Pull request overview

Adds namespace label selector support to the reflector’s “allowed namespaces” and “auto namespaces” logic, enabling selection of target namespaces via standard Kubernetes label selector syntax in addition to existing name/regex matching.

Changes:

• Introduces two new reflection annotations for label selectors (allowed/auto namespaces selectors) and wires them into MirroringProperties.
• Implements label-selector matching (with OR logic vs name-pattern matching) and updates mirroring flows to use V1Namespace when available.
• Adds unit tests and test helpers for selector behavior; exposes internals to the test project.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Hey — thanks for your patience with this one, sorry it sat longer than it should have. Circling back now with a proper pass.

First, the Copilot round was handled really well. I checked each one against current code: the fail-closed path in LabelSelectorMatch, the Modified + Deleted handlers, the negative-case tests, and the updated XML doc are all solid. The negative test coverage in particular (the InvalidSelector_* theories) is exactly the right shape.

I had a couple of items from an earlier review pass that didn't come through on the PR conversation — apologies for that, they're on me. I've restated them as inline comments below along with a few smaller things I spotted on this pass.

On tests: the unit coverage for the parser is thorough, but there's no end-to-end coverage for the feature itself. Given the existing Testcontainers.K3s pattern (see MirroringIntegrationTests.AutoReflect_To_AllowedNamespaces), it would be worth one or two integration tests — particularly one that exercises the new Modified-path logic (label changes creating/removing reflections), since that's easy to silently break with a future refactor.

Thanks again for the contribution — the core approach is sound and the implementation is genuinely considerate (the XML docs, the overload preservation, the InternalsVisibleTo pattern, all good calls). Happy to merge once the items below are resolved.

Really thorough response — appreciate the care on every point. I walked through each of the new commits against the earlier asks and they all hold up.

• Security fallback (983e507): CanBeReflectedToNamespaceCached / CanBeAutoReflectedToNamespaceCached now fail closed when a selector is configured and the namespace isn't cached, with a debug log for visibility. Clean, preserves existing behavior for regex-only sources.
• Parser refactor (551bdc9): V1LabelSelector / V1LabelSelectorRequirement as the internal representation, K8s-spec label key/value validation (prefix + name, length limits, regexes), and warning logs deduped per source-signature — exactly the surface area that was missing. The split between TryParseSetBased / TryParseInequality / TryParseEquality / TryParseExistence reads cleanly and each path validates independently. GetLabelSelectorErrors as a public diagnostic is a nice touch.
• Direct reflection rebalance (25ab8ff): both Modified and Deleted now walk _directReflectionCache, and the DirectReflect_StopsUpdating_WhenNamespaceLabelsNoLongerMatchSelector integration test exercises exactly the shift-label-mid-flight scenario.
• Labels-equal short-circuit (baf0a2d): NamespaceLabelsEqual with empty-dict coalescing, dedicated unit tests covering null/empty/add/remove/rename/same, applied before both the auto-source loop and the direct-rebalance loop.
• Integration tests: AutoReflect_To_NamespacesMatchingLabelSelector and AutoReflect_UpdatesReflections_WhenNamespaceLabelsChange plus the direct-reflection test give end-to-end protection for the new behavior. Pattern matches the existing AutoReflect_To_AllowedNamespaces shape, which is exactly right.

Two very small observations I won't block on:

1. NamespaceLabelsEqual uses SequenceEqual, which is order-sensitive — two semantically-equal dicts with different insertion order would compare unequal and fall through to reconciliation. Correctness is preserved (more work, not less), so it's fine as-is; a Count + All(TryGetValue...) check would be order-independent if you want to tune it.
2. TryParseEquality silently overwrites duplicate keys with conflicting values — e.g. env=prod,env=staging parses as matchLabels["env"] = "staging" rather than being rejected. Real-world operators won't write that, and kubectl would reject it, but a "duplicate key" check would make the parser a touch more faithful. Up to you — I'd leave it.

Really strong engagement through the review. Approving — happy to merge.