-services branch from e8c5d43 to 8717cde Compare January 26, 2026 13:51

giorio94 removed the dont-merge/needs-rebase This PR needs to be rebased because it has merge conflicts. label Jan 26, 2026

MrFreezeex reviewed Jan 26, 2026

View reviewed changes

pkg/clustermesh/mcsapi/serviceexportsync.go Show resolved Hide resolved

jimassa mentioned this pull request Jan 27, 2026

[CFP-39876]: Add namespace filtering conditions to ServiceImport controller #44040

Merged

2 tasks

squeed reviewed Jan 28, 2026

View reviewed changes

operator/watchers/service_sync.go Show resolved Hide resolved

maintainer-s-little-helper bot added the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label Jan 28, 2026

jimassa mentioned this pull request Jan 29, 2026

Optimize namespace update handling in clustermesh to avoid unnecessary CPU cycles when global status unchanged #44065

Closed

squeed approved these changes Feb 2, 2026

View reviewed changes

squeed enabled auto-merge February 2, 2026 11:38

squeed added this pull request to the merge queue Feb 2, 2026

Merged via the queue into cilium:main with commit d7aca94 Feb 2, 2026
75 of 76 checks passed

jimassa mentioned this pull request Feb 19, 2026

[CFP-39876]: Add connectivity test for non-global namespace isolation #44450

Draft

Conversation

jimassa commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes

operator/watchers/service_sync.go

pkg/clustermesh/mcsapi/serviceexportsync.go

Tests

Manual Testing on Kind Clusters

Setup

Service Namespace Filtering Results

ServiceExport Namespace Filtering Results (MCS API)

Verification Commands Used

Uh oh!

maintainer-s-little-helper bot commented Dec 16, 2025

Uh oh!

maintainer-s-little-helper bot commented Dec 16, 2025

Uh oh!

maintainer-s-little-helper bot commented Dec 18, 2025

Uh oh!

maintainer-s-little-helper bot commented Dec 19, 2025

Uh oh!

MrFreezeex left a comment

Choose a reason for hiding this comment

Uh oh!

anubhabMajumdar left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

anubhabMajumdar commented Jan 21, 2026

Uh oh!

giorio94 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

giorio94 left a comment

Choose a reason for hiding this comment

Uh oh!

giorio94 commented Jan 22, 2026

Uh oh!

giorio94 commented Jan 26, 2026

Uh oh!

giorio94 commented Jan 26, 2026

Uh oh!

giorio94 commented Jan 26, 2026

Uh oh!

Uh oh!

anubhabMajumdar commented Jan 26, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

jimassa commented Dec 16, 2025 •

edited

Loading