mirror of
https://github.com/lukaszraczylo/kubemirror.git
synced 2026-06-05 22:43:51 +00:00
lukaszraczylo
99c0eccd53
H1: --verify-source-freshness used to default to false, so any source update whose annotation was still in the informer cache (5-20s lag) would resolve the wrong target list. cleanupOrphanedMirrors then ran against the stale list and missed orphans (manifested in e2e as 'Orphaned mirror in kubemirror-e2e-app-1 not deleted within timeout' after target-namespaces was changed). Defaulting to true fixes the race; the trade-off is one extra API read per stale-cache reconcile. M2: ResolveTargetNamespaces glob branch checked filter.IsAllowed but not the opt-out map, so a namespace labeled allow-mirrors=false would still receive a mirror through patterns like 'app-*'. The 'all' branch already had the guard; the glob branch now does too. Direct namespace listings still bypass opt-out by design (explicit author intent).