The mirror reconcile path issued one direct apiserver GET per target
namespace on every pass. With N sources and M target namespaces each
resync produced N*M GET requests. On a 65-namespace cluster this
generated 63 GET/s and overloaded one control-plane node.
Changes:
- reconcileMirror now trusts the informer cache. Content drift is
detected via the source hash annotation. A stale resourceVersion
makes Update return a conflict, which requeues the source.
- The verify-source-freshness flag now defaults to false. The Helm
chart passes the value explicitly, so the chart default of false
matches the binary behaviour.
- Reconcile performs one namespace LIST per pass. Target resolution
and orphan cleanup share the result.
- Add load regression tests that count direct API reads in the
reconcile hot path.
Correct two wrong CLI flag defaults (leader-elect, verify-source-freshness) and add missing flags/Helm values. Remove documented-but-nonexistent annotations (excluded-namespaces, namespace-pattern) that silently did nothing, document the real exclude/paused and glob targeting, fix the mirror ownership-check example, and add the missing charts/kubemirror/README.md that README linked to.
Discloses the single anonymous adoption ping sent on startup and points
users to the upstream README section for full opt-out instructions
instead of duplicating the table here.
lukaszraczylo