CRD discovery, log noise reduction, e2e tests

pkg/filter/namespace.go

@@ -105,6 +105,7 @@ func ParseTargetNamespaces(value string) []string {
 //   - patterns: namespace patterns from annotation
 //   - allNamespaces: list of all namespaces in cluster
 //   - allowMirrorsNamespaces: namespaces with allow-mirrors label
+//   - optOutNamespaces: namespaces with allow-mirrors="false" (explicitly opted out)
 //   - sourceNamespace: exclude this namespace to prevent self-copy
 //   - filter: namespace filter for exclusions
 //
@@ -113,6 +114,7 @@ func ResolveTargetNamespaces(
 	patterns []string,
 	allNamespaces []string,
 	allowMirrorsNamespaces []string,
+	optOutNamespaces []string,
 	sourceNamespace string,
 	filter *NamespaceFilter,
 ) []string {
@@ -120,21 +122,30 @@ func ResolveTargetNamespaces(
 		return nil
 	}
 
+	// Create map of opt-out namespaces for fast lookup
+	optOutMap := make(map[string]bool)
+	for _, ns := range optOutNamespaces {
+		optOutMap[ns] = true
+	}
+
 	// Use map to deduplicate
 	targetMap := make(map[string]bool)
 
 	for _, pattern := range patterns {
 		switch pattern {
 		case constants.TargetNamespacesAll:
-			// Mirror to all namespaces (except source and excluded)
+			// Mirror to all namespaces (except source, excluded, and opt-out)
+			// This implements opt-OUT model: namespaces without labels get mirrors
+			// Only namespaces with allow-mirrors="false" are excluded
 			for _, ns := range allNamespaces {
-				if ns != sourceNamespace && filter.IsAllowed(ns) {
+				if ns != sourceNamespace && filter.IsAllowed(ns) && !optOutMap[ns] {
 					targetMap[ns] = true
 				}
 			}
 
 		case constants.TargetNamespacesAllLabeled:
-			// Mirror only to namespaces with allow-mirrors label
+			// Mirror only to namespaces with allow-mirrors="true" label
+			// This implements opt-IN model
 			for _, ns := range allowMirrorsNamespaces {
 				if ns != sourceNamespace && filter.IsAllowed(ns) {
 					targetMap[ns] = true

pkg/filter/namespace_test.go

@@ -318,6 +318,7 @@ func TestResolveTargetNamespaces(t *testing.T) {
 				tt.patterns,
 				tt.allNamespaces,
 				tt.allowMirrorsNamespaces,
+				[]string{}, // optOutNamespaces - empty for these tests
 				tt.sourceNamespace,
 				tt.filter,
 			)
@@ -342,6 +343,7 @@ func TestResolveTargetNamespaces_EdgeCases(t *testing.T) {
 			[]string{"all"},
 			[]string{},
 			[]string{},
+			[]string{}, // optOutNamespaces
 			"default",
 			NewNamespaceFilter([]string{}, []string{}),
 		)
@@ -354,6 +356,7 @@ func TestResolveTargetNamespaces_EdgeCases(t *testing.T) {
 			[]string{"[invalid"},
 			[]string{"app1"},
 			[]string{},
+			[]string{}, // optOutNamespaces
 			"default",
 			NewNamespaceFilter([]string{}, []string{}),
 		)
@@ -366,6 +369,7 @@ func TestResolveTargetNamespaces_EdgeCases(t *testing.T) {
 			[]string{"all"},
 			[]string{"app1", "app2", "app3"},
 			[]string{},
+			[]string{}, // optOutNamespaces
 			"default",
 			strictFilter,
 		)
@@ -541,6 +545,7 @@ func BenchmarkResolveTargetNamespaces(b *testing.B) {
 					tt.patterns,
 					allNamespaces,
 					allowMirrorsNamespaces,
+					[]string{}, // optOutNamespaces
 					"default",
 					filter,
 				)
@@ -566,6 +571,7 @@ func BenchmarkResolveTargetNamespaces_LargeScale(b *testing.B) {
 				[]string{constants.TargetNamespacesAll},
 				allNamespaces,
 				allowMirrorsNamespaces,
+				[]string{}, // optOutNamespaces
 				"default",
 				filter,
 			)
@@ -579,6 +585,7 @@ func BenchmarkResolveTargetNamespaces_LargeScale(b *testing.B) {
 				[]string{"namespace-*"},
 				allNamespaces,
 				allowMirrorsNamespaces,
+				[]string{}, // optOutNamespaces
 				"default",
 				filter,
 			)