added support for multiple namespaces (v2)

[msafwankarim]

Adding support to watch multiple namespaces. Original code was merged in master in #1162. This PR is porting same feature to v2 with some additional robustness fixes.

Note: Dropping --watchNamespace flag and replacing it with --namespaces to sync with v1

[github-actions]

✅ Load Test Results (quick)

❌ Load Test Results: 1 TEST(S) FAILED

🚀 Quick Test (S1, S4, S6) — Use /loadtest for full suite

2/3 passed (66%)

	Scenario	Description	Actions	Errors
✅	S1	S1: 143 burst updates, each triggers 1 dep...	143/143	0
❌	S4	S4: 143 no-op updates, all should be skipped	0	0
✅	S6	S6: Restart test - 142 updates during restart	138	0

📦 Download detailed results

---

Artifacts: Download

[github-actions]

✅ Load Test Results (quick)

✅ Load Test Results: ALL TESTS PASSED

🚀 Quick Test (S1, S4, S6) — Use /loadtest for full suite

3/3 passed (100%)

	Scenario	Description	Actions	Errors
✅	S1	S1: 143 burst updates, each triggers 1 dep...	143/143	0
✅	S4	S4: 143 no-op updates, all should be skipped	0	0
✅	S6	S6: Restart test - 142 updates during restart	136	0

📦 Download detailed results

---

Artifacts: Download

[Copilot]

Pull request overview

This PR ports v1’s multi-namespace “scoped mode” into the v2 codebase by introducing an explicit watched-namespace list and updating the Helm chart + e2e suite to validate scoped behavior and reduce reload-detection race flakiness.

Changes:

• Introduces --namespaces/WatchedNamespaces as the explicit namespace-scoping mechanism (with KUBERNETES_NAMESPACE fallback for single-namespace mode) and updates manager cache scoping accordingly.
• Updates the Helm chart to support reloader.namespaces and render per-namespace Role/RoleBinding resources (and passes --namespaces to the deployment).
• Hardens e2e tests against TOCTOU races by adding WaitReloadedFrom/WaitEnvVarFrom and updating tests to capture baselines pre-trigger; adds a new scoped-namespaces e2e test.

Reviewed changes

Copilot reviewed 45 out of 45 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
test/e2e/utils/workload_statefulset.go	Adds baseline-aware wait helpers to reduce reload false positives.
test/e2e/utils/workload_openshift.go	Adds baseline-aware wait helpers for OpenShift DeploymentConfig workloads.
test/e2e/utils/workload_job.go	Adds “From” variants returning unsupported for Jobs to satisfy interface changes.
test/e2e/utils/workload_deployment.go	Adds baseline-aware wait helpers for Deployments.
test/e2e/utils/workload_daemonset.go	Adds baseline-aware wait helpers for DaemonSets.
test/e2e/utils/workload_cronjob.go	Adds “From” variants and keeps env-var strategy unsupported for CronJobs.
test/e2e/utils/workload_argo.go	Adds baseline-aware wait helpers for Argo Rollouts.
test/e2e/utils/workload_adapter.go	Extends WorkloadAdapter with WaitReloadedFrom/WaitEnvVarFrom contracts.
test/e2e/flags/watch_namespaces_test.go	New e2e test verifying scoped namespace watching via reloader.namespaces.
test/e2e/flags/watch_globally_test.go	Updates tests to avoid TOCTOU races by capturing baseline before triggers.
test/e2e/flags/resource_selector_test.go	Updates reload waits to be baseline-aware.
test/e2e/flags/reload_on_delete_test.go	Updates reload waits to be baseline-aware.
test/e2e/flags/reload_on_create_test.go	Updates reload waits to be baseline-aware.
test/e2e/flags/namespace_selector_test.go	Updates reload waits to be baseline-aware.
test/e2e/flags/namespace_ignore_test.go	Updates reload waits to be baseline-aware.
test/e2e/flags/ignored_workloads_test.go	Updates reload waits to be baseline-aware.
test/e2e/flags/ignore_resources_test.go	Updates reload waits to be baseline-aware.
test/e2e/flags/auto_reload_all_test.go	Updates reload waits to be baseline-aware.
test/e2e/csi/csi_test.go	Updates CSI tests to capture reload baseline before SPCPS/secret triggers.
test/e2e/core/workloads_test.go	Updates core workload tests to use baseline-aware waits (reload + env-var strategy).
test/e2e/core/reference_methods_test.go	Updates reference-method tests to use baseline-aware reload waits.
test/e2e/argo/rollout_test.go	Updates Argo rollout test to be baseline-aware.
test/e2e/annotations/search_match_test.go	Updates annotation tests to be baseline-aware.
test/e2e/annotations/resource_ignore_test.go	Updates ignore-annotation tests to be baseline-aware.
test/e2e/annotations/pause_period_test.go	Updates pause-period tests to be baseline-aware.
test/e2e/annotations/exclude_test.go	Updates exclude-annotation tests to be baseline-aware.
test/e2e/annotations/combination_test.go	Updates combination-annotation tests to be baseline-aware.
test/e2e/annotations/auto_reload_test.go	Updates auto-annotation tests to be baseline-aware.
test/e2e/advanced/regex_test.go	Updates regex tests to be baseline-aware.
test/e2e/advanced/multi_container_test.go	Updates multi-container tests to be baseline-aware.
internal/pkg/metadata/publisher.go	Switches metadata publisher runnable to use an uncached client (needed when cache is namespace-scoped).
internal/pkg/controller/manager.go	Scopes controller-runtime cache to multiple namespaces and refactors manager creation to accept a rest.Config.
internal/pkg/controller/manager_test.go	Adds unit test for multi-namespace cache scoping helper.
internal/pkg/config/flags.go	Replaces single watch namespace with --namespaces; adds logger-aware ApplyFlags behavior and ignores selectors/ignores outside global mode.
internal/pkg/config/flags_test.go	Updates tests for new flag surface + adds coverage for namespace scoping semantics.
internal/pkg/config/config.go	Replaces WatchedNamespace with WatchedNamespaces and adds IsGlobalMode().
internal/pkg/config/config_test.go	Adds tests for IsGlobalMode().
deployments/kubernetes/chart/reloader/values.yaml	Adds reloader.namespaces values documentation and bumps chart image/tag metadata.
deployments/kubernetes/chart/reloader/templates/rolebinding.yaml	Renders per-namespace RoleBindings in scoped mode (and single-namespace RoleBinding otherwise).
deployments/kubernetes/chart/reloader/templates/role.yaml	Renders per-namespace Roles in scoped mode and factors rules into helpers.
deployments/kubernetes/chart/reloader/templates/deployment.yaml	Adds namespace validation, avoids KUBERNETES_NAMESPACE env in scoped mode, and passes --namespaces.
deployments/kubernetes/chart/reloader/templates/clusterrole.yaml	Adjusts verbs ordering and expands events API groups/verbs.
deployments/kubernetes/chart/reloader/templates/_helpers.tpl	Adds helpers for normalized watch namespaces, validation, and shared RBAC rule blocks.
deployments/kubernetes/chart/reloader/README.md	Documents reloader.namespaces and clarifies ignoreNamespaces gating.
cmd/reloader/main.go	Configures logging earlier (so ApplyFlags can log) and wires metadata publisher with manager rest config/scheme; updates logging around namespace mode.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[SyedaFatimaKazmi]

The pr looks good
There's a couple of minor things we should update before merging

• fix the readme (i left a comment at copilot review)
• the e2e tests dont actually test the multiple namespaces. no test proves reloads fire across 2+ watched namespaces at once (should add a test)
• reloader-release-rules grants events in the release namespace unconditionally but the only writer there is leader election. i think it could be gated on enableHA alongside leases (harmless really but just wider than necessary)

[github-actions]

✅ Load Test Results (quick)

✅ Load Test Results: ALL TESTS PASSED

🚀 Quick Test (S1, S4, S6) — Use /loadtest for full suite

3/3 passed (100%)

	Scenario	Description	Actions	Errors
✅	S1	S1: 143 burst updates, each triggers 1 dep...	141/143	0
✅	S4	S4: 143 no-op updates, all should be skipped	0	0
✅	S6	S6: Restart test - 142 updates during restart	145	0

📦 Download detailed results

---

Artifacts: Download