Add namespace label selector support for reflection

[davidswimbird]

Add two new annotations that allow selecting target namespaces by
Kubernetes label selectors instead of only name regex patterns:

• reflection-allowed-namespaces-selector
• reflection-auto-namespaces-selector

When both a name-pattern and a label selector annotation are set, a
namespace matches if it satisfies either condition (OR logic). The label
selector supports standard Kubernetes syntax: equality (=, ==, !=),
existence, and set-based (in, notin) expressions.

This is useful when you want to reflect a secret to a subset of non-deterministic namespaces, that can't be represented with a regex.

For my use case, it makes the manual overhead of managing reflector a lot smaller, as I can automate the label configuration for my namespaces ahead of time, to know that they will be receiving the secrets when the namespace is created with a specified label.

This is based on the suggestion in: Discussion #409

[winromulus]

@davidswimbird while I review this, please update the documentation as well (readme)

[Copilot]

Pull request overview

Adds namespace label selector support to the reflector’s “allowed namespaces” and “auto namespaces” logic, enabling selection of target namespaces via standard Kubernetes label selector syntax in addition to existing name/regex matching.

Changes:

• Introduces two new reflection annotations for label selectors (allowed/auto namespaces selectors) and wires them into MirroringProperties.
• Implements label-selector matching (with OR logic vs name-pattern matching) and updates mirroring flows to use V1Namespace when available.
• Adds unit tests and test helpers for selector behavior; exposes internals to the test project.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tests/ES.Kubernetes.Reflector.Tests/LabelSelectorMatchTests.cs	Adds unit tests for label selector parsing/matching and OR logic with name patterns.
tests/ES.Kubernetes.Reflector.Tests/Additions/ReflectorAnnotationsBuilder.cs	Adds builder helpers for the new selector annotations in tests.
src/ES.Kubernetes.Reflector/Mirroring/Core/ResourceMirror.cs	Caches namespaces for selector evaluation and uses V1Namespace overloads for matching.
src/ES.Kubernetes.Reflector/Mirroring/Core/MirroringPropertiesExtensions.cs	Parses new annotations, adds selector-aware matching, and implements label selector evaluation.
src/ES.Kubernetes.Reflector/Mirroring/Core/MirroringProperties.cs	Adds properties for allowed/auto namespace label selectors.
src/ES.Kubernetes.Reflector/Mirroring/Core/Annotations.cs	Adds constants for the new selector annotations.
src/ES.Kubernetes.Reflector/ES.Kubernetes.Reflector.csproj	Adds InternalsVisibleTo to allow unit tests to access LabelSelectorMatch.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Automatically marked as stale due to no recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[davidswimbird]

Hey @winromulus. How's the review coming along? :)

[winromulus]

@davidswimbird a couple of comments left as pending. Can you check those please?

[davidswimbird]

@winromulus resolved all comments. They had already been adressed, just didn't want to resolve comments without you having a look :)

[winromulus]

Hey — thanks for your patience with this one, sorry it sat longer than it should have. Circling back now with a proper pass.

First, the Copilot round was handled really well. I checked each one against current code: the fail-closed path in LabelSelectorMatch, the Modified + Deleted handlers, the negative-case tests, and the updated XML doc are all solid. The negative test coverage in particular (the InvalidSelector_* theories) is exactly the right shape.

I had a couple of items from an earlier review pass that didn't come through on the PR conversation — apologies for that, they're on me. I've restated them as inline comments below along with a few smaller things I spotted on this pass.

On tests: the unit coverage for the parser is thorough, but there's no end-to-end coverage for the feature itself. Given the existing Testcontainers.K3s pattern (see MirroringIntegrationTests.AutoReflect_To_AllowedNamespaces), it would be worth one or two integration tests — particularly one that exercises the new Modified-path logic (label changes creating/removing reflections), since that's easy to silently break with a future refactor.

Thanks again for the contribution — the core approach is sound and the implementation is genuinely considerate (the XML docs, the overload preservation, the InternalsVisibleTo pattern, all good calls). Happy to merge once the items below are resolved.

[davidswimbird]

Thanks for the review @winromulus! Appreciate that you took the time and dug deep, you found things I would never have caught myself.

I've adressed your inline comments, and added integration tests for the full feature as per the root review comment.

Let me know if there's anything else I should adress :)

[winromulus]

Really thorough response — appreciate the care on every point. I walked through each of the new commits against the earlier asks and they all hold up.

• Security fallback (983e507): CanBeReflectedToNamespaceCached / CanBeAutoReflectedToNamespaceCached now fail closed when a selector is configured and the namespace isn't cached, with a debug log for visibility. Clean, preserves existing behavior for regex-only sources.
• Parser refactor (551bdc9): V1LabelSelector / V1LabelSelectorRequirement as the internal representation, K8s-spec label key/value validation (prefix + name, length limits, regexes), and warning logs deduped per source-signature — exactly the surface area that was missing. The split between TryParseSetBased / TryParseInequality / TryParseEquality / TryParseExistence reads cleanly and each path validates independently. GetLabelSelectorErrors as a public diagnostic is a nice touch.
• Direct reflection rebalance (25ab8ff): both Modified and Deleted now walk _directReflectionCache, and the DirectReflect_StopsUpdating_WhenNamespaceLabelsNoLongerMatchSelector integration test exercises exactly the shift-label-mid-flight scenario.
• Labels-equal short-circuit (baf0a2d): NamespaceLabelsEqual with empty-dict coalescing, dedicated unit tests covering null/empty/add/remove/rename/same, applied before both the auto-source loop and the direct-rebalance loop.
• Integration tests: AutoReflect_To_NamespacesMatchingLabelSelector and AutoReflect_UpdatesReflections_WhenNamespaceLabelsChange plus the direct-reflection test give end-to-end protection for the new behavior. Pattern matches the existing AutoReflect_To_AllowedNamespaces shape, which is exactly right.

Two very small observations I won't block on:

1. NamespaceLabelsEqual uses SequenceEqual, which is order-sensitive — two semantically-equal dicts with different insertion order would compare unequal and fall through to reconciliation. Correctness is preserved (more work, not less), so it's fine as-is; a Count + All(TryGetValue...) check would be order-independent if you want to tune it.
2. TryParseEquality silently overwrites duplicate keys with conflicting values — e.g. env=prod,env=staging parses as matchLabels["env"] = "staging" rather than being rejected. Real-world operators won't write that, and kubectl would reject it, but a "duplicate key" check would make the parser a touch more faithful. Up to you — I'd leave it.

Really strong engagement through the review. Approving — happy to merge.