always include the controller namespace in the k8s provider

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

Author: zhaohuabing

internal/provider/kubernetes/controller.go

@@ -177,7 +177,9 @@ func newGatewayAPIController(ctx context.Context, mgr manager.Manager, cfg *conf
 
 	if byNamespaceSelectorEnabled(cfg.EnvoyGateway) {
 		r.namespaceLabel = cfg.EnvoyGateway.Provider.Kubernetes.Watch.NamespaceSelector
-		r.client = newNamespaceSelectorClient(r.client, r.namespaceLabel)
+		// Always include the controller namespace so EG-owned infrastructure
+		// resources remain visible when user namespaces are selected by labels.
+		r.client = newNamespaceSelectorClient(r.client, r.namespaceLabel, cfg.ControllerNamespace)
 	}
 
 	// controller-runtime doesn't allow run controller with same name for more than once

internal/provider/kubernetes/kubernetes.go

@@ -272,6 +272,10 @@ func newProvider(ctx context.Context, restCfg *rest.Config, svrCfg *ec.Server,
 
 	if svrCfg.EnvoyGateway.NamespaceMode() {
 		mgrOpts.Cache.DefaultNamespaces = make(map[string]cache.Config)
+		// Keep the controller namespace visible even when users restrict watched
+		// Gateway API namespaces; infra reconciliation reads EG-owned resources
+		// such as Secrets from this namespace through the shared cached client.
+		mgrOpts.Cache.DefaultNamespaces[svrCfg.ControllerNamespace] = cache.Config{}
 		for _, watchNS := range svrCfg.EnvoyGateway.Provider.Kubernetes.Watch.Namespaces {
 			mgrOpts.Cache.DefaultNamespaces[watchNS] = cache.Config{}
 		}

internal/provider/kubernetes/namespace_selector_client.go

@@ -11,6 +11,7 @@ import (
 
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/sets"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
@@ -20,18 +21,20 @@ import (
 // List operations.
 type namespaceSelectorClient struct {
 	client.Client
-	namespaceSelector *metav1.LabelSelector
+	namespaceSelector  *metav1.LabelSelector
+	includedNamespaces sets.Set[string]
 }
 
 // newNamespaceSelectorClient creates a new namespace-filtered client wrapper.
 // If namespaceSelector is nil, the wrapper passes through all operations unchanged.
-func newNamespaceSelectorClient(c client.Client, namespaceSelector *metav1.LabelSelector) client.Client {
+func newNamespaceSelectorClient(c client.Client, namespaceSelector *metav1.LabelSelector, includedNamespaces ...string) client.Client {
 	if namespaceSelector == nil {
 		return c
 	}
 	return &namespaceSelectorClient{
-		Client:            c,
-		namespaceSelector: namespaceSelector,
+		Client:             c,
+		namespaceSelector:  namespaceSelector,
+		includedNamespaces: sets.New(includedNamespaces...),
 	}
 }
 
@@ -86,15 +89,21 @@ func (c *namespaceSelectorClient) filterByNamespaceLabels(ctx context.Context, l
 		}
 
 		ns := obj.GetNamespace()
-		matches, cached := namespaceMatches[ns]
-		if !cached {
-			var err error
-			matches, err = checkObjectNamespaceLabels(ctx, c.Client, c.namespaceSelector, obj)
-			if err != nil {
-				return fmt.Errorf("failed to check namespace labels for object %s/%s: %w",
-					ns, obj.GetName(), err)
+		// includedNamespaces are part of EG's own operating surface, e.g. the
+		// controller namespace. They must bypass user namespace selectors.
+		matches := c.includedNamespaces.Has(ns)
+		if !matches {
+			cachedMatches, cached := namespaceMatches[ns]
+			matches = cachedMatches
+			if !cached {
+				var err error
+				matches, err = checkObjectNamespaceLabels(ctx, c.Client, c.namespaceSelector, obj)
+				if err != nil {
+					return fmt.Errorf("failed to check namespace labels for object %s/%s: %w",
+						ns, obj.GetName(), err)
+				}
+				namespaceMatches[ns] = matches
 			}
-			namespaceMatches[ns] = matches
 		}
 
 		if matches {

internal/provider/kubernetes/namespace_selector_client_test.go

@@ -80,11 +80,12 @@ func TestNamespaceSelectorClient(t *testing.T) {
 	scheme := envoygateway.GetScheme()
 
 	testCases := []struct {
-		name              string
-		namespaceSelector *metav1.LabelSelector
-		objects           []runtime.Object
-		expectCTPCount    int
-		expectGWCount     int
+		name               string
+		namespaceSelector  *metav1.LabelSelector
+		includedNamespaces []string
+		objects            []runtime.Object
+		expectCTPCount     int
+		expectGWCount      int
 	}{
 		{
 			name:              "nil selector returns all resources",
@@ -127,6 +128,22 @@ func TestNamespaceSelectorClient(t *testing.T) {
 			expectCTPCount: 0,
 			expectGWCount:  0,
 		},
+		{
+			name: "included namespace bypasses selector",
+			namespaceSelector: &metav1.LabelSelector{
+				MatchLabels: map[string]string{
+					"env": "development",
+				},
+			},
+			includedNamespaces: []string{"non-matching-ns"},
+			objects: []runtime.Object{
+				nsMatching, nsNonMatching,
+				ctpInMatchingNs, ctpInNonMatchingNs,
+				gwInMatchingNs, gwInNonMatchingNs,
+			},
+			expectCTPCount: 1,
+			expectGWCount:  1,
+		},
 	}
 
 	for _, tc := range testCases {
@@ -138,7 +155,7 @@ func TestNamespaceSelectorClient(t *testing.T) {
 				Build()
 
 			// Wrap with namespace selector client
-			wrappedClient := newNamespaceSelectorClient(fakeClient, tc.namespaceSelector)
+			wrappedClient := newNamespaceSelectorClient(fakeClient, tc.namespaceSelector, tc.includedNamespaces...)
 
 			ctx := context.Background()
 

internal/provider/kubernetes/predicates.go

@@ -52,6 +52,11 @@ func (r *gatewayAPIReconciler) hasMatchingController(gc *gwapiv1.GatewayClass) b
 // hasMatchingNamespaceLabels returns true if the namespace of provided object has
 // the provided labels or false otherwise.
 func (r *gatewayAPIReconciler) hasMatchingNamespaceLabels(obj client.Object) bool {
+	// Controller-namespace events can affect EG-owned infrastructure and should
+	// not be dropped by the user's Gateway API namespace selector.
+	if obj.GetNamespace() == r.namespace {
+		return true
+	}
 	ok, err := checkObjectNamespaceLabels(context.Background(), r.client, r.namespaceLabel, obj)
 	if err != nil {
 		r.log.Error(

internal/provider/kubernetes/predicates_test.go

@@ -260,6 +260,60 @@ func TestFindOwningGateway(t *testing.T) {
 	}
 }
 
+func TestEnvoyServiceForGatewayIncludesControllerNamespace(t *testing.T) {
+	ctx := context.Background()
+	gatewayNamespace := "watched"
+	controllerNamespace := "envoy-gateway-system"
+	gatewayClassName := "gc-name"
+	namespaceSelector := &metav1.LabelSelector{
+		MatchLabels: map[string]string{"gateway": "enabled"},
+	}
+	gtw := test.GetGateway(types.NamespacedName{
+		Namespace: gatewayNamespace,
+		Name:      "gateway",
+	}, gatewayClassName, 80)
+	svc := &corev1.Service{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: controllerNamespace,
+			Name:      "envoy-default-gateway",
+			Labels:    gatewayapi.OwnerLabels(gtw, false),
+		},
+	}
+
+	baseClient := fakeclient.NewClientBuilder().
+		WithScheme(envoygateway.GetScheme()).
+		WithObjects(
+			&corev1.Namespace{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:   gatewayNamespace,
+					Labels: namespaceSelector.MatchLabels,
+				},
+			},
+			&corev1.Namespace{
+				ObjectMeta: metav1.ObjectMeta{Name: controllerNamespace},
+			},
+			svc,
+		).
+		Build()
+	r := &gatewayAPIReconciler{
+		namespace:       controllerNamespace,
+		classController: gwapiv1.GatewayController(egv1a1.GatewayControllerName),
+		mergeGateways:   sets.New[string](),
+	}
+
+	r.client = newNamespaceSelectorClient(baseClient, namespaceSelector)
+	got, err := r.envoyServiceForGateway(ctx, gtw)
+	require.NoError(t, err)
+	require.Nil(t, got)
+
+	r.client = newNamespaceSelectorClient(baseClient, namespaceSelector, controllerNamespace)
+	got, err = r.envoyServiceForGateway(ctx, gtw)
+	require.NoError(t, err)
+	require.NotNil(t, got)
+	require.Equal(t, svc.Name, got.Name)
+	require.Equal(t, controllerNamespace, got.Namespace)
+}
+
 // TestValidateConfigMapForReconcile tests the validateConfigMapForReconcile
 // predicate function.
 func TestValidateConfigMapForReconcile(t *testing.T) {

release-notes/current.yaml

@@ -17,6 +17,7 @@ bug fixes: |
   Fixed BackendTLSPolicy selection to prefer section name over wildcard match on the same backend.
   Fixed missing deprecated field warning in ClientTrafficPolicy and SecurityPolicy.
   Fixed ClientTrafficPolicy TLS cipher validation rejecting supported IANA/RFC cipher suite names.
+  Fixed Kubernetes provider namespace-scoped watches to always include the controller namespace so Envoy Gateway can read its own infrastructure resources.
 
 # Enhancements that improve performance.
 performance improvements: |

test/config/envoy-gateaway-config/watch-namespaces.yaml

@@ -11,17 +11,20 @@ data:
       type: Kubernetes
       kubernetes:
         watch:
-          type: Namespaces
-          namespaces:
-          - envoy-gateway-system
-          - btp-cross-ns-denied
-          - btp-cross-ns-granted
-          - gateway-conformance-infra
-          - gateway-preserve-case-backend
-          - gateway-upgrade-infra
-          - listenerset-tls-termination-secret
-          - monitoring
-          - multireferencegrants-ns
+          type: NamespaceSelector
+          namespaceSelector:
+            matchExpressions:
+            - key: kubernetes.io/metadata.name
+              operator: In
+              values:
+              - btp-cross-ns-denied
+              - btp-cross-ns-granted
+              - gateway-conformance-infra
+              - gateway-preserve-case-backend
+              - gateway-upgrade-infra
+              - listenerset-tls-termination-secret
+              - monitoring
+              - multireferencegrants-ns
     gateway:
       controllerName: gateway.envoyproxy.io/gatewayclass-controller
     extensionApis: