Using controllers in namespace scope with IAMRoleSelector

[ramasai1]

Hi, I want to use my controllers in namespace scope, and I want to make it such that spec.namespaceSelector.names and watchNamespace in the same chart are the same. It seems like the Helm charts for all controllers install the role correctly and add the iamroleselectors permission, but the controller doesn't start up successfully because of using an unfiltered informer factory for iamroleselectors. Using NewDynamicSharedInformerFactory queries across all namespaces, which seems like it is not needed.

I understand requiring the use of running the controllers in cluster scope while using classic team/service level CARM, but now it seems quite possible to run the controllers in namespace scope with IAMRoleSelector due to namespaceSelector.names.

Is this something that can be made possible?

Thanks.

[github-actions]

Hello @ramasai1 👋 Thank you for opening an issue in ACK! A maintainer will triage this issue soon.

We encourage community contributions, so if you're interested in tackling this yourself or suggesting a solution, please check out our Contribution and Code of Conduct guidelines.

You can find more information about ACK on our website.

[ramasai1]

Oh I see, looks like the IAMRoleSelector CRD itself is cluster scoped.

Looks like the namespace install scope result can be achieved by scoping .spec.namespaceSelector.names to the set of chosen namespaces, but can the Helm chart be mended to give a separate ClusterRole for iamroleselectors in both cluster and namespace scope so that the controllers truly run in namespace scope?