Only load manifests with allowed namespaces

cluster/kubernetes/kubernetes.go

@@ -138,7 +138,7 @@ func NewCluster(clientset k8sclient.Interface,
 func (c *Cluster) SomeControllers(ids []flux.ResourceID) (res []cluster.Controller, err error) {
 	var controllers []cluster.Controller
 	for _, id := range ids {
-		if !c.isInAllowedNamespace(id) {
+		if !isInAllowedNamespace(c.allowedNamespaces, id) {
 			continue
 		}
 		ns, kind, name := id.Components()
@@ -228,7 +228,7 @@ func (c *Cluster) Sync(spec cluster.SyncDef) error {
 			{action.Apply, "apply"},
 		}
 		for _, stage := range stages {
-			if stage.res == nil || !c.isInAllowedNamespace(stage.res.ResourceID()) {
+			if stage.res == nil || !isInAllowedNamespace(c.allowedNamespaces, stage.res.ResourceID()) {
 				continue
 			}
 
@@ -382,13 +382,13 @@ func (c *Cluster) getAllowedNamespaces() ([]apiv1.Namespace, error) {
 	return namespaces.Items, nil
 }
 
-func (c *Cluster) isInAllowedNamespace(id flux.ResourceID) bool {
-	if len(c.allowedNamespaces) == 0 {
+func isInAllowedNamespace(allowedNamespaces []string, id flux.ResourceID) bool {
+	if len(allowedNamespaces) == 0 {
 		// all namespaces are allowed
 		return true
 	}
 	ns, _, _ := id.Components()
-	for _, allowedNS := range c.allowedNamespaces {
+	for _, allowedNS := range allowedNamespaces {
 		if ns == allowedNS {
 			return true
 		}

cluster/kubernetes/manifests.go

@@ -8,10 +8,17 @@ import (
 )
 
 type Manifests struct {
+	AllowedNamespaces []string
 }
 
 func (c *Manifests) LoadManifests(base string, paths []string) (map[string]resource.Resource, error) {
-	return kresource.Load(base, paths)
+	resources, err := kresource.Load(base, paths)
+	for k, r := range resources {
+		if !isInAllowedNamespace(c.AllowedNamespaces, r.ResourceID()) {
+			delete(resources, k)
+		}
+	}
+	return resources, err
 }
 
 func (c *Manifests) ParseManifests(allDefs []byte) (map[string]resource.Resource, error) {

cmd/fluxd/main.go

@@ -274,7 +274,7 @@ func main() {
 		imageCreds = k8sInst.ImagesToFetch
 		// There is only one way we currently interpret a repo of
 		// files as manifests, and that's as Kubernetes yamels.
-		k8sManifests = &kubernetes.Manifests{}
+		k8sManifests = &kubernetes.Manifests{AllowedNamespaces: allowedNamespaces}
 	}
 
 	// Wrap the procedure for collecting images to scan