Skip to content

deny list implementation via predicates#1770

Merged
sunsingerus merged 1 commit intoAltinity:0.25.4from
AdheipSingh:feat/denylist
Sep 5, 2025
Merged

deny list implementation via predicates#1770
sunsingerus merged 1 commit intoAltinity:0.25.4from
AdheipSingh:feat/denylist

Conversation

@AdheipSingh
Copy link
Copy Markdown
Contributor

@AdheipSingh AdheipSingh commented Jul 15, 2025 •
edited
Loading

  • Use case: I want the operator to watch all namespaces but exclude namespaces x, y, and z. This is particularly useful in a multi-tenant scenario where the operator is reconciling X number of CHIs and has full watch privileges across namespaces. At that point, we can restrict the operator from watching specific namespaces where secure applications are running.

  • Predicates based implementation will filter out the event before enqueueing it in worker-queue .

Important items to consider before making a Pull Request

Please check items PR complies to:

  • All commits in the PR are squashed. More info
  • The PR is made into dedicated next-release branch, not into master branch1. More info
  • The PR is signed. More info

--

@AdheipSingh AdheipSingh changed the base branch from master to 0.25.2 July 15, 2025 21:09
@AdheipSingh AdheipSingh changed the base branch from 0.25.2 to 0.25.3 July 15, 2025 21:10
@sunsingerus
Copy link
Copy Markdown
Collaborator

sunsingerus commented Jul 16, 2025

interesting idea, will take a look later

@sunsingerus sunsingerus added the planned for review This feature is planned for review label Jul 16, 2025
@AdheipSingh
Copy link
Copy Markdown
Contributor Author

AdheipSingh commented Jul 30, 2025

@sunsingerus Any updates on this one ? cc @alex-zaitsev . BTW i had this feature in druid-operator. So now when i run Clickhouse i feel this is useful, especially in SaaS scenario where a single operator reconciles N chi.

@Slach Slach requested a review from sunsingerus July 30, 2025 16:09
@sunsingerus sunsingerus changed the base branch from 0.25.3 to 0.25.4 August 12, 2025 08:15
@UnamedRus
Copy link
Copy Markdown

UnamedRus commented Aug 21, 2025

There is also reports that watch namespace feature affect only CHI, but not CHK deployments

spec:
  watch:
    namespaces: 
    - ".*"

@AdheipSingh
Copy link
Copy Markdown
Contributor Author

AdheipSingh commented Aug 25, 2025

There is also reports that watch namespace feature affect only CHI, but not CHK deployments

spec:
  watch:
    namespaces: 
    - ".*"

Yes, as my comments state, operator can watch all namespaces but deny a few ns.

@sunsingerus sunsingerus merged commit e075850 into Altinity:0.25.4 Sep 5, 2025
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sunsingerus sunsingerus Awaiting requested review from sunsingerus

Assignees

No one assigned

Labels

planned for review This feature is planned for review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@AdheipSingh @sunsingerus @UnamedRus