feat: add namespaceStrategy API (#883)

This change adds a new namespaceStrategy API field which dictates how
RootSync reconcilers handle undeclared namespaces.

The default value is implicit, which is the same as the current
behavior. This mode creates namespaces implicitly if they are not
declared and do not exist.

The new strategy is explicit, in which namespaces will only be created
by the reconciler if they are declared in the source.

cmd/reconciler/main.go

@@ -16,6 +16,7 @@ package main
 
 import (
 	"flag"
+	"fmt"
 	"os"
 	"strings"
 
@@ -95,25 +96,30 @@ var (
 		"Enable debug mode, panicking in many scenarios where normally an InternalError would be logged. "+
 			"Do not use in production.")
 
-	renderingEnabled = flag.Bool("rendering-enabled", util.EnvBool(reconcilermanager.RenderingEnabled, false), "")
+	renderingEnabled  = flag.Bool("rendering-enabled", util.EnvBool(reconcilermanager.RenderingEnabled, false), "")
+	namespaceStrategy = flag.String(flags.namespaceStrategy, util.EnvString(reconcilermanager.NamespaceStrategy, ""),
+		fmt.Sprintf("Set the namespace strategy for the reconciler. Must be %s or %s.",
+			configsync.NamespaceStrategyImplicit, configsync.NamespaceStrategyExplicit))
 )
 
 var flags = struct {
-	sourceDir        string
-	repoRootDir      string
-	hydratedRootDir  string
-	clusterName      string
-	sourceFormat     string
-	statusMode       string
-	reconcileTimeout string
+	sourceDir         string
+	repoRootDir       string
+	hydratedRootDir   string
+	clusterName       string
+	sourceFormat      string
+	statusMode        string
+	reconcileTimeout  string
+	namespaceStrategy string
 }{
-	repoRootDir:      "repo-root",
-	sourceDir:        "source-dir",
-	hydratedRootDir:  "hydrated-root",
-	clusterName:      "cluster-name",
-	sourceFormat:     reconcilermanager.SourceFormat,
-	statusMode:       "status-mode",
-	reconcileTimeout: "reconcile-timeout",
+	repoRootDir:       "repo-root",
+	sourceDir:         "source-dir",
+	hydratedRootDir:   "hydrated-root",
+	clusterName:       "cluster-name",
+	sourceFormat:      reconcilermanager.SourceFormat,
+	statusMode:        "status-mode",
+	reconcileTimeout:  "reconcile-timeout",
+	namespaceStrategy: "namespace-strategy",
 }
 
 func main() {
@@ -195,10 +201,16 @@ func main() {
 		if format == "" {
 			format = filesystem.SourceFormatHierarchy
 		}
+		// Default to "implicit" if unset.
+		nsStrat := configsync.NamespaceStrategy(*namespaceStrategy)
+		if nsStrat == "" {
+			nsStrat = configsync.NamespaceStrategyImplicit
+		}
 
 		klog.Info("Starting reconciler for: root")
 		opts.RootOptions = &reconciler.RootOptions{
-			SourceFormat: format,
+			SourceFormat:      format,
+			NamespaceStrategy: nsStrat,
 		}
 	} else {
 		klog.Infof("Starting reconciler for: %s", *scope)
@@ -207,6 +219,10 @@ func main() {
 			klog.Fatalf("Flag %s and Environment variable%q must not be passed to a Namespace reconciler",
 				flags.sourceFormat, filesystem.SourceFormatKey)
 		}
+		if *namespaceStrategy != "" {
+			klog.Fatalf("Flag %s and Environment variable%q must not be passed to a Namespace reconciler",
+				flags.namespaceStrategy, reconcilermanager.NamespaceStrategy)
+		}
 	}
 	reconciler.Run(opts)
 }

e2e/nomostest/testpredicates/predicates.go

@@ -1153,8 +1153,8 @@ func validateRootSyncCondition(actual *v1beta1.RootSyncCondition, expected *v1be
 }
 
 // RootSyncSpecOverrideEquals checks that the RootSync's spec.override matches
-// the specified OverrideSpec.
-func RootSyncSpecOverrideEquals(expected *v1beta1.OverrideSpec) Predicate {
+// the specified RootSyncOverrideSpec.
+func RootSyncSpecOverrideEquals(expected *v1beta1.RootSyncOverrideSpec) Predicate {
 	return func(obj client.Object) error {
 		if obj == nil {
 			return ErrObjectNotFound