Skip to content

fix: rbac for namespaceSelector in Gateway Namespace Mode#8014

Merged
zirain merged 3 commits intoenvoyproxy:mainfrom
cnvergence:fix-watch-namespaceselector
Jan 28, 2026
Merged

fix: rbac for namespaceSelector in Gateway Namespace Mode#8014
zirain merged 3 commits intoenvoyproxy:mainfrom
cnvergence:fix-watch-namespaceselector

Conversation

@cnvergence
Copy link
Copy Markdown
Member

@cnvergence cnvergence commented Jan 21, 2026

What type of PR is this?

What this PR does / why we need it:

This PR adds cluster roles when namespace selector is used with namespace watch.

Which issue(s) this PR fixes:

Fixes #7617

Release Notes: Yes/No

@netlify
Copy link
Copy Markdown

netlify bot commented Jan 21, 2026

Deploy Preview for cerulean-figolla-1f9435 canceled.

Name Link
🔨 Latest commit a53ce15
🔍 Latest deploy log https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6978cafc71c3fa000880af3a

@cnvergence
Copy link
Copy Markdown
Member Author

cnvergence commented Jan 21, 2026

This PR currently sets a ClusterRole with Helm, if namespaceSelector is set with GatewayNamespace mode.
We would need move RBAC creation to the controller code, if we would like to support namespaces dynamically, but I think it will be much better to leave it up to users, given we will have a opt-out possibility for default Helm Chart RBAC.

@codecov
Copy link
Copy Markdown

codecov bot commented Jan 21, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.77%. Comparing base (d78c894) to head (a53ce15).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #8014      +/-   ##
==========================================
- Coverage   73.80%   73.77%   -0.03%     
==========================================
  Files         237      237              
  Lines       35753    35753              
==========================================
- Hits        26386    26376      -10     
- Misses       7512     7520       +8     
- Partials     1855     1857       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@cnvergence cnvergence marked this pull request as ready for review January 23, 2026 09:15
@cnvergence cnvergence requested a review from a team as a code owner January 23, 2026 09:15
@cnvergence cnvergence added this to the v1.7.0-rc.1 Release milestone Jan 23, 2026
@zirain zirain force-pushed the fix-watch-namespaceselector branch from 576d57f to c475603 Compare January 24, 2026 05:43
@zirain
Copy link
Copy Markdown
Member

zirain commented Jan 24, 2026

is this a fix or a feature, do we need to backport this?

arkodg
arkodg previously approved these changes Jan 24, 2026
@arkodg arkodg requested review from a team January 24, 2026 18:26
@zirain zirain force-pushed the fix-watch-namespaceselector branch from 44098cd to adbc420 Compare January 25, 2026 04:16
kkk777-7
kkk777-7 previously approved these changes Jan 25, 2026
@arkodg
Copy link
Copy Markdown
Contributor

arkodg commented Jan 25, 2026

gateway-namespace-mode tests seems to consistenly fail

@cnvergence
Copy link
Copy Markdown
Member Author

/retest

1 similar comment
@cnvergence
Copy link
Copy Markdown
Member Author

/retest

@cnvergence cnvergence dismissed stale reviews from arkodg and kkk777-7 via 177294f January 26, 2026 11:39
@cnvergence cnvergence force-pushed the fix-watch-namespaceselector branch from b596bf5 to 177294f Compare January 26, 2026 11:39
@zirain zirain force-pushed the fix-watch-namespaceselector branch from 6c574aa to 788aeb4 Compare January 27, 2026 00:26
zirain
zirain previously approved these changes Jan 27, 2026
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
@cnvergence cnvergence force-pushed the fix-watch-namespaceselector branch from 788aeb4 to 92ae167 Compare January 27, 2026 14:20
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
@zirain
Copy link
Copy Markdown
Member

zirain commented Jan 28, 2026

/retest

@zirain zirain merged commit 36d98d1 into envoyproxy:main Jan 28, 2026
61 of 65 checks passed
SadmiB pushed a commit to SadmiB/gateway that referenced this pull request Jan 30, 2026
…#8014)

* fix: rbac for namespaceSelector in Gateway Namespace Mode

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* double check the conditional logic

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* readd the comment in the helm template

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

---------

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
Signed-off-by: Sadmi Bouhafs <sadmibouhafs@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Watch namespaceselector doesnt have rbacs created

5 participants