| Operator ⇅ | C ⇅ | H ⇅ | M ⇅ | L ⇅ | Total ▼ | APs |
|---|---|---|---|---|---|---|
cluster-node-tuning-operatorcluster-node-tuning-operator 3263815 91 AP-1, AP-10, AP-3, AP-7, AP-8, AP-9 91c812dcaf93AP-3: Invisible informer from client.Get() (32)
err := r.ManagementClient.List(ctx, cmList, client.MatchingLabels{hypershiftconsts.NodePoolNameLabel: npName, hypershiftconsts.ControllerGeneratedPerformanceProfileConfigMapLabel: "true"})
client.Get()/List() for corev1.ConfigMapList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.ConfigMapList in every namespace.
Add &corev1.ConfigMapList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err = client.Get(ctx, key, infra); err != nil {
client.Get()/List() for apiconfigv1.Infrastructure which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every apiconfigv1.Infrastructure in every namespace.
Add &apiconfigv1.Infrastructure{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := cli.Get(ctx, client.ObjectKeyFromObject(cm), tcm)
client.Get()/List() for corev1.ConfigMap which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.ConfigMap in every namespace.
Add &corev1.ConfigMap{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := ci.Client.List(ctx, cmList, &client.ListOptions{
client.Get()/List() for corev1.ConfigMapList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.ConfigMapList in every namespace.
Add &corev1.ConfigMapList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := ci.Client.List(ctx, cmList, &client.ListOptions{
client.Get()/List() for corev1.ConfigMapList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.ConfigMapList in every namespace.
Add &corev1.ConfigMapList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := ci.Client.List(ctx, cmList, &client.ListOptions{
client.Get()/List() for corev1.ConfigMapList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.ConfigMapList in every namespace.
Add &corev1.ConfigMapList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := cli.Get(ctx, key, cm)
client.Get()/List() for performancev2.PerformanceProfileStatus which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every performancev2.PerformanceProfileStatus in every namespace.
Add &performancev2.PerformanceProfileStatus{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := cli.Get(ctx, key, co); err != nil {
client.Get()/List() for apiconfigv1.ClusterOperator which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every apiconfigv1.ClusterOperator in every namespace.
Add &apiconfigv1.ClusterOperator{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := cli.List(ctx, nodes, &client.ListOptions{LabelSelector: selector}); err != nil {
client.Get()/List() for corev1.NodeList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.NodeList in every namespace.
Add &corev1.NodeList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err = testclient.DataPlaneClient.Get(ctx, client.ObjectKey{Name: p.Spec.NodeName}, node)
client.Get()/List() for corev1.Node which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Node in every namespace.
Add &corev1.Node{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err = testclient.DataPlaneClient.Get(ctx, client.ObjectKey{Name: p.Spec.NodeName}, node)
client.Get()/List() for corev1.Node which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Node in every namespace.
Add &corev1.Node{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
Expect(testclient.ControlPlaneClient.Get(ctx, key, kc)).ToNot(HaveOccurred())
client.Get()/List() for machineconfigv1.KubeletConfig which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every machineconfigv1.KubeletConfig in every namespace.
Add &machineconfigv1.KubeletConfig{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := c.List(ctx, npList); err != nil {
client.Get()/List() for hypershiftv1beta1.NodePoolList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every hypershiftv1beta1.NodePoolList in every namespace.
Add &hypershiftv1beta1.NodePoolList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := testclient.DataPlaneClient.List(ctx, podList, listOptions); err != nil {
client.Get()/List() for corev1.PodList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.PodList in every namespace.
Add &corev1.PodList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err = testclient.DataPlaneClient.Get(ctx, client.ObjectKeyFromObject(testpod), updatedPod)
client.Get()/List() for corev1.Pod which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Pod in every namespace.
Add &corev1.Pod{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := testclient.DataPlaneClient.Get(ctx, client.ObjectKeyFromObject(testpod), &updatedPod)
client.Get()/List() for corev1.Pod which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Pod in every namespace.
Add &corev1.Pod{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := testclient.ControlPlaneClient.List(ctx, ctrcfgList); err != nil {
client.Get()/List() for machineconfigv1.ContainerRuntimeConfigList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every machineconfigv1.ContainerRuntimeConfigList in every namespace.
Add &machineconfigv1.ContainerRuntimeConfigList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := testclient.DataPlaneClient.List(ctx, ovnpods, options)
client.Get()/List() for corev1.Pod which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Pod in every namespace.
Add &corev1.Pod{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := c.Get(ctx, key, nodecfg)
client.Get()/List() for apiconfigv1.Node which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every apiconfigv1.Node in every namespace.
Add &apiconfigv1.Node{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := cli.Get(ctx, key, &ds)
client.Get()/List() for appsv1.DaemonSet which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every appsv1.DaemonSet in every namespace.
Add &appsv1.DaemonSet{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := cli.List(ctx, podList, &client.ListOptions{
client.Get()/List() for corev1.PodList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.PodList in every namespace.
Add &corev1.PodList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := cli.Get(ctx, types.NamespacedName{Namespace: namespace, Name: name}, deployment)
client.Get()/List() for appsv1.Deployment which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every appsv1.Deployment in every namespace.
Add &appsv1.Deployment{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := testclient.DataPlaneClient.Get(ctx, mcpKey, mcp); apierrors.IsNotFound(err) {
client.Get()/List() for machineconfigv1.MachineConfigPool which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every machineconfigv1.MachineConfigPool in every namespace.
Add &machineconfigv1.MachineConfigPool{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := testclient.Client.Get(ctx, key, ns); errors.IsNotFound(err) {
client.Get()/List() for corev1.Namespace which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Namespace in every namespace.
Add &corev1.Namespace{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := testclient.DataPlaneClient.List(ctx, pods, listOptions); err != nil {
client.Get()/List() for corev1.PodList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.PodList in every namespace.
Add &corev1.PodList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err = c.Get(ctx, key, np)
client.Get()/List() for hypershiftv1beta1.NodePool which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every hypershiftv1beta1.NodePool in every namespace.
Add &hypershiftv1beta1.NodePool{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := c.List(ctx, npList); err != nil {
client.Get()/List() for hypershiftv1beta1.NodePoolList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every hypershiftv1beta1.NodePoolList in every namespace.
Add &hypershiftv1beta1.NodePoolList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := testclient.DataPlaneClient.Get(ctx, podKey, updatedPod); err != nil {
client.Get()/List() for corev1.Pod which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Pod in every namespace.
Add &corev1.Pod{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := testclient.DataPlaneClient.Get(ctx, podKey, updatedPod); err != nil {
client.Get()/List() for corev1.Pod which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Pod in every namespace.
Add &corev1.Pod{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := testclient.DataPlaneClient.Get(ctx, podKey, updatedPod); err != nil {
client.Get()/List() for corev1.Pod which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Pod in every namespace.
Add &corev1.Pod{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := testclient.DataPlaneClient.List(ctx, &pods, listOptions)
client.Get()/List() for client.ListOptions which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every client.ListOptions in every namespace.
Add &client.ListOptions{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := testclient.DataPlaneClient.List(ctx, podList, opts); err != nil {
client.Get()/List() for client.ListOptions which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every client.ListOptions in every namespace.
Add &client.ListOptions{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
AP-1: Predicate filters don't limit cache (6)
Owns(&mcov1.MachineConfig{}, builder.WithPredicates(p)).
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
Owns(&mcov1.KubeletConfig{}, builder.WithPredicates(kubeletPredicates)).
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
Owns(&tunedv1.Tuned{}, builder.WithPredicates(p)).
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
Owns(&nodev1.RuntimeClass{}, builder.WithPredicates(p)).
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(mcpPredicates)).
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(tunedProfilePredicates),
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
AP-10: No DefaultTransform to strip managedFields (1)
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
AP-7: Operator-created resources missing cache labels (11)
ObjectMeta without label: nodekey
Resource created by the operator lacks the label (nodekey) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"nodekey": "true"} to the ObjectMeta.
ObjectMeta without label: nodekey
Resource created by the operator lacks the label (nodekey) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"nodekey": "true"} to the ObjectMeta.
ObjectMeta without label: nodekey
Resource created by the operator lacks the label (nodekey) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"nodekey": "true"} to the ObjectMeta.
ObjectMeta without label: nodekey
Resource created by the operator lacks the label (nodekey) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"nodekey": "true"} to the ObjectMeta.
ObjectMeta without label: nodekey
Resource created by the operator lacks the label (nodekey) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"nodekey": "true"} to the ObjectMeta.
ObjectMeta without label: nodekey
Resource created by the operator lacks the label (nodekey) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"nodekey": "true"} to the ObjectMeta.
ObjectMeta without label: nodekey
Resource created by the operator lacks the label (nodekey) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"nodekey": "true"} to the ObjectMeta.
ObjectMeta without label: nodekey
Resource created by the operator lacks the label (nodekey) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"nodekey": "true"} to the ObjectMeta.
ObjectMeta without label: nodekey
Resource created by the operator lacks the label (nodekey) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"nodekey": "true"} to the ObjectMeta.
ObjectMeta without label: nodekey
Resource created by the operator lacks the label (nodekey) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"nodekey": "true"} to the ObjectMeta.
ObjectMeta without label: nodekey
Resource created by the operator lacks the label (nodekey) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"nodekey": "true"} to the ObjectMeta.
AP-9: Labels not propagated during resource updates (26)
_, err = cs.Tuneds(ntoconfig.WatchNamespace()).Update(ctx, curTuned, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
_, err = cs.Tuneds(ntoconfig.WatchNamespace()).Update(ctx, curTuned, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
_, err = cs.Tuneds(ntoconfig.WatchNamespace()).Update(ctx, curTuned, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
Expect(testclient.DataPlaneClient.Update(ctx, &ns)).ToNot(HaveOccurred())
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
if err = cli.Update(ctx, np); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
if err = cli.Update(ctx, np); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
if cli.Update(ctx, np) != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
if cli.Update(ctx, np) != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
return dpi.Client.Update(ctx, obj, opts...)
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
if err := r.ManagementClient.Update(ctx, instance); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
if err = r.ManagementClient.Update(ctx, instance); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
if err := r.StatusWriter.Update(ctx, instance, conditions); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
if err := r.StatusWriter.Update(ctx, profile, conditions); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
if err := r.StatusWriter.Update(ctx, profile, conditions); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
return w.Update(ctx, profile, conditions)
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
return w.Client.Status().Update(ctx, profile)
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
return ci.Client.Update(ctx, obj, opts...)
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
return ci.Client.Update(ctx, cm, opts...)
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
if err := cli.Update(ctx, tcm); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
return w.Update(ctx, object, conditions)
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
if err := w.Update(ctx, instance, conditions); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
if err := cli.Update(ctx, cm); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
return cli.Update(ctx, mc)
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
return cli.Update(ctx, kc)
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
return cli.Update(ctx, tuned)
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
return cli.Update(ctx, runtimeClass)
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (openshift-app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["openshift-app"] = "true"
AP-8: No upgrade path for pre-existing unlabeled resources (15)
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
|
||||||
cluster-capi-operatorcluster-capi-operator 1625388 87 AP-1, AP-10, AP-3, AP-7, AP-8, AP-9 f9513d325592AP-3: Invisible informer from client.Get() (16)
Expect(cl.Get(ctx, infraName, infra)).To(Succeed())
client.Get()/List() for configv1.Infrastructure which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.Infrastructure in every namespace.
Add &configv1.Infrastructure{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := cl.Get(ctx, nodeName, node); err != nil {
client.Get()/List() for corev1.Node which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Node in every namespace.
Add &corev1.Node{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.List(ctx, configMapList, client.InNamespace(defaultCAPINamespace),
client.Get()/List() for corev1.ConfigMapList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.ConfigMapList in every namespace.
Add &corev1.ConfigMapList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.Client.Get(ctx, clusterObjectKey, infraCluster); err != nil {
client.Get()/List() for unstructured.Unstructured which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every unstructured.Unstructured in every namespace.
Add &unstructured.Unstructured{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.Get(ctx, client.ObjectKey{Namespace: r.CAPINamespace, Name: r.Infra.Status.InfrastructureName}, azureClusterIdentity); err != nil && !cerrors.IsNotFound(err) {
client.Get()/List() for azurev1.AzureClusterIdentity which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every azurev1.AzureClusterIdentity in every namespace.
Add &azurev1.AzureClusterIdentity{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.Get(ctx, client.ObjectKey{Name: controllers.InfrastructureResourceName}, infra); err != nil {
client.Get()/List() for configv1.Infrastructure which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.Infrastructure in every namespace.
Add &configv1.Infrastructure{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.Get(ctx, client.ObjectKey{Namespace: r.CAPINamespace, Name: m.Name}, capiMachine); err != nil {
client.Get()/List() for clusterv1.Machine which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every clusterv1.Machine in every namespace.
Add &clusterv1.Machine{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.Get(ctx, client.ObjectKey{Namespace: r.CAPINamespace, Name: mapiMachine.Name}, capiMachine); err != nil {
client.Get()/List() for clusterv1.Machine which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every clusterv1.Machine in every namespace.
Add &clusterv1.Machine{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.Get(ctx, client.ObjectKey{Namespace: r.CAPINamespace, Name: m.Name}, capiMachine); err != nil {
client.Get()/List() for clusterv1.Machine which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every clusterv1.Machine in every namespace.
Add &clusterv1.Machine{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.Get(ctx, client.ObjectKey{Namespace: r.CAPINamespace, Name: mapiMachine.Name}, capiMachine); err != nil {
client.Get()/List() for clusterv1.Machine which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every clusterv1.Machine in every namespace.
Add &clusterv1.Machine{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.Get(ctx, client.ObjectKey{Namespace: r.CAPINamespace, Name: ms.Name}, capiMachineSet); err != nil {
client.Get()/List() for clusterv1.MachineSet which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every clusterv1.MachineSet in every namespace.
Add &clusterv1.MachineSet{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.Get(ctx, client.ObjectKey{Namespace: r.CAPINamespace, Name: mapiMachineSet.Name}, capiMachineSet); err != nil {
client.Get()/List() for clusterv1.MachineSet which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every clusterv1.MachineSet in every namespace.
Add &clusterv1.MachineSet{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.Get(ctx, client.ObjectKey{Namespace: r.CAPINamespace, Name: ms.Name}, capiMachineSet); err != nil {
client.Get()/List() for clusterv1.MachineSet which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every clusterv1.MachineSet in every namespace.
Add &clusterv1.MachineSet{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.Get(ctx, client.ObjectKey{Namespace: r.CAPINamespace, Name: mapiMachineSet.Name}, capiMachineSet); err != nil {
client.Get()/List() for clusterv1.MachineSet which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every clusterv1.MachineSet in every namespace.
Add &clusterv1.MachineSet{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.Get(ctx, client.ObjectKey{Namespace: r.CAPINamespace, Name: r.Infra.Status.InfrastructureName}, awsCluster); err != nil {
client.Get()/List() for awsv1.AWSCluster which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every awsv1.AWSCluster in every namespace.
Add &awsv1.AWSCluster{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := cl.Get(ctx, client.ObjectKey{Name: infrastructureResourceName}, infra); err != nil {
client.Get()/List() for configv1.Infrastructure which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.Infrastructure in every namespace.
Add &configv1.Infrastructure{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
AP-1: Predicate filters don't limit cache (25)
For(&configv1.ClusterOperator{}, builder.WithPredicates(clusterOperatorPredicates())).
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(configMapPredicate(r.ManagedNamespace, r.Platform)),
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(ownedPlatformLabelPredicate(w.namespace, r.Platform)),
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
For(&mapiv1beta1.Machine{}, builder.WithPredicates(util.FilterNamespace(r.MAPINamespace))).
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(util.FilterNamespace(r.CAPINamespace)),
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(util.FilterNamespace(r.CAPINamespace)),
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
For(&mapiv1beta1.MachineSet{}, builder.WithPredicates(util.FilterNamespace(r.MAPINamespace))).
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(util.FilterNamespace(r.CAPINamespace)),
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(util.FilterNamespace(r.CAPINamespace)),
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
For(&configv1.ClusterOperator{}, builder.WithPredicates(clusterOperatorPredicates())).
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(coreClusterPredicate(r.ManagedNamespace)),
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(tokenSecretPredicate()),
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(kubeconfigSecretPredicate()),
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(userDataSecretPredicate(r.ManagedNamespace)),
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(userDataSecretPredicate(SecretSourceNamespace)),
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
For(&mapiv1beta1.Machine{}, builder.WithPredicates(util.FilterNamespace(r.MAPINamespace))).
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(util.FilterNamespace(r.CAPINamespace)),
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(util.FilterNamespace(r.CAPINamespace)),
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
For(&configv1.ClusterOperator{}, builder.WithPredicates(clusterOperatorPredicates())).
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(infraClusterPredicate(r.ManagedNamespace)),
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(util.FilterNamespace(r.MAPINamespace)),
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(util.FilterNamespace(r.MAPINamespace)),
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
For(&mapiv1beta1.MachineSet{}, builder.WithPredicates(util.FilterNamespace(r.MAPINamespace))).
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(util.FilterNamespace(r.CAPINamespace)),
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(util.FilterNamespace(r.CAPINamespace)),
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
AP-10: No DefaultTransform to strip managedFields (2)
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
AP-7: Operator-created resources missing cache labels (27)
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
ObjectMeta without label: machine.openshift.io/cluster-api-machine-role
Resource created by the operator lacks the label (machine.openshift.io/cluster-api-machine-role) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"machine.openshift.io/cluster-api-machine-role": "true"} to the ObjectMeta.
AP-9: Labels not propagated during resource updates (9)
err := cl.Update(ctx, copyObj)
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (machine.openshift.io/cluster-api-machine-role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["machine.openshift.io/cluster-api-machine-role"] = "true"
actual, err := client.CustomResourceDefinitions().Update(ctx, existingCopy, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (machine.openshift.io/cluster-api-machine-role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["machine.openshift.io/cluster-api-machine-role"] = "true"
if err := r.Update(ctx, target); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (machine.openshift.io/cluster-api-machine-role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["machine.openshift.io/cluster-api-machine-role"] = "true"
if err := r.Update(ctx, updatedOrCreatedCAPIInfraMachine); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (machine.openshift.io/cluster-api-machine-role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["machine.openshift.io/cluster-api-machine-role"] = "true"
if err := r.Update(ctx, existingCAPIInfraMachine); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (machine.openshift.io/cluster-api-machine-role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["machine.openshift.io/cluster-api-machine-role"] = "true"
if err := r.Update(ctx, updatedCAPIMachine); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (machine.openshift.io/cluster-api-machine-role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["machine.openshift.io/cluster-api-machine-role"] = "true"
if err := r.Update(ctx, updatedMAPIMachine); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (machine.openshift.io/cluster-api-machine-role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["machine.openshift.io/cluster-api-machine-role"] = "true"
if err := r.Update(ctx, updatedOrCreatedCAPIMachineSet); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (machine.openshift.io/cluster-api-machine-role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["machine.openshift.io/cluster-api-machine-role"] = "true"
if err := r.Update(ctx, updatedMAPIMachineSet); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (machine.openshift.io/cluster-api-machine-role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["machine.openshift.io/cluster-api-machine-role"] = "true"
AP-8: No upgrade path for pre-existing unlabeled resources (8)
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
|
||||||
cluster-ingress-operatorcluster-ingress-operator 64040 68 AP-10, AP-3 cadbee7826caAP-3: Invisible informer from client.Get() (64)
if err := r.client.Get(ctx, defaultIngressControllerName, defaultIngressController); err != nil {
client.Get()/List() for operatorv1.IngressController which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operatorv1.IngressController in every namespace.
Add &operatorv1.IngressController{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, defaultCertName, defaultCert); err != nil {
client.Get()/List() for corev1.Secret which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Secret in every namespace.
Add &corev1.Secret{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, operatorcontroller.CanaryDaemonSetName(), canaryDaemonSet); err != nil {
client.Get()/List() for corev1.Secret which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Secret in every namespace.
Add &corev1.Secret{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, operatorcontroller.CanaryCertificateName(), currentCanaryCert); err != nil {
client.Get()/List() for corev1.Secret which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Secret in every namespace.
Add &corev1.Secret{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, request.NamespacedName, ingress); err != nil {
client.Get()/List() for operatorv1.IngressController which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operatorv1.IngressController in every namespace.
Add &operatorv1.IngressController{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err = r.client.Get(ctx, controller.RouterDeploymentName(ingress), deployment)
client.Get()/List() for appsv1.Deployment which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every appsv1.Deployment in every namespace.
Add &appsv1.Deployment{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.List(ctx, controllers, client.InNamespace(r.operatorNamespace)); err != nil {
client.Get()/List() for operatorv1.IngressControllerList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operatorv1.IngressControllerList in every namespace.
Add &operatorv1.IngressControllerList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.List(ctx, secrets, client.InNamespace(r.operandNamespace)); err != nil {
client.Get()/List() for corev1.SecretList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.SecretList in every namespace.
Add &corev1.SecretList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.Get(ctx, controller.IngressClusterConfigName(), &ingressConfig); err != nil {
client.Get()/List() for configv1.Ingress which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.Ingress in every namespace.
Add &configv1.Ingress{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, name, cm); err != nil {
client.Get()/List() for corev1.ConfigMap which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.ConfigMap in every namespace.
Add &corev1.ConfigMap{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := reconciler.cache.List(ctx, controllers, listOpts); err != nil {
client.Get()/List() for operatorv1.IngressControllerList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operatorv1.IngressControllerList in every namespace.
Add &operatorv1.IngressControllerList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, request.NamespacedName, ic); err != nil {
client.Get()/List() for operatorv1.IngressController which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operatorv1.IngressController in every namespace.
Add &operatorv1.IngressController{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.Get(ctx, request.NamespacedName, ingress); err != nil {
client.Get()/List() for configv1.Ingress which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.Ingress in every namespace.
Add &configv1.Ingress{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, types.NamespacedName{Namespace: r.config.SecretNamespace, Name: roleName}, role); err != nil {
client.Get()/List() for rbacv1.Role which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every rbacv1.Role in every namespace.
Add &rbacv1.Role{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.List(ctx, controllers, listOpts); err != nil {
client.Get()/List() for operatorv1.IngressControllerList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operatorv1.IngressControllerList in every namespace.
Add &operatorv1.IngressControllerList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.List(ctx, controllers, listOpts); err != nil {
client.Get()/List() for operatorv1.IngressControllerList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operatorv1.IngressControllerList in every namespace.
Add &operatorv1.IngressControllerList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.Get(ctx, request.NamespacedName, ic); err != nil {
client.Get()/List() for operatorv1.IngressController which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operatorv1.IngressController in every namespace.
Add &operatorv1.IngressController{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.Get(ctx, operatorcontroller.RouterDeploymentName(ic), deployment); err != nil {
client.Get()/List() for appsv1.Deployment which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every appsv1.Deployment in every namespace.
Add &appsv1.Deployment{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.Get(ctx, clientCAConfigmapName, clientCAConfigmap); err != nil {
client.Get()/List() for corev1.ConfigMap which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.ConfigMap in every namespace.
Add &corev1.ConfigMap{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, controller.CRLConfigMapName(ic), cm); err != nil {
client.Get()/List() for corev1.ConfigMap which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.ConfigMap in every namespace.
Add &corev1.ConfigMap{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, types.NamespacedName{Name: "cluster"}, dnsConfig); err != nil {
client.Get()/List() for configv1.DNS which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.DNS in every namespace.
Add &configv1.DNS{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, request.NamespacedName, record); err != nil {
client.Get()/List() for iov1.DNSRecord which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every iov1.DNSRecord in every namespace.
Add &iov1.DNSRecord{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, request.NamespacedName, ¤t); err != nil {
client.Get()/List() for iov1.DNSRecord which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every iov1.DNSRecord in every namespace.
Add &iov1.DNSRecord{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.List(ctx, records, client.InNamespace(ns)); err != nil {
client.Get()/List() for iov1.DNSRecordList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every iov1.DNSRecordList in every namespace.
Add &iov1.DNSRecordList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, name, &crd); err != nil {
client.Get()/List() for apiextensionsv1.CustomResourceDefinition which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every apiextensionsv1.CustomResourceDefinition in every namespace.
Add &apiextensionsv1.CustomResourceDefinition{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.List(ctx, gatewayAPICRDs, client.MatchingFields{gatewayAPICRDIndexFieldName: unmanagedGatewayAPICRDIndexFieldValue}); err != nil {
client.Get()/List() for apiextensionsv1.CustomResourceDefinitionList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every apiextensionsv1.CustomResourceDefinitionList in every namespace.
Add &apiextensionsv1.CustomResourceDefinitionList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, types.NamespacedName{Name: name}, &existingClusterRole); err != nil {
client.Get()/List() for rbacv1.ClusterRole which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every rbacv1.ClusterRole in every namespace.
Add &rbacv1.ClusterRole{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, name, co); err != nil {
client.Get()/List() for configv1.ClusterOperator which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.ClusterOperator in every namespace.
Add &configv1.ClusterOperator{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.List(ctx, &gatewayClasses); err != nil {
client.Get()/List() for gatewayapiv1.GatewayClassList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every gatewayapiv1.GatewayClassList in every namespace.
Add &gatewayapiv1.GatewayClassList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.List(ctx, &gatewayClasses, client.MatchingFields{
client.Get()/List() for gatewayapiv1.GatewayClassList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every gatewayapiv1.GatewayClassList in every namespace.
Add &gatewayapiv1.GatewayClassList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.Get(ctx, request.NamespacedName, gatewayclass); err != nil {
client.Get()/List() for gatewayapiv1.GatewayClass which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every gatewayapiv1.GatewayClass in every namespace.
Add &gatewayapiv1.GatewayClass{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.Get(ctx, request.NamespacedName, gatewayClass); err != nil {
client.Get()/List() for gatewayapiv1.GatewayClass which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every gatewayapiv1.GatewayClass in every namespace.
Add &gatewayapiv1.GatewayClass{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.Get(ctx, name, &istio); err != nil {
client.Get()/List() for sailv1.Istio which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every sailv1.Istio in every namespace.
Add &sailv1.Istio{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.Get(ctx, namespacedName, &crd); err != nil {
client.Get()/List() for apiextensionsv1.CustomResourceDefinition which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every apiextensionsv1.CustomResourceDefinition in every namespace.
Add &apiextensionsv1.CustomResourceDefinition{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err = r.client.Get(ctx, istioRevisionName, istioRevision)
client.Get()/List() for sailv1.IstioRevision which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every sailv1.IstioRevision in every namespace.
Add &sailv1.IstioRevision{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, name, &subscription); err != nil {
client.Get()/List() for operatorsv1alpha1.Subscription which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operatorsv1alpha1.Subscription in every namespace.
Add &operatorsv1alpha1.Subscription{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.List(ctx, installPlans, client.InNamespace(operatorcontroller.OpenshiftOperatorNamespace)); err != nil {
client.Get()/List() for operatorsv1alpha1.InstallPlanList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operatorsv1alpha1.InstallPlanList in every namespace.
Add &operatorsv1alpha1.InstallPlanList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.Get(ctx, request.NamespacedName, &gateway); err != nil {
client.Get()/List() for gatewayapiv1.Gateway which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every gatewayapiv1.Gateway in every namespace.
Add &gatewayapiv1.Gateway{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := reconciler.cache.List(ctx, &gateways); err != nil {
client.Get()/List() for gatewayapiv1.GatewayList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every gatewayapiv1.GatewayList in every namespace.
Add &gatewayapiv1.GatewayList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.Get(ctx, request.NamespacedName, &service); err != nil {
client.Get()/List() for corev1.Service which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Service in every namespace.
Add &corev1.Service{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.Get(ctx, gatewayName, &gateway); err != nil {
client.Get()/List() for gatewayapiv1.Gateway which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every gatewayapiv1.Gateway in every namespace.
Add &gatewayapiv1.Gateway{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, types.NamespacedName{Name: "cluster"}, dnsConfig); err != nil {
client.Get()/List() for configv1.DNS which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.DNS in every namespace.
Add &configv1.DNS{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, types.NamespacedName{Name: "cluster"}, infraConfig); err != nil {
client.Get()/List() for configv1.Infrastructure which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.Infrastructure in every namespace.
Add &configv1.Infrastructure{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.List(ctx, &dnsrecords, listOpts...); err != nil {
client.Get()/List() for iov1.DNSRecordList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every iov1.DNSRecordList in every namespace.
Add &iov1.DNSRecordList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.List(ctx, classes); err != nil {
client.Get()/List() for networkingv1.IngressClassList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every networkingv1.IngressClassList in every namespace.
Add &networkingv1.IngressClassList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.List(ctx, controllers, client.InNamespace(r.config.Namespace)); err != nil {
client.Get()/List() for operatorv1.IngressControllerList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operatorv1.IngressControllerList in every namespace.
Add &operatorv1.IngressControllerList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, request.NamespacedName, ingress); err != nil {
client.Get()/List() for operatorv1.IngressController which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operatorv1.IngressController in every namespace.
Add &operatorv1.IngressController{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, types.NamespacedName{Name: "cluster"}, apiConfig); err != nil {
client.Get()/List() for configv1.APIServer which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.APIServer in every namespace.
Add &configv1.APIServer{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, types.NamespacedName{Name: "cluster"}, dnsConfig); err != nil {
client.Get()/List() for configv1.APIServer which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.APIServer in every namespace.
Add &configv1.APIServer{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, types.NamespacedName{Name: "cluster"}, infraConfig); err != nil {
client.Get()/List() for configv1.DNS which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.DNS in every namespace.
Add &configv1.DNS{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, types.NamespacedName{Name: "cluster"}, ingressConfig); err != nil {
client.Get()/List() for configv1.Infrastructure which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.Infrastructure in every namespace.
Add &configv1.Infrastructure{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, types.NamespacedName{Name: "cluster"}, networkConfig); err != nil {
client.Get()/List() for configv1.Ingress which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.Ingress in every namespace.
Add &configv1.Ingress{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, types.NamespacedName{Name: "cluster"}, clusterProxyConfig); err != nil {
client.Get()/List() for configv1.Proxy which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.Proxy in every namespace.
Add &configv1.Proxy{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, types.NamespacedName{Name: "cluster"}, infraConfig); err != nil {
client.Get()/List() for configv1.Infrastructure which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.Infrastructure in every namespace.
Add &configv1.Infrastructure{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, name, configmap); err != nil {
client.Get()/List() for corev1.ConfigMap which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.ConfigMap in every namespace.
Add &corev1.ConfigMap{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.Get(ctx, request.NamespacedName, ingressController); err != nil {
client.Get()/List() for operatorv1.IngressController which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operatorv1.IngressController in every namespace.
Add &operatorv1.IngressController{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, operatorcontroller.IngressClusterOperatorName(), co); err != nil {
client.Get()/List() for configv1.ClusterOperator which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.ClusterOperator in every namespace.
Add &configv1.ClusterOperator{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, types.NamespacedName{Name: ingressNamespace}, ns); err != nil {
client.Get()/List() for corev1.Namespace which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Namespace in every namespace.
Add &corev1.Namespace{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.List(ctx, ingressList, client.InNamespace(r.config.Namespace)); err != nil {
client.Get()/List() for operatorv1.IngressControllerList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operatorv1.IngressControllerList in every namespace.
Add &operatorv1.IngressControllerList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.Get(ctx, subscriptionName, &subscription); err != nil {
client.Get()/List() for operatorsv1alpha1.Subscription which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operatorsv1alpha1.Subscription in every namespace.
Add &operatorsv1alpha1.Subscription{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.List(ctx, controllers, client.MatchingFields{"spec.httpErrorCodePages.name": configmapName}); err != nil {
client.Get()/List() for operatorv1.IngressControllerList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operatorv1.IngressControllerList in every namespace.
Add &operatorv1.IngressControllerList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, request.NamespacedName, ingress); err != nil {
client.Get()/List() for operatorv1.IngressController which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operatorv1.IngressController in every namespace.
Add &operatorv1.IngressController{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, controller.RouterDeploymentName(ingress), deployment); err != nil {
client.Get()/List() for appsv1.Deployment which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every appsv1.Deployment in every namespace.
Add &appsv1.Deployment{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.cache.List(ctx, controllers, client.InNamespace(r.config.OperatorNamespace)); err != nil {
client.Get()/List() for operatorv1.IngressControllerList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operatorv1.IngressControllerList in every namespace.
Add &operatorv1.IngressControllerList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
AP-10: No DefaultTransform to strip managedFields (4)
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
|
||||||
prometheus-operatorprometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook 003324 57 AP-7, AP-8, AP-9 3de9763f3612AP-7: Operator-created resources missing cache labels (10)
ObjectMeta without label: app
Resource created by the operator lacks the label (app) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"app": "true"} to the ObjectMeta.
ObjectMeta without label: app
Resource created by the operator lacks the label (app) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"app": "true"} to the ObjectMeta.
ObjectMeta without label: app
Resource created by the operator lacks the label (app) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"app": "true"} to the ObjectMeta.
ObjectMeta without label: app
Resource created by the operator lacks the label (app) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"app": "true"} to the ObjectMeta.
ObjectMeta without label: app
Resource created by the operator lacks the label (app) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"app": "true"} to the ObjectMeta.
ObjectMeta without label: app
Resource created by the operator lacks the label (app) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"app": "true"} to the ObjectMeta.
ObjectMeta without label: app
Resource created by the operator lacks the label (app) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"app": "true"} to the ObjectMeta.
ObjectMeta without label: app
Resource created by the operator lacks the label (app) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"app": "true"} to the ObjectMeta.
ObjectMeta without label: app
Resource created by the operator lacks the label (app) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"app": "true"} to the ObjectMeta.
ObjectMeta without label: app
Resource created by the operator lacks the label (app) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"app": "true"} to the ObjectMeta.
AP-9: Labels not propagated during resource updates (23)
rule, err = f.MonClientV1.PrometheusRules(ns).Update(ctx, ar, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["role"] = "true"
_, err = f.KubeClient.AdmissionregistrationV1().MutatingWebhookConfigurations().Update(ctx, hook, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["role"] = "true"
_, err = f.KubeClient.AdmissionregistrationV1().ValidatingWebhookConfigurations().Update(ctx, hook, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["role"] = "true"
_, err := f.KubeClient.CoreV1().ReplicationControllers(namespace).Update(ctx, &rC, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["role"] = "true"
scrapeConfig, err = f.MonClientV1alpha1.ScrapeConfigs(ns).Update(ctx, ar, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["role"] = "true"
_, err = f.KubeClient.CoreV1().Secrets(ns).Update(ctx, secret, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["role"] = "true"
return f.KubeClient.RbacV1().ClusterRoles().Update(ctx, cr, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["role"] = "true"
_, err := f.KubeClient.RbacV1().ClusterRoles().Update(ctx, clusterRole, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["role"] = "true"
_, err = f.APIServerClient.ApiextensionsV1().CustomResourceDefinitions().Update(ctx, crd, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["role"] = "true"
if _, err := f.KubeClient.CoreV1().Services(namespace).Update(ctx, service, metav1.UpdateOptions{}); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["role"] = "true"
_, err = f.KubeClient.RbacV1().ClusterRoleBindings().Update(ctx, clusterRoleBinding, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["role"] = "true"
_, err = f.KubeClient.CoreV1().ServiceAccounts(namespace).Update(ctx, serviceAccount, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["role"] = "true"
_, err = f.KubeClient.CoreV1().Namespaces().Update(ctx, ns, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["role"] = "true"
_, err := f.APIServerClient.ApiextensionsV1().CustomResourceDefinitions().Update(ctx, crd, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["role"] = "true"
return f.KubeClient.AppsV1().Deployments(deployment.Namespace).Update(ctx, deployment, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["role"] = "true"
_, err = f.KubeClient.AppsV1().Deployments(namespace).Update(ctx, deployment, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["role"] = "true"
d, err = f.KubeClient.AppsV1().Deployments(namespace).Update(ctx, d, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["role"] = "true"
ret, err = sclient.Update(ctx, svc, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["role"] = "true"
_, err = eclient.Update(ctx, eps, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["role"] = "true"
_, err = c.Update(ctx, eps, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["role"] = "true"
_, err = sstClient.Update(ctx, sset, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["role"] = "true"
_, err = dmsClient.Update(ctx, dset, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["role"] = "true"
_, err = secretClient.Update(ctx, desired, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (role), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["role"] = "true"
AP-8: No upgrade path for pre-existing unlabeled resources (24)
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
|
||||||
operator-framework-operator-controllerolm-catalogd, olm-operator-controller 317110 49 AP-1, AP-10, AP-3, AP-4, AP-5, AP-8 834ed2c3cd06AP-3: Invisible informer from client.Get() (31)
err := k8sClient.Get(ctx, client.ObjectKey{Name: name}, &catalog)
client.Get()/List() for olmv1.ClusterCatalog which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every olmv1.ClusterCatalog in every namespace.
Add &olmv1.ClusterCatalog{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := k8s.Get(ctx, key, cc); err != nil {
client.Get()/List() for olmv1.ClusterCatalog which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every olmv1.ClusterCatalog in every namespace.
Add &olmv1.ClusterCatalog{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := k8sClient.Get(ctx, client.ObjectKey{Name: name}, &ext)
client.Get()/List() for olmv1.ClusterExtension which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every olmv1.ClusterExtension in every namespace.
Add &olmv1.ClusterExtension{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := k8sClient.List(ctx, ceList); err == nil {
client.Get()/List() for olmv1.ClusterExtensionList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every olmv1.ClusterExtensionList in every namespace.
Add &olmv1.ClusterExtensionList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := k8sClient.Get(ctx, client.ObjectKey{Name: ce.Name}, &olmv1.ClusterExtension{})
client.Get()/List() for client.DeleteOptions which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every client.DeleteOptions in every namespace.
Add &client.DeleteOptions{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := k8sClient.Get(ctx, client.ObjectKey{Name: crdName}, crd); err == nil {
client.Get()/List() for apiextensionsv1.CustomResourceDefinition which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every apiextensionsv1.CustomResourceDefinition in every namespace.
Add &apiextensionsv1.CustomResourceDefinition{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := k8sClient.Get(ctx, client.ObjectKey{Name: name, Namespace: namespace}, b)
client.Get()/List() for buildv1.Build which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every buildv1.Build in every namespace.
Add &buildv1.Build{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := k8sClient.Get(ctx, client.ObjectKey{Name: name}, cc)
client.Get()/List() for olmv1.ClusterCatalog which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every olmv1.ClusterCatalog in every namespace.
Add &olmv1.ClusterCatalog{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := k8sClient.Get(ctx, client.ObjectKey{Name: catName}, catalog)
client.Get()/List() for olmv1.ClusterCatalog which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every olmv1.ClusterCatalog in every namespace.
Add &olmv1.ClusterCatalog{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := k8sClient.Get(ctx, client.ObjectKey{Name: name}, catalog)
client.Get()/List() for olmv1.ClusterCatalog which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every olmv1.ClusterCatalog in every namespace.
Add &olmv1.ClusterCatalog{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := k8sClient.Get(ctx, client.ObjectKey{Name: catalog}, cc)
client.Get()/List() for olmv1.ClusterCatalog which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every olmv1.ClusterCatalog in every namespace.
Add &olmv1.ClusterCatalog{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
g.Expect(k8sClient.Get(ctx, client.ObjectKeyFromObject(job), recheck)).NotTo(HaveOccurred())
client.Get()/List() for batchv1.Job which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every batchv1.Job in every namespace.
Add &batchv1.Job{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
return env.Get().K8sClient.Get(ctx, client.ObjectKey{Name: name}, ce)
client.Get()/List() for olmv1.ClusterExtension which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every olmv1.ClusterExtension in every namespace.
Add &olmv1.ClusterExtension{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := k8sClient.Get(ctx, client.ObjectKey{Name: "olm"}, obj)
client.Get()/List() for configv1.ClusterOperator which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.ClusterOperator in every namespace.
Add &configv1.ClusterOperator{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := k8sClient.Get(ctx, client.ObjectKey{Name: "cluster"}, olm)
client.Get()/List() for operatorv1.OLM which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operatorv1.OLM in every namespace.
Add &operatorv1.OLM{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := k8sClient.Get(ctx, client.ObjectKey{Name: ce.Name}, latest)
client.Get()/List() for olmv1.ClusterExtension which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every olmv1.ClusterExtension in every namespace.
Add &olmv1.ClusterExtension{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := k8sClient.List(ctx, deployments, client.InNamespace(installNamespace))
client.Get()/List() for appsv1.DeploymentList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every appsv1.DeploymentList in every namespace.
Add &appsv1.DeploymentList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := k8sClient.Get(ctx, client.ObjectKey{Name: ceName}, &ext)
client.Get()/List() for olmv1.ClusterExtension which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every olmv1.ClusterExtension in every namespace.
Add &olmv1.ClusterExtension{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := k8sClient.Get(ctx, client.ObjectKey{Name: ceName}, &ext)
client.Get()/List() for olmv1.ClusterExtension which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every olmv1.ClusterExtension in every namespace.
Add &olmv1.ClusterExtension{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := k8sClient.List(ctx, whList)
client.Get()/List() for admissionregistrationv1.ValidatingWebhookConfigurationList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every admissionregistrationv1.ValidatingWebhookConfigurationList in every namespace.
Add &admissionregistrationv1.ValidatingWebhookConfigurationList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := k8sClient.List(ctx, mwhList)
client.Get()/List() for admissionregistrationv1.MutatingWebhookConfigurationList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every admissionregistrationv1.MutatingWebhookConfigurationList in every namespace.
Add &admissionregistrationv1.MutatingWebhookConfigurationList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := k8sClient.Get(ctx, client.ObjectKey{Name: ceName}, tempCE)
client.Get()/List() for olmv1.ClusterExtension which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every olmv1.ClusterExtension in every namespace.
Add &olmv1.ClusterExtension{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := k8sClient.List(ctx, whList)
client.Get()/List() for admissionregistrationv1.ValidatingWebhookConfigurationList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every admissionregistrationv1.ValidatingWebhookConfigurationList in every namespace.
Add &admissionregistrationv1.ValidatingWebhookConfigurationList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := k8sClient.List(ctx, mwhList)
client.Get()/List() for admissionregistrationv1.MutatingWebhookConfigurationList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every admissionregistrationv1.MutatingWebhookConfigurationList in every namespace.
Add &admissionregistrationv1.MutatingWebhookConfigurationList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := k8sClient.List(ctx, whList); err == nil {
client.Get()/List() for admissionregistrationv1.ValidatingWebhookConfigurationList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every admissionregistrationv1.ValidatingWebhookConfigurationList in every namespace.
Add &admissionregistrationv1.ValidatingWebhookConfigurationList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := k8sClient.List(ctx, mwhList); err == nil {
client.Get()/List() for admissionregistrationv1.MutatingWebhookConfigurationList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every admissionregistrationv1.MutatingWebhookConfigurationList in every namespace.
Add &admissionregistrationv1.MutatingWebhookConfigurationList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := k8sClient.List(ctx, whList)
client.Get()/List() for admissionregistrationv1.ValidatingWebhookConfigurationList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every admissionregistrationv1.ValidatingWebhookConfigurationList in every namespace.
Add &admissionregistrationv1.ValidatingWebhookConfigurationList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err = k8sClient.List(ctx, mwhList)
client.Get()/List() for admissionregistrationv1.MutatingWebhookConfigurationList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every admissionregistrationv1.MutatingWebhookConfigurationList in every namespace.
Add &admissionregistrationv1.MutatingWebhookConfigurationList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := k8sClient.Get(ctx, client.ObjectKey{Name: webhookOperatorInstallNamespace}, tempNs)
client.Get()/List() for corev1.Namespace which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Namespace in every namespace.
Add &corev1.Namespace{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := k8sClient.Get(ctx, client.ObjectKey{Name: ce.Name}, tempCE)
client.Get()/List() for olmv1.ClusterExtension which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every olmv1.ClusterExtension in every namespace.
Add &olmv1.ClusterExtension{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := k8sClient.Get(ctx, client.ObjectKey{Name: serviceName, Namespace: webhookOperatorInstallNamespace}, svc)
client.Get()/List() for corev1.Service which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Service in every namespace.
Add &corev1.Service{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
AP-1: Predicate filters don't limit cache (1)
builder.WithPredicates(predicate.Funcs{
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
AP-4: No DefaultNamespaces — everything is cluster-wide (1)
cache.Options without DefaultNamespaces
No DefaultNamespaces set in cache configuration. Every informer watches ALL namespaces by default, even if the operator only manages resources in a few namespaces.
For single-namespace operators, set DefaultNamespaces: map[string]cache.Config{"my-ns": {}}. For multi-namespace, use label selectors in ByObject.
AP-5: Typed/unstructured cache trap (5)
obj := unstructured.Unstructured{}
Unstructured object usage found in a file that also registers typed watches. controller-runtime maintains 3 separate caches (typed, unstructured, metadata) — mismatched representations cause duplicate caches or wasted memory.
Use WatchesMetadata() if you only need triggers. Otherwise ensure watch and read use the same object representation.
unstr.SetGroupVersionKind(gvk)
Unstructured object usage found in a file that also registers typed watches. controller-runtime maintains 3 separate caches (typed, unstructured, metadata) — mismatched representations cause duplicate caches or wasted memory.
Use WatchesMetadata() if you only need triggers. Otherwise ensure watch and read use the same object representation.
obj.GetObjectKind().SetGroupVersionKind(gvk)
Unstructured object usage found in a file that also registers typed watches. controller-runtime maintains 3 separate caches (typed, unstructured, metadata) — mismatched representations cause duplicate caches or wasted memory.
Use WatchesMetadata() if you only need triggers. Otherwise ensure watch and read use the same object representation.
obj := unstructured.Unstructured{}
Unstructured object usage found in a file that also registers typed watches. controller-runtime maintains 3 separate caches (typed, unstructured, metadata) — mismatched representations cause duplicate caches or wasted memory.
Use WatchesMetadata() if you only need triggers. Otherwise ensure watch and read use the same object representation.
clusterExtensions.SetGroupVersionKind(ocv1.GroupVersion.WithKind("ClusterExtensionList"))
Unstructured object usage found in a file that also registers typed watches. controller-runtime maintains 3 separate caches (typed, unstructured, metadata) — mismatched representations cause duplicate caches or wasted memory.
Use WatchesMetadata() if you only need triggers. Otherwise ensure watch and read use the same object representation.
AP-10: No DefaultTransform to strip managedFields (1)
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
AP-8: No upgrade path for pre-existing unlabeled resources (10)
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
|
||||||
cluster-network-operatorcluster-network-operator 29100 30 AP-3, AP-4 b5955e9ede21AP-3: Invisible informer from client.Get() (29)
err := cli.CRClient().Get(ctx, types.NamespacedName{Name: name, Namespace: namespace}, ret)
client.Get()/List() for unstructured.Unstructured which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every unstructured.Unstructured in every namespace.
Add &unstructured.Unstructured{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := client.CRClient().Get(ctx, types.NamespacedName{Name: name, Namespace: namespace}, current)
client.Get()/List() for uns.Unstructured which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every uns.Unstructured in every namespace.
Add &uns.Unstructured{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
instance, err := c.client.Get(ctx, names.CLUSTER_CONFIG, metav1.GetOptions{})
client.Get()/List() for v1.NetworkSpecApplyConfiguration which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every v1.NetworkSpecApplyConfiguration in every namespace.
Add &v1.NetworkSpecApplyConfiguration{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := client.Default().CRClient().Get(ctx, namespacedName, configMap)
client.Get()/List() for corev1.ConfigMap which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.ConfigMap in every namespace.
Add &corev1.ConfigMap{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := r.client.Default().CRClient().Get(ctx, request.NamespacedName, clusterConfig)
client.Get()/List() for configv1.Network which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.Network in every namespace.
Add &configv1.Network{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err = r.client.Default().CRClient().Get(ctx, types.NamespacedName{Name: names.OPERATOR_CONFIG}, currentOperConfig)
client.Get()/List() for operv1.Network which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operv1.Network in every namespace.
Add &operv1.Network{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := r.client.Default().CRClient().Get(ctx, types.NamespacedName{Name: names.CLUSTER_CONFIG}, operConfig)
client.Get()/List() for operv1.Network which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operv1.Network in every namespace.
Add &operv1.Network{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := r.mgr.GetClient().Get(ctx, request.NamespacedName, obj)
client.Get()/List() for netopv1.EgressRouter which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every netopv1.EgressRouter in every namespace.
Add &netopv1.EgressRouter{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := r.client.Default().CRClient().Get(ctx, request.NamespacedName, infraConfig)
client.Get()/List() for configv1.Infrastructure which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.Infrastructure in every namespace.
Add &configv1.Infrastructure{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := r.client.Get(ctx, request.NamespacedName, ingressControllerConfig)
client.Get()/List() for operv1.IngressController which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operv1.IngressController in every namespace.
Add &operv1.IngressController{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err = r.client.Get(ctx, types.NamespacedName{Name: targetNamespace}, namespace)
client.Get()/List() for corev1.Namespace which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Namespace in every namespace.
Add &corev1.Namespace{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := r.client.Default().CRClient().Get(ctx, types.NamespacedName{
client.Get()/List() for configv1.Network which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.Network in every namespace.
Add &configv1.Network{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Default().CRClient().List(ctx, dsList, &client.ListOptions{Namespace: ns}); err != nil {
client.Get()/List() for appsv1.DaemonSetList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every appsv1.DaemonSetList in every namespace.
Add &appsv1.DaemonSetList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Default().CRClient().List(ctx, dsList, &client.ListOptions{Namespace: ns}); err != nil {
client.Get()/List() for appsv1.DaemonSetList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every appsv1.DaemonSetList in every namespace.
Add &appsv1.DaemonSetList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Default().CRClient().List(ctx, nodeList, &client.ListOptions{}); err != nil {
client.Get()/List() for corev1.NodeList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.NodeList in every namespace.
Add &corev1.NodeList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err = r.client.Default().CRClient().List(ctx, pools); err != nil {
client.Get()/List() for metav1.Condition which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every metav1.Condition in every namespace.
Add &metav1.Condition{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := r.client.Default().CRClient().Get(ctx, request.NamespacedName, operConfig)
client.Get()/List() for operv1.Network which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operv1.Network in every namespace.
Add &operv1.Network{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err = r.client.Default().CRClient().Get(ctx, types.NamespacedName{Name: names.CLUSTER_CONFIG}, clusterConfig)
client.Get()/List() for configv1.Network which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.Network in every namespace.
Add &configv1.Network{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := client.Get(ctx, types.NamespacedName{Namespace: names.APPLIED_NAMESPACE, Name: names.APPLIED_PREFIX + name}, cm)
client.Get()/List() for corev1.ConfigMap which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.ConfigMap in every namespace.
Add &corev1.ConfigMap{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := r.mgr.GetClient().Get(ctx, request.NamespacedName, obj)
client.Get()/List() for netopv1.OperatorPKI which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every netopv1.OperatorPKI in every namespace.
Add &netopv1.OperatorPKI{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, request.NamespacedName, proxyConfig); err != nil {
client.Get()/List() for configv1.Infrastructure which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.Infrastructure in every namespace.
Add &configv1.Infrastructure{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, names.Proxy(), proxyConfig); err != nil {
client.Get()/List() for configv1.Proxy which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.Proxy in every namespace.
Add &configv1.Proxy{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err = r.client.Default().CRClient().Get(ctx, types.NamespacedName{Namespace: "openshift-ovn-kubernetes", Name: "signer-ca"}, caSecret)
client.Get()/List() for corev1.Secret which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Secret in every namespace.
Add &corev1.Secret{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := r.client.Default().CRClient().Get(ctx, request.NamespacedName, csr)
client.Get()/List() for csrv1.CertificateSigningRequest which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every csrv1.CertificateSigningRequest in every namespace.
Add &csrv1.CertificateSigningRequest{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err = status.client.ClientFor("").CRClient().List(ctx, mcPools)
client.Get()/List() for mcfgv1.MachineConfigPoolList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every mcfgv1.MachineConfigPoolList in every namespace.
Add &mcfgv1.MachineConfigPoolList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := m.cache.List(ctx, mcPools)
client.Get()/List() for mcfgv1.MachineConfigPoolList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every mcfgv1.MachineConfigPoolList in every namespace.
Add &mcfgv1.MachineConfigPoolList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := p.cache.List(ctx, mcPools)
client.Get()/List() for mcfgv1.MachineConfigPoolList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every mcfgv1.MachineConfigPoolList in every namespace.
Add &mcfgv1.MachineConfigPoolList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := client.Default().CRClient().List(ctx, mcpList); err != nil {
client.Get()/List() for mcfgv1.MachineConfigPoolList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every mcfgv1.MachineConfigPoolList in every namespace.
Add &mcfgv1.MachineConfigPoolList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := client.Default().CRClient().Get(ctx, types.NamespacedName{Namespace: MTU_CM_NAMESPACE, Name: MTU_CM_NAME}, cm)
client.Get()/List() for corev1.ConfigMap which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.ConfigMap in every namespace.
Add &corev1.ConfigMap{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
AP-4: No DefaultNamespaces — everything is cluster-wide (1)
cache.Options without DefaultNamespaces
No DefaultNamespaces set in cache configuration. Every informer watches ALL namespaces by default, even if the operator only manages resources in a few namespaces.
For single-namespace operators, set DefaultNamespaces: map[string]cache.Config{"my-ns": {}}. For multi-namespace, use label selectors in ByObject.
|
||||||
machine-api-operatormachine-api-operator 16080 24 AP-10, AP-3, AP-7, AP-9 88f39dc939ccAP-3: Invisible informer from client.Get() (16)
if err := r.Client.Get(ctx, request.NamespacedName, m); err != nil {
client.Get()/List() for machinev1.Machine which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every machinev1.Machine in every namespace.
Add &machinev1.Machine{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.Client.Get(ctx, client.ObjectKey{Name: name}, &node); err != nil {
client.Get()/List() for corev1.Node which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Node in every namespace.
Add &corev1.Node{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := d.Client.List(ctx, nodes); err != nil {
client.Get()/List() for corev1.NodeList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.NodeList in every namespace.
Add &corev1.NodeList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := d.Client.Get(ctx, request.NamespacedName, m); err != nil {
client.Get()/List() for machinev1.Machine which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every machinev1.Machine in every namespace.
Add &machinev1.Machine{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
return external.Get(ctx, r.client, remediationRef, m.Namespace)
client.Get()/List() for corev1.ObjectReference which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.ObjectReference in every namespace.
Add &corev1.ObjectReference{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, namespacedName(o), node); err != nil {
client.Get()/List() for corev1.Node which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Node in every namespace.
Add &corev1.Node{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.List(ctx, mhcList); err != nil {
client.Get()/List() for machinev1.MachineHealthCheckList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every machinev1.MachineHealthCheckList in every namespace.
Add &machinev1.MachineHealthCheckList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx,
client.Get()/List() for machinev1.Machine which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every machinev1.Machine in every namespace.
Add &machinev1.Machine{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.List(ctx, mhcList); err != nil {
client.Get()/List() for machinev1.MachineHealthCheckList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every machinev1.MachineHealthCheckList in every namespace.
Add &machinev1.MachineHealthCheckList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := r.Client.Get(ctx, key, m)
client.Get()/List() for machinev1.Machine which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every machinev1.Machine in every namespace.
Add &machinev1.Machine{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.apiReader.Get(ctx, apimachinerytypes.NamespacedName{Name: nodeName}, node); err != nil {
client.Get()/List() for corev1.Node which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Node in every namespace.
Add &corev1.Node{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := apiReader.List(ctx, allPods, &runtimeclient.ListOptions{
client.Get()/List() for corev1.PodList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.PodList in every namespace.
Add &corev1.PodList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := runtimeClient.Get(ctx, claimKey, ipAddressClaim); err != nil {
client.Get()/List() for ipamv1beta1.IPAddressClaim which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every ipamv1beta1.IPAddressClaim in every namespace.
Add &ipamv1beta1.IPAddressClaim{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := runtimeClient.Get(ctx, addressKey, ipAddress); err != nil {
client.Get()/List() for ipamv1beta1.IPAddress which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every ipamv1beta1.IPAddress in every namespace.
Add &ipamv1beta1.IPAddress{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := runtimeClient.List(ctx, ipAddressClaimList, client.InNamespace(machine.Namespace)); err != nil {
client.Get()/List() for ipamv1beta1.IPAddressClaimList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every ipamv1beta1.IPAddressClaimList in every namespace.
Add &ipamv1beta1.IPAddressClaimList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := runtimeClient.Get(ctx, claimKey, ipAddressClaim); err == nil {
client.Get()/List() for ipamv1beta1.IPAddressClaim which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every ipamv1beta1.IPAddressClaim in every namespace.
Add &ipamv1beta1.IPAddressClaim{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
AP-10: No DefaultTransform to strip managedFields (2)
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
AP-7: Operator-created resources missing cache labels (1)
ObjectMeta without label: api
Resource created by the operator lacks the label (api) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"api": "true"} to the ObjectMeta.
AP-9: Labels not propagated during resource updates (5)
if err := r.Client.Update(ctx, m); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (api), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["api"] = "true"
if err := r.Client.Update(ctx, m); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (api), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["api"] = "true"
if err := r.actuator.Update(ctx, m); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (api), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["api"] = "true"
if err := runtimeClient.Update(ctx, ipAddressClaim); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (api), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["api"] = "true"
if err := runtimeClient.Update(ctx, &ipAddressClaim); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (api), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["api"] = "true"
|
||||||
operator-framework-olmoperator-framework-tools, operator-lifecycle-manager, operator-registry 47112 24 AP-1, AP-10, AP-3, AP-4, AP-5, AP-7, AP-8, AP-9 149d553b2057AP-3: Invisible informer from client.Get() (4)
if err := r.Get(ctx, types.NamespacedName{Name: provided.Name}, crd); err != nil {
client.Get()/List() for metav1.PartialObjectMetadata which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every metav1.PartialObjectMetadata in every namespace.
Add &metav1.PartialObjectMetadata{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := c.kubeClient.Get(ctx, key, catalogSource)
client.Get()/List() for operatorsv1alpha1.CatalogSource which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operatorsv1alpha1.CatalogSource in every namespace.
Add &operatorsv1alpha1.CatalogSource{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := c.kubeClient.Get(ctx, k8scontrollerclient.ObjectKey{
client.Get()/List() for corev1.Pod which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Pod in every namespace.
Add &corev1.Pod{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := c.Get(ctx, ogNN, og); err != nil {
client.Get()/List() for operatorsv1.OperatorGroup which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operatorsv1.OperatorGroup in every namespace.
Add &operatorsv1.OperatorGroup{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
AP-1: Predicate filters don't limit cache (2)
For(&operatorsv1alpha1.ClusterServiceVersion{}, builder.WithPredicates(p)).
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
return bldr.Watches(&operatorsv1alpha1.ClusterServiceVersion{}, enqueue, builder.WithPredicates(originalCSV))
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
AP-4: No DefaultNamespaces — everything is cluster-wide (1)
cache.Options without DefaultNamespaces
No DefaultNamespaces set in cache configuration. Every informer watches ALL namespaces by default, even if the operator only manages resources in a few namespaces.
For single-namespace operators, set DefaultNamespaces: map[string]cache.Config{"my-ns": {}}. For multi-namespace, use label selectors in ByObject.
AP-5: Typed/unstructured cache trap (4)
unstObjs := []*unstructured.Unstructured{}
Unstructured object usage found in a file that also registers typed watches. controller-runtime maintains 3 separate caches (typed, unstructured, metadata) — mismatched representations cause duplicate caches or wasted memory.
Use WatchesMetadata() if you only need triggers. Otherwise ensure watch and read use the same object representation.
unst := &unstructured.Unstructured{}
Unstructured object usage found in a file that also registers typed watches. controller-runtime maintains 3 separate caches (typed, unstructured, metadata) — mismatched representations cause duplicate caches or wasted memory.
Use WatchesMetadata() if you only need triggers. Otherwise ensure watch and read use the same object representation.
unstructuredCSV := unstructured.Unstructured{}
Unstructured object usage found in a file that also registers typed watches. controller-runtime maintains 3 separate caches (typed, unstructured, metadata) — mismatched representations cause duplicate caches or wasted memory.
Use WatchesMetadata() if you only need triggers. Otherwise ensure watch and read use the same object representation.
crd.SetGroupVersionKind(apiextensionsv1.SchemeGroupVersion.WithKind("CustomResourceDefinition"))
Unstructured object usage found in a file that also registers typed watches. controller-runtime maintains 3 separate caches (typed, unstructured, metadata) — mismatched representations cause duplicate caches or wasted memory.
Use WatchesMetadata() if you only need triggers. Otherwise ensure watch and read use the same object representation.
AP-10: No DefaultTransform to strip managedFields (2)
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
AP-7: Operator-created resources missing cache labels (4)
ObjectMeta without label: app
Resource created by the operator lacks the label (app) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"app": "true"} to the ObjectMeta.
ObjectMeta without label: app
Resource created by the operator lacks the label (app) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"app": "true"} to the ObjectMeta.
ObjectMeta without label: app
Resource created by the operator lacks the label (app) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"app": "true"} to the ObjectMeta.
ObjectMeta without label: app
Resource created by the operator lacks the label (app) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"app": "true"} to the ObjectMeta.
AP-9: Labels not propagated during resource updates (5)
return client.Update(ctx, secret)
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["app"] = "true"
return c.Update(ctx, og)
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["app"] = "true"
if _, err := op.opClient.KubernetesInterface().CoreV1().Services(service.Namespace).Update(ctx, localCopy, metav1.UpdateOptions{}); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["app"] = "true"
if err := r.Status().Update(ctx, operator.Operator); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["app"] = "true"
_, err = r.Images().Update(ctx, img)
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["app"] = "true"
AP-8: No upgrade path for pre-existing unlabeled resources (2)
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
|
||||||
cluster-cloud-controller-manager-operatorcluster-cloud-controller-manager-operator 11720 20 AP-1, AP-10, AP-3 6148c0cca626AP-3: Invisible informer from client.Get() (11)
if err := r.Get(ctx, client.ObjectKey{Name: "cluster"}, network); err != nil {
client.Get()/List() for configv1.Network which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.Network in every namespace.
Add &configv1.Network{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.Get(ctx, client.ObjectKey{Name: proxyResourceName}, clusterProxy); err != nil && !errors.IsNotFound(err) {
client.Get()/List() for configv1.Proxy which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.Proxy in every namespace.
Add &configv1.Proxy{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := client.Get(ctx, coreclientv1.ObjectKeyFromObject(required), existing)
client.Get()/List() for appsv1.Deployment which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every appsv1.Deployment in every namespace.
Add &appsv1.Deployment{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := client.Get(ctx, coreclientv1.ObjectKeyFromObject(required), existing)
client.Get()/List() for appsv1.DaemonSet which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every appsv1.DaemonSet in every namespace.
Add &appsv1.DaemonSet{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := client.Get(ctx, coreclientv1.ObjectKeyFromObject(required), existing)
client.Get()/List() for policyv1.PodDisruptionBudget which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every policyv1.PodDisruptionBudget in every namespace.
Add &policyv1.PodDisruptionBudget{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := client.Get(ctx, coreclientv1.ObjectKeyFromObject(required), existing)
client.Get()/List() for rbacv1.ClusterRole which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every rbacv1.ClusterRole in every namespace.
Add &rbacv1.ClusterRole{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := client.Get(ctx, coreclientv1.ObjectKeyFromObject(required), existing)
client.Get()/List() for rbacv1.ClusterRoleBinding which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every rbacv1.ClusterRoleBinding in every namespace.
Add &rbacv1.ClusterRoleBinding{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := client.Get(ctx, coreclientv1.ObjectKeyFromObject(requiredOriginal), existing)
client.Get()/List() for admissionregistrationv1.ValidatingAdmissionPolicy which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every admissionregistrationv1.ValidatingAdmissionPolicy in every namespace.
Add &admissionregistrationv1.ValidatingAdmissionPolicy{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := client.Get(ctx, coreclientv1.ObjectKeyFromObject(requiredOriginal), existing)
client.Get()/List() for admissionregistrationv1.ValidatingAdmissionPolicyBinding which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every admissionregistrationv1.ValidatingAdmissionPolicyBinding in every namespace.
Add &admissionregistrationv1.ValidatingAdmissionPolicyBinding{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := client.Get(ctx, coreclientv1.ObjectKeyFromObject(requiredOriginal), existing)
client.Get()/List() for corev1.Service which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Service in every namespace.
Add &corev1.Service{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.Get(ctx, types.NamespacedName{Name: proxyResourceName}, proxyConfig); err != nil {
client.Get()/List() for configv1.Proxy which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.Proxy in every namespace.
Add &configv1.Proxy{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
AP-1: Predicate filters don't limit cache (7)
builder.WithPredicates(
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(infrastructurePredicates()),
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
For(&configv1.ClusterOperator{}, builder.WithPredicates(clusterOperatorPredicates())).
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(infrastructurePredicates())).
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(featureGatePredicates())).
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(kcmPredicates())).
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
AP-10: No DefaultTransform to strip managedFields (2)
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
|
||||||
cluster-control-plane-machine-set-operatorcluster-control-plane-machine-set-operator 7715 20 AP-1, AP-10, AP-3, AP-5, AP-8 2dde33fb94aaAP-3: Invisible informer from client.Get() (7)
if err := r.Get(ctx, client.ObjectKey{Name: r.OperatorName}, co); err != nil {
client.Get()/List() for configv1.ClusterOperator which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.ClusterOperator in every namespace.
Add &configv1.ClusterOperator{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.List(ctx, machinesMeta, &client.ListOptions{LabelSelector: selector}); err != nil {
client.Get()/List() for metav1.PartialObjectMetadataList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every metav1.PartialObjectMetadataList in every namespace.
Add &metav1.PartialObjectMetadataList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.List(ctx, nodesList, &client.ListOptions{
client.Get()/List() for corev1.NodeList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.NodeList in every namespace.
Add &corev1.NodeList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := m.client.Get(ctx, types.NamespacedName{Name: nodeName}, node); err != nil {
client.Get()/List() for corev1.Node which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Node in every namespace.
Add &corev1.Node{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := cl.Get(ctx, client.ObjectKey{Name: InfrastructureName}, infrastructure); err != nil {
client.Get()/List() for configv1.Infrastructure which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.Infrastructure in every namespace.
Add &configv1.Infrastructure{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := k8sClient.Get(ctx, types.NamespacedName{Name: "cluster"}, featureGate); err != nil {
client.Get()/List() for configv1.FeatureGate which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.FeatureGate in every namespace.
Add &configv1.FeatureGate{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := k8sClient.Get(ctx, types.NamespacedName{Name: "version"}, clusterVersion); err != nil {
client.Get()/List() for configv1.ClusterVersion which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.ClusterVersion in every namespace.
Add &configv1.ClusterVersion{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
AP-1: Predicate filters don't limit cache (6)
For(&machinev1.ControlPlaneMachineSet{}, builder.WithPredicates(util.FilterControlPlaneMachineSet(clusterControlPlaneMachineSetName, r.Namespace))).
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(util.FilterControlPlaneMachines(r.Namespace)),
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(util.FilterControlPlaneNodes()),
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(util.FilterClusterOperator(r.OperatorName)),
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
builder.WithPredicates(util.FilterInfrastructure(infrastructureName)),
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
For(&machinev1.ControlPlaneMachineSet{}, builder.WithPredicates(util.FilterControlPlaneMachineSet(clusterControlPlaneMachineSetName, r.Namespace))).
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
AP-5: Typed/unstructured cache trap (1)
machine.SetGroupVersionKind(machineGVK)
Unstructured object usage found in a file that also registers typed watches. controller-runtime maintains 3 separate caches (typed, unstructured, metadata) — mismatched representations cause duplicate caches or wasted memory.
Use WatchesMetadata() if you only need triggers. Otherwise ensure watch and read use the same object representation.
AP-10: No DefaultTransform to strip managedFields (1)
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
AP-8: No upgrade path for pre-existing unlabeled resources (5)
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
|
||||||
cloud-credential-operatorcloud-credential-operator 8223 15 AP-10, AP-3, AP-4, AP-8 154ae10f442bAP-3: Invisible informer from client.Get() (8)
err := mgr.GetClient().List(ctx, crs)
client.Get()/List() for minterv1.CredentialsRequestList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every minterv1.CredentialsRequestList in every namespace.
Add &minterv1.CredentialsRequestList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := mgr.GetClient().List(ctx, crs)
client.Get()/List() for minterv1.CredentialsRequestList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every minterv1.CredentialsRequestList in every namespace.
Add &minterv1.CredentialsRequestList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
mgr.GetClient().List(ctx, crs)
client.Get()/List() for minterv1.CredentialsRequestList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every minterv1.CredentialsRequestList in every namespace.
Add &minterv1.CredentialsRequestList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := mgr.GetClient().List(ctx, crs)
client.Get()/List() for minterv1.CredentialsRequestList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every minterv1.CredentialsRequestList in every namespace.
Add &minterv1.CredentialsRequestList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := mgr.GetClient().List(ctx, crs)
client.Get()/List() for minterv1.CredentialsRequestList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every minterv1.CredentialsRequestList in every namespace.
Add &minterv1.CredentialsRequestList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err = r.Get(ctx, request.NamespacedName, cr)
client.Get()/List() for minterv1.CredentialsRequest which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every minterv1.CredentialsRequest in every namespace.
Add &minterv1.CredentialsRequest{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err = r.Get(ctx, types.NamespacedName{Name: cr.Spec.SecretRef.Namespace}, targetNS)
client.Get()/List() for corev1.Namespace which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Namespace in every namespace.
Add &corev1.Namespace{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := c.Get(ctx, types.NamespacedName{Name: "cluster"}, auth); err != nil {
client.Get()/List() for configv1.Authentication which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.Authentication in every namespace.
Add &configv1.Authentication{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
AP-4: No DefaultNamespaces — everything is cluster-wide (2)
cache.Options without DefaultNamespaces
No DefaultNamespaces set in cache configuration. Every informer watches ALL namespaces by default, even if the operator only manages resources in a few namespaces.
For single-namespace operators, set DefaultNamespaces: map[string]cache.Config{"my-ns": {}}. For multi-namespace, use label selectors in ByObject.
cache.Options without DefaultNamespaces
No DefaultNamespaces set in cache configuration. Every informer watches ALL namespaces by default, even if the operator only manages resources in a few namespaces.
For single-namespace operators, set DefaultNamespaces: map[string]cache.Config{"my-ns": {}}. For multi-namespace, use label selectors in ByObject.
AP-10: No DefaultTransform to strip managedFields (2)
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
AP-8: No upgrade path for pre-existing unlabeled resources (3)
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
|
||||||
baremetal-operatorbaremetal-operator 5216 14 AP-1, AP-10, AP-3, AP-5, AP-8 0aeba7af56b8AP-3: Invisible informer from client.Get() (5)
err = r.Get(ctx, hardwareDataKey, hardwareData)
client.Get()/List() for metal3api.HardwareData which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every metal3api.HardwareData in every namespace.
Add &metal3api.HardwareData{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := r.Client.Get(ctx, hardwareDataKey, hardwareData)
client.Get()/List() for metal3api.HardwareData which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every metal3api.HardwareData in every namespace.
Add &metal3api.HardwareData{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
return k8serrors.IsNotFound(input.Getter.Get(ctx, key, namespace))
client.Get()/List() for corev1.Namespace which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.Namespace in every namespace.
Add &corev1.Namespace{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
Expect(cli.List(ctx, crs)).To(Succeed())
client.Get()/List() for unstructured.UnstructuredList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every unstructured.UnstructuredList in every namespace.
Add &unstructured.UnstructuredList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := input.Client.Get(ctx, client.ObjectKey{
client.Get()/List() for irsov1alpha1.Ironic which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every irsov1alpha1.Ironic in every namespace.
Add &irsov1alpha1.Ironic{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
AP-1: Predicate filters don't limit cache (1)
WithEventFilter(predicate.Funcs{
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
AP-5: Typed/unstructured cache trap (1)
crs.SetGroupVersionKind(*crGVK)
Unstructured object usage found in a file that also registers typed watches. controller-runtime maintains 3 separate caches (typed, unstructured, metadata) — mismatched representations cause duplicate caches or wasted memory.
Use WatchesMetadata() if you only need triggers. Otherwise ensure watch and read use the same object representation.
AP-10: No DefaultTransform to strip managedFields (1)
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
AP-8: No upgrade path for pre-existing unlabeled resources (6)
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
|
||||||
cluster-monitoring-operatorcluster-monitoring-operator 00120 12 AP-7, AP-9 fee1f8a0fa38AP-7: Operator-created resources missing cache labels (3)
ObjectMeta without label: app
Resource created by the operator lacks the label (app) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"app": "true"} to the ObjectMeta.
ObjectMeta without label: app
Resource created by the operator lacks the label (app) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"app": "true"} to the ObjectMeta.
ObjectMeta without label: app
Resource created by the operator lacks the label (app) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"app": "true"} to the ObjectMeta.
AP-9: Labels not propagated during resource updates (9)
_, err = arcClient.Update(ctx, required, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["app"] = "true"
_, err = rclient.Update(ctx, required, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["app"] = "true"
_, err = pclient.Update(ctx, required, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["app"] = "true"
_, err = pclient.Update(ctx, required, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["app"] = "true"
_, err = aclient.Update(ctx, required, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["app"] = "true"
_, err = trclient.Update(ctx, required, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["app"] = "true"
_, err = smClient.Update(ctx, required, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["app"] = "true"
_, err = conClient.Update(ctx, required, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["app"] = "true"
_, err = client.Update(ctx, required, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["app"] = "true"
|
||||||
cluster-authentication-operatorcluster-authentication-operator 0074 11 AP-7, AP-8, AP-9 65eb4b2193d0AP-7: Operator-created resources missing cache labels (4)
ObjectMeta without label: node-role.kubernetes.io/worker
Resource created by the operator lacks the label (node-role.kubernetes.io/worker) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"node-role.kubernetes.io/worker": "true"} to the ObjectMeta.
ObjectMeta without label: node-role.kubernetes.io/worker
Resource created by the operator lacks the label (node-role.kubernetes.io/worker) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"node-role.kubernetes.io/worker": "true"} to the ObjectMeta.
ObjectMeta without label: node-role.kubernetes.io/worker
Resource created by the operator lacks the label (node-role.kubernetes.io/worker) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"node-role.kubernetes.io/worker": "true"} to the ObjectMeta.
ObjectMeta without label: node-role.kubernetes.io/worker
Resource created by the operator lacks the label (node-role.kubernetes.io/worker) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"node-role.kubernetes.io/worker": "true"} to the ObjectMeta.
AP-9: Labels not propagated during resource updates (3)
_, err := c.authentication.Update(ctx, authConfigCopy, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (node-role.kubernetes.io/worker), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["node-role.kubernetes.io/worker"] = "true"
_, err = c.oauthClientClient.Update(ctx, existingCopy, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (node-role.kubernetes.io/worker), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["node-role.kubernetes.io/worker"] = "true"
_, err = c.routeClient.Update(ctx, existingCopy, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (node-role.kubernetes.io/worker), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["node-role.kubernetes.io/worker"] = "true"
AP-8: No upgrade path for pre-existing unlabeled resources (4)
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
|
||||||
azure-service-operatorazure-service-operator 4330 10 AP-1, AP-10, AP-3, AP-5 5e84c83176d7AP-3: Invisible informer from client.Get() (4)
if err := a.client.List(ctx, &bindings, client.InNamespace(a.namespace)); err != nil {
client.Get()/List() for aadpodv1.AzureIdentityBindingList which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every aadpodv1.AzureIdentityBindingList in every namespace.
Add &aadpodv1.AzureIdentityBindingList{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := a.client.Get(ctx, key, &identity); err != nil {
client.Get()/List() for aadpodv1.AzureIdentity which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every aadpodv1.AzureIdentity in every namespace.
Add &aadpodv1.AzureIdentity{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
resp, err = interfacesClient.Get(ctx, nicID.ResourceGroupName, nicID.Name, nil)
client.Get()/List() for armnetwork.InterfacesClientGetResponse which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every armnetwork.InterfacesClientGetResponse in every namespace.
Add &armnetwork.InterfacesClientGetResponse{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
err := r.client.Get(ctx, refNamespacedName, configMap)
client.Get()/List() for v1.ConfigMap which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every v1.ConfigMap in every namespace.
Add &v1.ConfigMap{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
AP-1: Predicate filters don't limit cache (1)
For(info.Obj, ctrlbuilder.WithPredicates(info.Predicate)).
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
AP-5: Typed/unstructured cache trap (2)
clientObj.GetObjectKind().SetGroupVersionKind(gvk)
Unstructured object usage found in a file that also registers typed watches. controller-runtime maintains 3 separate caches (typed, unstructured, metadata) — mismatched representations cause duplicate caches or wasted memory.
Use WatchesMetadata() if you only need triggers. Otherwise ensure watch and read use the same object representation.
obj.GetObjectKind().SetGroupVersionKind(gvk)
Unstructured object usage found in a file that also registers typed watches. controller-runtime maintains 3 separate caches (typed, unstructured, metadata) — mismatched representations cause duplicate caches or wasted memory.
Use WatchesMetadata() if you only need triggers. Otherwise ensure watch and read use the same object representation.
AP-10: No DefaultTransform to strip managedFields (3)
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
|
||||||
cluster-etcd-operatorcluster-etcd-operator 0054 9 AP-8, AP-9 90faa26eef6bAP-9: Labels not propagated during resource updates (5)
_, err := cronJobClient.Update(ctx, cronJob, v1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["app"] = "true"
if _, err := c.machineClient.Update(ctx, machinePendingDeletionCopy, metav1.UpdateOptions{}); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["app"] = "true"
if _, err := c.machineClient.Update(ctx, masterMachineCopy, metav1.UpdateOptions{}); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["app"] = "true"
_, err := c.secretClient.Secrets(operatorclient.TargetNamespace).Update(ctx, secretToUntag, v1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["app"] = "true"
_, err := c.secretClient.Secrets(operatorclient.TargetNamespace).Update(ctx, secretToTag, v1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["app"] = "true"
AP-8: No upgrade path for pre-existing unlabeled resources (4)
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
|
||||||
console-operatorconsole-operator 0080 8 AP-7, AP-9 aee1a79b48a8AP-7: Operator-created resources missing cache labels (3)
ObjectMeta without label: name
Resource created by the operator lacks the label (name) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"name": "true"} to the ObjectMeta.
ObjectMeta without label: name
Resource created by the operator lacks the label (name) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"name": "true"} to the ObjectMeta.
ObjectMeta without label: name
Resource created by the operator lacks the label (name) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"name": "true"} to the ObjectMeta.
AP-9: Labels not propagated during resource updates (5)
actualCLIDownloads, err := consoleClient.Update(ctx, existingCLIDownloadsCopy, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (name), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["name"] = "true"
_, err = c.oauthClient.OAuthClients().Update(ctx, updated, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (name), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["name"] = "true"
actual, err := co.configMapClient.ConfigMaps(required.Namespace).Update(ctx, existing, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (name), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["name"] = "true"
actual, err := co.configMapClient.ConfigMaps(required.Namespace).Update(ctx, existing, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (name), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["name"] = "true"
actual, err := client.OAuthClients().Update(ctx, existing, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (name), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["name"] = "true"
|
||||||
cluster-kube-apiserver-operatorcluster-kube-apiserver-operator 0070 7 AP-7, AP-9 424f27c9c415AP-7: Operator-created resources missing cache labels (3)
ObjectMeta without label: apiserver
Resource created by the operator lacks the label (apiserver) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"apiserver": "true"} to the ObjectMeta.
ObjectMeta without label: apiserver
Resource created by the operator lacks the label (apiserver) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"apiserver": "true"} to the ObjectMeta.
ObjectMeta without label: apiserver
Resource created by the operator lacks the label (apiserver) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"apiserver": "true"} to the ObjectMeta.
AP-9: Labels not propagated during resource updates (4)
_, err = c.sccClient.SecurityContextConstraints().Update(ctx, sccCopy, v1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (apiserver), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["apiserver"] = "true"
caBundleConfigMap, err = client.ConfigMaps(operatorclient.TargetNamespace).Update(ctx, requiredConfigMap, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (apiserver), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["apiserver"] = "true"
_, err = operatorClient.OperatorV1().KubeAPIServers().Update(ctx, cfg, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (apiserver), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["apiserver"] = "true"
updatedCfg, err := operatorClient.OperatorV1().KubeAPIServers().Update(ctx, cfg, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (apiserver), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["apiserver"] = "true"
|
||||||
cluster-baremetal-operatorcluster-baremetal-operator 0510 6 AP-1, AP-10, AP-5 18e163a4c14dAP-1: Predicate filters don't limit cache (1)
Watches(&corev1.Secret{}, handler.EnqueueRequestsFromMapFunc(mapToProvisioningSingleton), builder.WithPredicates(pullSecretFilter)).
Predicate/event filter used on Watches() but predicates only filter events reaching the reconciler, not what the informer caches. The informer still does a full LIST+WATCH cluster-wide.
Replace Watches() with mgr.GetAPIReader() for occasional reads, or add a label selector in ByObject cache config.
AP-5: Typed/unstructured cache trap (4)
serviceMonitor := &unstructured.Unstructured{}
Unstructured object usage found in a file that also registers typed watches. controller-runtime maintains 3 separate caches (typed, unstructured, metadata) — mismatched representations cause duplicate caches or wasted memory.
Use WatchesMetadata() if you only need triggers. Otherwise ensure watch and read use the same object representation.
serviceMonitor.SetGroupVersionKind(schema.GroupVersionKind{
Unstructured object usage found in a file that also registers typed watches. controller-runtime maintains 3 separate caches (typed, unstructured, metadata) — mismatched representations cause duplicate caches or wasted memory.
Use WatchesMetadata() if you only need triggers. Otherwise ensure watch and read use the same object representation.
prometheusRule := &unstructured.Unstructured{}
Unstructured object usage found in a file that also registers typed watches. controller-runtime maintains 3 separate caches (typed, unstructured, metadata) — mismatched representations cause duplicate caches or wasted memory.
Use WatchesMetadata() if you only need triggers. Otherwise ensure watch and read use the same object representation.
prometheusRule.SetGroupVersionKind(schema.GroupVersionKind{
Unstructured object usage found in a file that also registers typed watches. controller-runtime maintains 3 separate caches (typed, unstructured, metadata) — mismatched representations cause duplicate caches or wasted memory.
Use WatchesMetadata() if you only need triggers. Otherwise ensure watch and read use the same object representation.
AP-10: No DefaultTransform to strip managedFields (1)
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
|
||||||
cluster-kube-controller-manager-operatorcluster-kube-controller-manager-operator 0050 5 AP-7, AP-9 395de9670574AP-7: Operator-created resources missing cache labels (3)
ObjectMeta without label: app
Resource created by the operator lacks the label (app) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"app": "true"} to the ObjectMeta.
ObjectMeta without label: app
Resource created by the operator lacks the label (app) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"app": "true"} to the ObjectMeta.
ObjectMeta without label: app
Resource created by the operator lacks the label (app) required by the ByObject cache filter. This resource will be invisible to the operator's own cached reads.
Add Labels: map[string]string{"app": "true"} to the ObjectMeta.
AP-9: Labels not propagated during resource updates (2)
caBundleConfigMap, err = client.ConfigMaps(operatorclient.TargetNamespace).Update(ctx, requiredConfigMap, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["app"] = "true"
caBundleConfigMap, err = client.ConfigMaps(operatorclient.OperatorNamespace).Update(ctx, requiredConfigMap, metav1.UpdateOptions{})
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (app), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["app"] = "true"
|
||||||
cluster-image-registry-operatorcluster-image-registry-operator 0220 4 AP-4, AP-9 b2dfc3bba3dfAP-4: No DefaultNamespaces — everything is cluster-wide (2)
cache.Options without DefaultNamespaces
No DefaultNamespaces set in cache configuration. Every informer watches ALL namespaces by default, even if the operator only manages resources in a few namespaces.
For single-namespace operators, set DefaultNamespaces: map[string]cache.Config{"my-ns": {}}. For multi-namespace, use label selectors in ByObject.
cache.Options without DefaultNamespaces
No DefaultNamespaces set in cache configuration. Every informer watches ALL namespaces by default, even if the operator only manages resources in a few namespaces.
For single-namespace operators, set DefaultNamespaces: map[string]cache.Config{"my-ns": {}}. For multi-namespace, use label selectors in ByObject.
AP-9: Labels not propagated during resource updates (2)
if _, err := client.Update(ctx, resourceGroupName, accountName, params, nil); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (name), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["name"] = "true"
if _, err := client.Update(ctx, resourceGroupName, accountName, params, nil); err != nil {
Update() call found without explicit label propagation. If the object's Labels map is nil or missing the required filter label (name), the resource becomes invisible to the filtered cache after the update.
Before Update(): if obj.Labels == nil { obj.Labels = map[string]string{} }; obj.Labels["name"] = "true"
|
||||||
operator-marketplaceoperator-marketplace 0112 4 AP-10, AP-4, AP-8 efb1a1ea40bcAP-4: No DefaultNamespaces — everything is cluster-wide (1)
cache.Options without DefaultNamespaces
No DefaultNamespaces set in cache configuration. Every informer watches ALL namespaces by default, even if the operator only manages resources in a few namespaces.
For single-namespace operators, set DefaultNamespaces: map[string]cache.Config{"my-ns": {}}. For multi-namespace, use label selectors in ByObject.
AP-10: No DefaultTransform to strip managedFields (1)
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
AP-8: No upgrade path for pre-existing unlabeled resources (2)
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
Create() without IsAlreadyExists fallback
Label-filtered cache is configured but Create() has no fallback for pre-existing unlabeled resources. After deploying the filtered cache, old resources cause Get()→NotFound but Create()→AlreadyExists.
Handle errors.IsAlreadyExists by falling back to a client.MergeFrom(base) patch that adds the required label.
|
||||||
cluster-dns-operatorcluster-dns-operator 2010 3 AP-10, AP-3 41a53fed36e6AP-3: Invisible informer from client.Get() (2)
if err := r.client.Get(ctx, request.NamespacedName, dns); err != nil {
client.Get()/List() for operatorv1.DNS which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every operatorv1.DNS in every namespace.
Add &operatorv1.DNS{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
if err := r.client.Get(ctx, name, co); err != nil {
client.Get()/List() for configv1.ClusterOperator which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every configv1.ClusterOperator in every namespace.
Add &configv1.ClusterOperator{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
AP-10: No DefaultTransform to strip managedFields (1)
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
|
||||||
cluster-storage-operatorcluster-storage-operator 0300 3 AP-4 e403475164a4AP-4: No DefaultNamespaces — everything is cluster-wide (3)
cache.Options without DefaultNamespaces
No DefaultNamespaces set in cache configuration. Every informer watches ALL namespaces by default, even if the operator only manages resources in a few namespaces.
For single-namespace operators, set DefaultNamespaces: map[string]cache.Config{"my-ns": {}}. For multi-namespace, use label selectors in ByObject.
cache.Options without DefaultNamespaces
No DefaultNamespaces set in cache configuration. Every informer watches ALL namespaces by default, even if the operator only manages resources in a few namespaces.
For single-namespace operators, set DefaultNamespaces: map[string]cache.Config{"my-ns": {}}. For multi-namespace, use label selectors in ByObject.
cache.Options without DefaultNamespaces
No DefaultNamespaces set in cache configuration. Every informer watches ALL namespaces by default, even if the operator only manages resources in a few namespaces.
For single-namespace operators, set DefaultNamespaces: map[string]cache.Config{"my-ns": {}}. For multi-namespace, use label selectors in ByObject.
|
||||||
cluster-config-operatorcluster-config-operator 1000 1 AP-3 1eb450a3a245AP-3: Invisible informer from client.Get() (1)
obj, err := c.configMapClient.ConfigMaps(operatorclient.GlobalUserSpecifiedConfigNamespace).Get(ctx, sourceCloudConfigMap, metav1.GetOptions{})
client.Get()/List() for corev1.ConfigMap which is not in ByObject or DisableFor. On first call, the cached client silently creates a cluster-wide informer with a full LIST of every corev1.ConfigMap in every namespace.
Add &corev1.ConfigMap{} to DisableFor to bypass cache, or add it to ByObject with a label selector.
|
||||||
cluster-autoscaler-operatorcluster-autoscaler-operator 0010 1 AP-10 dec12ba632a4AP-10: No DefaultTransform to strip managedFields (1)
cache.Options without DefaultTransform
Cache configuration does not strip managedFields. Every cached object carries ~2-5KB of managedFields metadata that operators almost never need. Across thousands of objects this adds significant memory overhead.
Add DefaultTransform: cache.TransformStripManagedFields() to cache.Options.
|
||||||
cluster-csi-snapshot-controller-operatorcluster-csi-snapshot-controller-operator 0000 0 8c1ebc60a201No anti-patterns detected |
||||||
cluster-kube-scheduler-operatorcluster-kube-scheduler-operator 0000 0 5ef1df3be41dNo anti-patterns detected |
||||||
cluster-kube-storage-version-migrator-operatorcluster-kube-storage-version-migrator-operator 0000 0 8a42beebd580No anti-patterns detected |
||||||
cluster-olm-operatorcluster-olm-operator 0000 0 03bedb913bceNo anti-patterns detected |
||||||
cluster-openshift-apiserver-operatorcluster-openshift-apiserver-operator 0000 0 52fd1773757bNo anti-patterns detected |
||||||
cluster-openshift-controller-manager-operatorcluster-openshift-controller-manager-operator 0000 0 2617a201bb36No anti-patterns detected |
||||||
cluster-samples-operatorcluster-samples-operator 0000 0 11ed1942dbbfNo anti-patterns detected |
||||||
cluster-version-operatorcluster-version-operator 0000 0 d37e5a056d5aNo anti-patterns detected |
||||||
csi-operatoraws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator 0000 0 20bb13fab386No anti-patterns detected |
||||||
gcp-pd-csi-driver-operatorgcp-pd-csi-driver-operator 0000 0 30853f6a0d50No anti-patterns detected |
||||||
ibm-powervs-block-csi-driver-operatorpowervs-block-csi-driver-operator 0000 0 b714ab87d079No anti-patterns detected |
||||||
ibm-vpc-block-csi-driver-operatoribm-vpc-block-csi-driver-operator 0000 0 00bc740728d9No anti-patterns detected |
||||||
insights-operatorinsights-operator 0000 0 5fa5ae58c0b7No anti-patterns detected |
||||||
machine-config-operatormachine-config-operator 0000 0 45a196b7ba10No anti-patterns detected |
||||||
service-ca-operatorservice-ca-operator 0000 0 e9622ba18c86No anti-patterns detected |
||||||
vmware-vsphere-csi-driver-operatorvsphere-csi-driver-operator 0000 0 d6a19449cc5dNo anti-patterns detected |
||||||