feat: Allow scoping Operator installation on specific namespaces

deploy/twingate-operator/templates/deployment.yaml

@@ -45,7 +45,13 @@ spec:
           - kopf
           - run
           - ./main.py
-          - "-A"
+          {{- with .Values.twingateOperator.namespaces  }}
+          {{- range . }}
+          - "--namespace={{ . }}"
+          {{- end }}
+          {{- else }}
+          - "--all-namespaces"
+          {{- end }}
           - "--standalone"
           - "--liveness=http://0.0.0.0:8080/healthz"
           - "--log-format={{ $logFormat }}"

deploy/twingate-operator/tests/__snapshot__/default_values_test.yaml.snap

@@ -111,7 +111,7 @@ should render:
                 - kopf
                 - run
                 - ./main.py
-                - -A
+                - --all-namespaces
                 - --standalone
                 - --liveness=http://0.0.0.0:8080/healthz
                 - --log-format=full

deploy/twingate-operator/tests/deployment_optional_values_test.yaml

@@ -37,6 +37,21 @@ tests:
           content:
             name: TWINGATE_DEFAULT_RESOURCE_TAGS
             value: '{"cluster":"test-cluster","owner":"eran"}'
+  - it: should use `namespaces`
+    set:
+      twingateOperator:
+        namespaces:
+          - "foo"
+          - "bar"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content:
+            --namespace=foo
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content:
+            --namespace=bar
   - it: should use `imagePullSecrets`
     set:
       imagePullSecrets:

deploy/twingate-operator/values.schema.json

@@ -155,7 +155,13 @@
                     "additionalProperties": {
                         "type": "string"
                     }
-                }
+                },
+                "namespaces": {
+                    "type": "array",
+                    "description": "Array of namespaces to monitor by the operator",
+                    "items": { "type": "string" },
+                    "default": []
+        }
             },
             "examples": [{
               "apiKey": "sdlkwdlsknsldknsldkcnm",

deploy/twingate-operator/values.yaml

@@ -22,6 +22,22 @@ twingateOperator: {}
 #    tag1: value_for_tag1
 #    tag2: value_for_tag2
 
+## Restrict operator to monitor resources in specific namespaces. You should either:
+## 1. Specify a list of namespaces:
+## namespaces: ["foo-dev", "foo-stg"]
+## 2. Use globs to match multiple namespaces:
+## namespaces: ["*-dev", "*-stg"]
+## 3. Use negation to include all namespaces except those excluded:
+## namespaces: ["!*-test"]
+## 4. Use multiple globs can be used in one pattern:
+## namespaces: ["foo-*,!*-test"]
+
+## Caveat: Globs in separate array elements are evaluated independently, and the final list of namespaces is the union of all globs' results.
+## i.e., `namespaces: ["foo-*", "!*-test"]` is not the same as `namespaces: ["foo-*,!*-test"]`
+
+## For more information on using multiple globs, see: https://kopf.readthedocs.io/en/stable/scopes
+#  namespaces: []
+
 # Twingate Kubernetes Access is currently in beta. Sign up for early access at https://www.twingate.com/product/kubernetes-access.
 kubernetes-access-gateway:
   enabled: false