opendefensecloud / solution-arsenal / 37751911677

79%

Build Type

push

github

Committed by web-flow

Commit Message

fix(controller): respect targetRef.namespace for RegistryBindings (#850)

## What
Same-namespace RegistryBindings are now matched on the full Target key,
not just the name.

- `buildPullSecretsLookup` skips bindings whose effective `targetRef`
namespace isn't the Target's namespace
- `mapRegistryBindingToTarget` enqueues `targetRef.namespace` when set,
instead of the binding's namespace
- new helper `registryBindingTargetKey(rb)`
(`cmp.Or(targetRef.namespace, rb.Namespace)`), reused by the follow-up
PRs

Part of #565.

## Why
`buildPullSecretsLookup` lists RegistryBindings by the
`spec.targetRef.name` index only -> a binding `A/rb` with `targetRef:
{name: foo, namespace: B}` gets applied to Target `A/foo`, which then
renders with a pull secret meant for `B/foo`. ReleaseBindings had the
same bug class, covered by the spec at `target_controller_test.go:1328`.

`mapRegistryBindingToTarget` enqueued `rb.Namespace` -> a binding
pointing into another namespace never triggered a reconcile of its
Target. Not visible today because cross-ns RegistryBindings aren't
collected yet, but #565 needs it.

A binding with `targetRef.namespace` set to its own namespace counts as
same-namespace. That's more lenient than ReleaseBindings (only `""`
counts there, `helpers.go:339`), on purpose: rejecting an explicit own
namespace would only surprise people.

## Testing
envtest, red first, then green:

```
make test testargs="--focus='RegistryBinding|mapRegistryBindingToTarget' ./pkg/controller"
Ran 15 of 143 Specs, 15 Passed, 0 Failed
```

Before the fix the new specs failed as expected (leak spec got
`leaked-creds`, map spec got namespace `provider` instead of `user`).
`go vet ./pkg/...` and `make lint` clean.

## Checklist
- [x] Tests added/updated (leak spec, own-namespace spec, map func
specs)
- [x] No breaking changes (or upgrade path documented above)
- [x] Readable commit history (squashed and cleaned up as desired)
- [x] AI code review considered and comments resolved... (continued)

Coverage Stats

8 of 8 new or added lines in 2 files covered. (100.0%)

5 existing lines in 2 files now uncovered.

5078 of 6464 relevant lines covered (78.56%)

33.77 hits per line