Cache selectors should allow setting a default

[alvaroaleman]

It is currently possible to set a selector in the cache per GVK, however it is not possible to set a default selector which might be very useful for scenarios like "I want all caches in this namespace except the cache for footype, which should be in a different namespace".

[joelanford]

I definitely agree that a default selector would be useful in many cases (e.g. label my.domain/managedBy == "my-operator"), but I'm not sure a namespace selector is appropriate at this layer.

If I'm understanding this correctly, it would result in the informers using a cluster-wide list/watch and the apiserver receiving all objects from etcd before filtering down to the desired namespace.

Clients using this setup would require cluster-wide RBAC list/watch for all of the watched kinds and (barring any gaps in my understanding of apiserver <-> etcd communication) would cause unnecessary resource usage from objects not in the selected namespaces being unnecessarily sent from etcd to the apiserver.

It seems like the GVKCaches approach in #1591 would be better from an RBAC and resource utilization perspective.

[alvaroaleman]

If I'm understanding this correctly, it would result in the informers using a cluster-wide list/watch and the apiserver receiving all objects from etcd before filtering down to the desired namespace.

No, the selector can be used to not even receive the objects and make the apiserver filter for us. Using a default namespace was just an example btw, could also be a default label selector. What exactly makes sense depends on what you want to do :)

[joelanford]

No, the selector can be used to not even receive the objects and make the apiserver filter for us.

Understood, but if cache.Options.Namespace is unset, the underlying apiserver call is going to be cluster-scoped regardless of the selectors. So it would generally be a bad idea to use a cluster-scoped informer with a namespace selector for the reasons I stated.

Nonetheless, I agree a default selector is valuable.

[alvaroaleman]

No, we had a change a while back that made us do a namespace-scoped list+watch request and only requires rbac for that namespace if a fieldselector for a namespace is set: #1602

[joelanford]

Ah ha! That was the piece I was missing. Very cool!