fix(extraresources): preserve namespace when matching by labels - #612
Open
pujitha24 wants to merge 1 commit into
Open
fix(extraresources): preserve namespace when matching by labels#612pujitha24 wants to merge 1 commit into
pujitha24 wants to merge 1 commit into
Conversation
Motivation: ToResourceSelector converted an ExtraResourcesRequirement into a fnv1.ResourceSelector, but only copied the Namespace field onto the selector inside the matchName branch. Namespace is a top-level field on the proto ResourceSelector, independent of the match oneof (matchLabels vs matchName), so when a requirement combined matchLabels with a namespace, the namespace was silently dropped and the query matched labelled resources across all namespaces instead of the requested one. This reproduces the exact behavior reported in the issue: HTTPRoutes selected by matchLabels with a namespace set came back from every namespace, not just the specified one. Approach: move the namespace assignment above the matchLabels/ matchName branch so it is applied to both selector types instead of only matchName. Validation: added extraresources_test.go with TestToResourceSelector, covering matchLabels+namespace (the bug scenario), matchLabels without a namespace (cluster-scoped, must remain unset), and matchName+ namespace (regression guard for the previously-working path). Ran `go test -v -cover ./...`, which passed (82.9% coverage); confirmed via `git stash` that the matchLabels+namespace case fails against the pre-fix code and passes with the fix. Also ran `go build ./...`, `go vet ./...`, `go mod tidy` (no diff), and `golangci-lint run ./...` at v2.4.0 (the version pinned in this repo's CI workflow), all with no issues. User-visible behavior for matchName selectors is unchanged; the only behavior change is that matchLabels selectors now honor the namespace field as documented, narrowing results to the requested namespace instead of matching cluster-wide. Report: crossplane-contrib#597 Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
pujitha24
requested review from
adamwg,
bobh66,
ezgidemirel,
phisco,
sergenyalcin,
turkenf and
ulucinar
as code owners
August 10, 2026 11:40
2 tasks
Contributor
Author
|
Just checking in on this one — it's rebased and all checks are green, happy to make any changes if something would help review go faster. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of your changes
ToResourceSelectorconverts anExtraResourcesRequirementinto afnv1.ResourceSelector, but only copied theNamespacefield onto the selector inside thematchNamebranch.Namespaceis a top-level field on the protoResourceSelector, independent of the match oneof (matchLabelsvsmatchName), so when a requirement combinedmatchLabelswith a namespace, the namespace was silently dropped and the query matched labelled resources across all namespaces instead of the requested one. This reproduces the exact behavior reported in the issue: HTTPRoutes selected bymatchLabelswith a namespace set came back from every namespace, not just the specified one.The fix moves the namespace assignment above the
matchLabels/matchNamebranch so it is applied to both selector types instead of onlymatchName.Added
extraresources_test.gowithTestToResourceSelector, coveringmatchLabels+namespace (the bug scenario),matchLabelswithout a namespace (cluster-scoped, must remain unset), andmatchName+namespace (regression guard for the previously-working path). Rango test -v -cover ./..., which passed (82.9% coverage); confirmed viagit stashthat thematchLabels+namespace case fails against the pre-fix code and passes with the fix. Also rango build ./...,go vet ./...,go mod tidy(no diff), andgolangci-lint run ./...at v2.4.0 (the version pinned in this repo's CI workflow), all with no issues. User-visible behavior formatchNameselectors is unchanged; the only behavior change is thatmatchLabelsselectors now honor the namespace field as documented, narrowing results to the requested namespace instead of matching cluster-wide.Fixes #597
I have:
AI assistance: this change was drafted with Claude Code.