|
| 1 | +/* Copyright © 2026 Broadcom, Inc. All Rights Reserved. |
| 2 | + SPDX-License-Identifier: Apache-2.0 */ |
| 3 | + |
| 4 | +package common |
| 5 | + |
| 6 | +import ( |
| 7 | + "context" |
| 8 | + |
| 9 | + corev1 "k8s.io/api/core/v1" |
| 10 | + apierrors "k8s.io/apimachinery/pkg/api/errors" |
| 11 | + "k8s.io/apimachinery/pkg/types" |
| 12 | + "sigs.k8s.io/controller-runtime/pkg/client" |
| 13 | + "sigs.k8s.io/controller-runtime/pkg/event" |
| 14 | + "sigs.k8s.io/controller-runtime/pkg/predicate" |
| 15 | + |
| 16 | + "github.com/vmware-tanzu/nsx-operator/pkg/config" |
| 17 | +) |
| 18 | + |
| 19 | +// isVPCNamespaceByName fetches the Namespace by name and calls config.IsVPCNamespace. |
| 20 | +// Returns true when the namespace cannot be fetched (transient error or already |
| 21 | +// gone) so the Reconcile loop can decide what to do. |
| 22 | +func isVPCNamespaceByName(c client.Reader, ns string) bool { |
| 23 | + namespace := &corev1.Namespace{} |
| 24 | + if err := c.Get(context.Background(), types.NamespacedName{Name: ns}, namespace); err != nil { |
| 25 | + if !apierrors.IsNotFound(err) { |
| 26 | + log.Error(err, "Failed to get Namespace for VPC predicate; allowing event through", "namespace", ns) |
| 27 | + } |
| 28 | + return true |
| 29 | + } |
| 30 | + return config.IsVPCNamespace(namespace) |
| 31 | +} |
| 32 | + |
| 33 | +// VPCNamespacePredicate returns a predicate that filters events for VPC-only |
| 34 | +// controllers. Events are passed when config.IsVPCNamespace reports true for |
| 35 | +// the resource's namespace. |
| 36 | +// |
| 37 | +// Behaviour by event type: |
| 38 | +// - Create / Update / Generic: allowed only for VPC namespaces. |
| 39 | +// - Delete: always allowed so the controller can clean up any existing NSX |
| 40 | +// resources even if the namespace is already gone. |
| 41 | +// |
| 42 | +// The namespace check is skipped for cluster-scoped resources (empty namespace), |
| 43 | +// which are always allowed through. |
| 44 | +func VPCNamespacePredicate(c client.Reader) predicate.Funcs { |
| 45 | + isVPCNs := func(ns string) bool { |
| 46 | + if ns == "" { |
| 47 | + // Cluster-scoped resource: no per-namespace filtering. |
| 48 | + return true |
| 49 | + } |
| 50 | + return isVPCNamespaceByName(c, ns) |
| 51 | + } |
| 52 | + |
| 53 | + return predicate.Funcs{ |
| 54 | + CreateFunc: func(e event.CreateEvent) bool { |
| 55 | + return isVPCNs(e.Object.GetNamespace()) |
| 56 | + }, |
| 57 | + UpdateFunc: func(e event.UpdateEvent) bool { |
| 58 | + return isVPCNs(e.ObjectNew.GetNamespace()) |
| 59 | + }, |
| 60 | + // Always allow Delete events so the controller can clean up NSX |
| 61 | + // resources regardless of the current namespace network metadata. |
| 62 | + DeleteFunc: func(e event.DeleteEvent) bool { |
| 63 | + return true |
| 64 | + }, |
| 65 | + GenericFunc: func(e event.GenericEvent) bool { |
| 66 | + return isVPCNs(e.Object.GetNamespace()) |
| 67 | + }, |
| 68 | + } |
| 69 | +} |
0 commit comments