Fix: namespace restricted mode issues

[frigaut-orange]

Description of your changes

Fixes #7354 and #7353

Depends on crossplane/crossplane-runtime#946

I have:

• Read and followed Crossplane's contribution process.
• Run ./nix.sh flake check to ensure this PR is ready for review.
• Added or updated unit tests.
• Added or updated e2e tests.
• Linked a PR or a docs tracking issue to document this change.
• Added backport release-x.y labels to auto-backport this PR.
• Followed the API promotion workflow if this PR introduces, removes, or promotes an API.

Need help with this checklist? See the cheat sheet.

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

The change corrects restricted event filtering and adds namespace-restricted E2E coverage. The E2E matrix now runs the new area, with manifests for resources in separate namespaces.

Namespace restriction

Layer / File(s)	Summary
Restricted event filtering cmd/crossplane/core/core.go	Metadata lookup errors are logged and allowed through. Cluster-scoped and default-namespace events are filtered. Other namespace events remain allowed.
Namespace-restricted E2E coverage test/e2e/namespace_restricted_test.go, test/e2e/manifests/namespace-restricted/*, .github/workflows/ci.yml, test/e2e/ops_operations_test.go	The suite enables --watch-cache-namespaced, applies cross-namespace prerequisites, verifies XR readiness and status, performs cleanup, and runs in CI. An operations label comment is corrected.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant E2ETest
  participant Helm
  participant Crossplane
  participant KubernetesAPI
  E2ETest->>Helm: install with --watch-cache-namespaced
  Helm->>Crossplane: configure namespace-restricted mode
  E2ETest->>KubernetesAPI: apply namespace and composition resources
  KubernetesAPI->>Crossplane: reconcile namespaced XR
  Crossplane-->>KubernetesAPI: update readiness and status.coolerField
  E2ETest->>KubernetesAPI: delete XR and prerequisites

Loading

Suggested reviewers: adamwg, jbw976

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is under 72 characters and clearly describes the namespace-restricted mode fixes.
Description check	✅ Passed	The description identifies the linked issues, dependency, validation steps, and overall namespace-restricted mode work.
Linked Issues check	✅ Passed	The changes correct namespace-restricted event filtering and add end-to-end coverage for the behavior required by issue #7354.
Out of Scope Changes check	✅ Passed	The CI, manifest, test, filter, and comment changes support namespace-restricted mode or its validation.
Breaking Changes	✅ Passed	The PR changes no files under apis/, and startCommand flags are unchanged; cmd/ only corrects existing opt-in filtering and adds cache handling.
Feature Gate Requirement	✅ Passed	PR fixes existing namespace-restricted mode behavior without adding new experimental features. Both WatchCacheNamespaced and RestrictNamespacedEvents flags pre-existed; no apis/** changes or featur...

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (2)

test/e2e/namespace_restricted_test.go (1)

58-92: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Use the required table-driven test form.

Please represent the scenario as a named test case with args, want, and reason fields. Keep the feature construction inside the case loop. This structure will support additional namespace-restricted scenarios without duplicating the lifecycle flow.

As per path instructions, **/*_test.go: “Enforce table-driven test structure: PascalCase test names (no underscores), args/want pattern, use cmp.Diff with cmpopts.EquateErrors() for error testing.”

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/e2e/namespace_restricted_test.go` around lines 58 - 92, Refactor the
TestNamespaceRestrictedBasicCompositionNamespaced function into a table-driven
test structure with a slice of test cases, where each case contains args, want,
and reason fields representing different namespace-restricted scenarios. Move
the feature construction and lifecycle flow (WithSetup, Assess, WithTeardown)
inside a loop that iterates over the test cases, parameterizing the manifests
and resource paths to support multiple scenarios without duplicating the shared
lifecycle logic. Use PascalCase naming for individual test case names without
underscores.

Source: Path instructions

cmd/crossplane/core/core.go (1)

265-277: 🎯 Functional Correctness | 🔵 Trivial | 🏗️ Heavy lift

Add a regression test for all filter outcomes.

Thank you for correcting the predicate. The new E2E suite enables only --watch-cache-namespaced at test/e2e/namespace_restricted_test.go, Line 50. It does not execute this RestrictNamespacedEvents filter.

Add a table-driven test for metadata-access failure, cluster-scoped objects, default-namespace objects, and other namespaced objects. Assert the expected event.FilterFn result for each case.

As per path instructions, **/*_test.go: “Enforce table-driven test structure: PascalCase test names (no underscores), args/want pattern, use cmp.Diff with cmpopts.EquateErrors() for error testing.”

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cmd/crossplane/core/core.go` around lines 265 - 277, Create a table-driven
unit test for the RestrictNamespacedEvents filter predicate that covers all
filter outcomes: metadata-access failures, cluster-scoped objects (empty
namespace), default-namespace objects, and other namespaced objects. Use
PascalCase test names without underscores, an args/want pattern for test cases,
and assert the expected boolean result returned by the event.FilterFn for each
scenario. For metadata-access failure cases, use cmp.Diff with
cmpopts.EquateErrors() to validate error behavior.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@cmd/crossplane/core/core.go`:
- Around line 265-277: Create a table-driven unit test for the
RestrictNamespacedEvents filter predicate that covers all filter outcomes:
metadata-access failures, cluster-scoped objects (empty namespace),
default-namespace objects, and other namespaced objects. Use PascalCase test
names without underscores, an args/want pattern for test cases, and assert the
expected boolean result returned by the event.FilterFn for each scenario. For
metadata-access failure cases, use cmp.Diff with cmpopts.EquateErrors() to
validate error behavior.

In `@test/e2e/namespace_restricted_test.go`:
- Around line 58-92: Refactor the
TestNamespaceRestrictedBasicCompositionNamespaced function into a table-driven
test structure with a slice of test cases, where each case contains args, want,
and reason fields representing different namespace-restricted scenarios. Move
the feature construction and lifecycle flow (WithSetup, Assess, WithTeardown)
inside a loop that iterates over the test cases, parameterizing the manifests
and resource paths to support multiple scenarios without duplicating the shared
lifecycle logic. Use PascalCase naming for individual test case names without
underscores.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 93ea1be9-500b-4e9e-89bf-876d3e777427

📥 Commits

Reviewing files that changed from the base of the PR and between 16b3864 and 071c621.

📒 Files selected for processing (6)

• .github/workflows/ci.yml
• cmd/crossplane/core/core.go
• test/e2e/manifests/namespace-restricted/other-namespace.yaml
• test/e2e/manifests/namespace-restricted/xr.yaml
• test/e2e/namespace_restricted_test.go
• test/e2e/ops_operations_test.go