fix: Namespace Sync controller should list no resources when source namespace is empty string

pkg/controllers/namespacesync/controller.go

@@ -32,13 +32,6 @@ type Reconciler struct {
 	TargetNamespaceFilter func(ns *corev1.Namespace) bool
 }
 
-var NamespaceHasLabelKey = func(key string) func(ns *corev1.Namespace) bool {
-	return func(ns *corev1.Namespace) bool {
-		_, ok := ns.GetLabels()[key]
-		return ok
-	}
-}
-
 func (r *Reconciler) SetupWithManager(
 	ctx context.Context,
 	mgr ctrl.Manager,
@@ -157,6 +150,12 @@ func (r *Reconciler) listSourceClusterClasses(
 	[]clusterv1.ClusterClass,
 	error,
 ) {
+	// Handle the empty string explicitly, because listing resources with an empty
+	// string namespace returns resources in all namespaces.
+	if r.SourceClusterClassNamespace == "" {
+		return nil, nil
+	}
+
 	ccl := &clusterv1.ClusterClassList{}
 	err := r.Client.List(ctx, ccl, client.InNamespace(r.SourceClusterClassNamespace))
 	if err != nil {

pkg/controllers/namespacesync/controller_test.go

@@ -73,6 +73,29 @@ func TestReconcileNewClusterClass(t *testing.T) {
 	}
 }
 
+func TestSourceClusterClassNamespaceEmpty(t *testing.T) {
+	g := NewWithT(t)
+
+	_, cleanup, err := createUniqueClusterClassAndTemplates(
+		sourceClusterClassNamespace,
+	)
+	g.Expect(err).ToNot(HaveOccurred())
+	defer func() {
+		g.Expect(cleanup()).To(Succeed())
+	}()
+
+	// This test initializes its own reconciler, instead of using the one created
+	// in suite_test.go, in order to configure the source namespace.
+	r := Reconciler{
+		Client:                      env.Client,
+		SourceClusterClassNamespace: "",
+	}
+
+	ns, err := r.listSourceClusterClasses(ctx)
+	g.Expect(err).ToNot(HaveOccurred())
+	g.Expect(ns).To(BeEmpty())
+}
+
 func verifyClusterClassAndTemplates(
 	cli client.Reader,
 	name,

pkg/controllers/namespacesync/label.go

@@ -0,0 +1,12 @@
+// Copyright 2024 Nutanix. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+package namespacesync
+
+import corev1 "k8s.io/api/core/v1"
+
+var NamespaceHasLabelKey = func(key string) func(ns *corev1.Namespace) bool {
+	return func(ns *corev1.Namespace) bool {
+		_, ok := ns.GetLabels()[key]
+		return ok
+	}
+}

pkg/controllers/namespacesync/label_test.go

@@ -0,0 +1,61 @@
+// Copyright 2024 Nutanix. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+package namespacesync
+
+import (
+	"testing"
+
+	corev1 "k8s.io/api/core/v1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestNamespaceHasLabelKey(t *testing.T) {
+	tests := []struct {
+		name string
+		key  string
+		ns   *corev1.Namespace
+		want bool
+	}{
+		{
+			name: "match a labeled namespace",
+			key:  "testkey",
+			ns: &corev1.Namespace{
+				ObjectMeta: v1.ObjectMeta{
+					Name: "test",
+					Labels: map[string]string{
+						"testkey": "",
+					},
+				},
+			},
+			want: true,
+		},
+		{
+			name: "do not match if label key is not found",
+			key:  "testkey",
+			ns: &corev1.Namespace{
+				ObjectMeta: v1.ObjectMeta{
+					Name: "test",
+				},
+			},
+			want: false,
+		},
+		{
+			name: "do not match if label key is empty string",
+			key:  "",
+			ns: &corev1.Namespace{
+				ObjectMeta: v1.ObjectMeta{
+					Name: "test",
+				},
+			},
+			want: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fn := NamespaceHasLabelKey(tt.key)
+			if got := fn(tt.ns); got != tt.want {
+				t.Fatalf("got %t, want %t", got, tt.want)
+			}
+		})
+	}
+}