deny list implementation via predicates

[AdheipSingh]

• Use case: I want the operator to watch all namespaces but exclude namespaces x, y, and z. This is particularly useful in a multi-tenant scenario where the operator is reconciling X number of CHIs and has full watch privileges across namespaces. At that point, we can restrict the operator from watching specific namespaces where secure applications are running.

• Predicates based implementation will filter out the event before enqueueing it in worker-queue .

Important items to consider before making a Pull Request

Please check items PR complies to:

• All commits in the PR are squashed. More info
• The PR is made into dedicated next-release branch, not into master branch¹. More info
• The PR is signed. More info

--

[sunsingerus]

interesting idea, will take a look later

[AdheipSingh]

@sunsingerus Any updates on this one ? cc @alex-zaitsev . BTW i had this feature in druid-operator. So now when i run Clickhouse i feel this is useful, especially in SaaS scenario where a single operator reconciles N chi.

[UnamedRus]

There is also reports that watch namespace feature affect only CHI, but not CHK deployments

spec:
  watch:
    namespaces: 
    - ".*"

[AdheipSingh]

There is also reports that watch namespace feature affect only CHI, but not CHK deployments

spec:
  watch:
    namespaces: 
    - ".*"

Yes, as my comments state, operator can watch all namespaces but deny a few ns.