Skip to content

helm-operator: keep the chart label filter on dependent resource caches - #7154

Open
TarasLykhenko wants to merge 1 commit into
operator-framework:masterfrom
TarasLykhenko:helm-dependent-cache-selector
Open

TarasLykhenko wants to merge 1 commit into
operator-framework:masterfrom
TarasLykhenko:helm-dependent-cache-selector

Conversation

@TarasLykhenko

Copy link
Copy Markdown

Description of the change:

When the Helm operator watches all namespaces (no WATCH_NAMESPACE), configureWatchNamespaces no longer sets LabelSelector: labels.Everything() on the all-namespaces cache config.

configureSelectors sets DefaultLabelSelector to helm.sdk.operatorframework.io/chart in (<chart names>), so the cache holds only the objects the operator created. That filter was added in #6377. In controller-runtime's cache defaulting, a label selector on a DefaultNamespaces entry takes precedence over DefaultLabelSelector (defaultConfig only fills a nil selector). The labels.Everything() override, added in #6664 while moving to the new cache API, therefore disables the chart filter for every dependent resource: each dependent informer caches every object of its kind in the cluster.

With the selector left unset:

  • dependent resources fall back to the chart-label DefaultLabelSelector again;
  • watched custom resources are unaffected, because configureSelectors gives each of them its own ByObject selector, which takes precedence over both;
  • cluster-scoped kinds are unaffected, because DefaultNamespaces does not apply to them.

Objects created by the operator carry the label, because NewLabelInjectingClient adds it on every create and update.

Motivation for the change:

A cluster-wide Helm operator whose chart renders common kinds (Secrets, ConfigMaps, Deployments, Services, Roles) caches all of them across the cluster, including the data of every Secret and ConfigMap. Memory then grows with the size of the cluster, not with the number of custom resources. We run one that manages a few dozen custom resources; it uses 1-3 GiB on most clusters and is OOMKilled at a 5 GiB limit on the largest one.

Testing:

TestConfigureWatchNamespaces in internal/cmd/helm-operator/run/cmd_test.go checks that the all-namespaces config leaves the label selector unset, and that a namespace list still yields one config per namespace. The first case fails without the change.

Checklist

  • Add a changelog fragment
  • Add tests

When watching all namespaces, configureWatchNamespaces set
LabelSelector: labels.Everything() on the all-namespaces cache config.
In controller-runtime that selector takes precedence over the
chart-label DefaultLabelSelector set by configureSelectors, so every
dependent informer cached every object of its kind in the cluster.

Leave the selector unset so dependent resources fall back to the
chart-label default again. Watched custom resources keep their own
ByObject selector.

Signed-off-by: TarasLykhenko <18290033+TarasLykhenko@users.noreply.github.com>
@openshift-ci
openshift-ci Bot requested review from anik120 and oceanc80 November 12, 2026 16:02

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant