Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

Support namespace caches for authorized local Secrets

Ouverte
  • Quelque chose ne va pas ?
#195 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Personne n'a encore pris cette issue.

Évaluation

Difficulté
5/5
Temps estimé
Plus d'une semaine
Accessibilité débutants
35/100
Type d'issue
Fonctionnalité
Clarté
Plutôt claire
Activité
Active
Stack technique
go
Domaine
api, backend

Piste de recherche

Read the local manager setup in cmd/api-syncagent/main.go and the local and related-resource clients in internal/controller/sync/controller.go. Start by tracing how Secret informers are created and how namespace permissions are managed; the issue also points to Issue 113 for namespace deletion context. Done means namespace-scoped Secret caches cover primary and related Secret operations, include the state namespace, keep cluster-scoped resources separate, and handle startup, shutdown, and an empty namespace set safely.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Feature Description

The local manager has no namespace limit for its cache.
A Secret informer therefore needs cluster-wide list and watch permissions.
Namespace RoleBindings cannot grant those operations across all namespaces.
An event predicate filters objects after the API request. It cannot narrow the request scope.

To reproduce
  1. Configure a published resource with a local Secret or a related Secret.
  2. Grant Secret access only in sample-space and the agent state namespace.
  3. Start the agent with its required permissions for other resource types.
  4. Observe the Secret informer request scope.
Actual behavior

The informer requests Secrets across all namespaces. Namespace RoleBindings cannot authorize the request.

Expected behavior

An explicit namespace set limits the Secret informer to authorized namespaces.

Proposed Solution

Support namespace caches for local Secrets.
Keep cluster-scoped resources separate. Include the fixed state namespace.
Create each namespace permission before its informer starts.
Define how the informer stops before namespace permissions disappear.
An empty namespace set must not create an all-namespace informer.
Cover primary and related Secret reads, writes, patches, and deletion.

Alternative Solutions

Cluster-wide Secret permissions permit the current cache. They exceed the required namespace access.
The agent namespace flag controls its own namespace. It does not define the tenant namespace set.

Want to contribute?

No implementation commitment accompanies this request.

Additional Context

Source check: 2026-10-30, default branch main, commit 7d8db2c9ce67562bcb23968ea651fd4f2fa52a01.

Local manager setup.
Local manager client.
Related-resource local client.

Issue 113 concerns namespace deletion after unbind.
It does not add namespace caches. No current live test or patch accompanies this request.

Langage dominant
Go
Étoiles
25
Forks
32
Aucune PR mergée en 30 j

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de kcp-dev/api-syncagent

Toutes les issues de kcp-dev/api-syncagent

Issues similaires

Plus d'issues Go

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.