Watch Namespaces based on labels and label selectors

[DuncanDoyle]

Gloo Edge Product

Enterprise

Gloo Edge Version

1.16.4

Is your feature request related to a problem? Please describe.

In GE, we currently either watch all namespaces, or we watch the namespaces configured in the watchNamespaces configuration. This is a very static setup. In a development environment, where you might use a namespace per PR, a more dynamic way of configuring which namespaces are being watched would provide the required flexibility (otherwise the GE config would need to be constantly updated).

Note that we need to watch namespaces if we want to route to K8S services in Upstreams using EDS (i.e. using kube Kubernetes UpstreamSpec: https://docs.solo.io/gloo-edge/1.7.23/reference/api/github.com/solo-io/gloo/projects/gloo/api/v1/upstream.proto.sk/), as Gloo needs to be able to access the K8S endpoints in those namespaces.

Describe the solution you'd like

Use K8S label selectors and labels on namespaces to dynamically add namespaces to GEs watchNamespaces.

Describe alternatives you've considered

Regex based namespace selectors.

Additional Context

No response

Related Issues:

• [Migrated] Labeled selectors for watched resources solo-io/gloo#6871
• [Migrated] resource selection based on label(s) or need solo-io/gloo#5530
• https://github.com/solo-io/solo-projects/issues/5898
• [Migrated] fine-grained selector for watched CRs solo-io/gloo#5868

┆Issue is synchronized with this Asana task by Unito

[nrjpoddar]

@sam-heilbron to look at this issue for scope/estimation.

[yuval-k]

is this for tenancy? or for RBAC? i believe watch namespaces being a list allows us to use Roles instead of ClusterRoles

[davidjumani]

This is for tenancy. If edge is installed with global.glooRbac.namespaced enabled, it uses Roles instead of ClusterRoles

[sam-heilbron]

cc @davidjumani internal slack ref

[soloio-bot]

Zendesk ticket #3965 has been linked to this issue.

[davidjumani]

This is in OSS v1.18.0-beta24 and v1.17.9
It will be in Enterprise v1.18.0-beta2 and v1.17.3 when released