lukaszraczylo 99c0eccd53 fix: default verify-source-freshness=true; honor opt-out for glob ...

H1: --verify-source-freshness used to default to false, so any source
update whose annotation was still in the informer cache (5-20s lag)
would resolve the wrong target list. cleanupOrphanedMirrors then ran
against the stale list and missed orphans (manifested in e2e as
'Orphaned mirror in kubemirror-e2e-app-1 not deleted within timeout'
after target-namespaces was changed). Defaulting to true fixes the
race; the trade-off is one extra API read per stale-cache reconcile.

M2: ResolveTargetNamespaces glob branch checked filter.IsAllowed but
not the opt-out map, so a namespace labeled allow-mirrors=false would
still receive a mirror through patterns like 'app-*'. The 'all' branch
already had the guard; the glob branch now does too. Direct namespace
listings still bypass opt-out by design (explicit author intent).

2026-05-02 22:36:50 +01:00

..

namespace_test.go

fix: default verify-source-freshness=true; honor opt-out for glob

2026-05-02 22:36:50 +01:00

namespace.go

fix: default verify-source-freshness=true; honor opt-out for glob

2026-05-02 22:36:50 +01:00