feat(main): add --watch-namespace to scope the manager cache#341
feat(main): add --watch-namespace to scope the manager cache#341K.J. Valencik (kjvalencik) wants to merge 1 commit into
Conversation
github-actions
Bot
added
the
documentation
|
Warning Review limit reached
Next review available in: 51 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (5)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
K.J. Valencik (kjvalencik)
force-pushed
the
kj/watch-namespaces
branch
from
7cbb390 to
6b58045
Compare
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces support for scoping the etcd-operator to watch specific namespaces instead of all namespaces. It adds a --watch-namespace flag and a corresponding WATCH_NAMESPACE environment variable to the manager, updates the Helm chart to support this configuration via manager.watchNamespaces, and updates the documentation and tests accordingly. The review feedback suggests making the Helm template more robust by handling cases where manager.watchNamespaces is provided as a string instead of a slice to prevent template rendering errors.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
The manager's default cluster-wide cache holds every Pod, PVC, Service, Job, and PDB in the cluster; on large clusters this OOM-kills the manager against the chart's default 128Mi limit. Add a --watch-namespace flag (defaulting to $WATCH_NAMESPACE, per the operator-sdk convention) taking a comma-separated namespace list, wired into the manager's Cache.DefaultNamespaces. Empty/unset preserves the current watch-everything behavior. The chart exposes it as manager.watchNamespaces, rendered onto the manager container as the WATCH_NAMESPACE env var. RBAC is intentionally untouched: the ClusterRole continues to authorize the scoped watches. Signed-off-by: K.J. Valencik <kjvalencik@gmail.com>
K.J. Valencik (kjvalencik)
force-pushed
the
kj/watch-namespaces
branch
from
6b58045 to
5b7b50c
Compare
1 participant
Motivation
The manager's controller-runtime cache defaults to cluster-wide watches for every secondary resource it owns (Pods, PVCs, Services, Jobs, PDBs). On large clusters, caching every pod in the cluster can OOM-kill the manager against the chart's default 128Mi limit — even when only a handful of namespaces contain etcd clusters.
docs/installation.mdpreviously called this out as an unexposed follow-up.Related: #199
Changes
--watch-namespaceflag, defaulting to$WATCH_NAMESPACE(operator-sdk convention): a comma-separated namespace list wired into the manager'sCache.DefaultNamespaces. Empty/unset keeps today's watch-everything behavior.manager.watchNamespaces(list) renders theWATCH_NAMESPACEenv var onto the manager container. Unset by default.RBAC
Intentionally untouched — the existing ClusterRole authorizes the scoped watches. Since every rule in the manager role covers namespaced resources, this change also makes it possible to run with per-namespace
Roles instead of the ClusterRole (with the metrics proxy disabled, as its TokenReview/SubjectAccessReview permissions are cluster-scoped) — left as a future improvement.Testing
cache.Options, keeping the unset path identical to the previous behavior.make testpasses;helm template/helm lintverified with and without the value set.