Deep Review: 20260323-111913-pr-188

The For(&corev1.Namespace{}) watch at line 65 uses handler.EnqueueRequestForObject, which enqueues the object's own name. The global WithEventFilter at line 75 accepts both mockNamespaceName ("rdd-mocks") and apiNamespace ("rancher-desktop"). When the reconciler creates the rancher-desktop namespace, the For watch fires and enqueues reconcile.Request{Name: "rancher-desktop"}.

func (r *kubeNamespaceReconciler) SetupWithManager(mgr ctrl.Manager) error {
	return ctrl.NewControllerManagedBy(mgr).
		For(&corev1.Namespace{}).
		Named("mock-kube-namespace-reconciler").
		Watches(
			&corev1.Namespace{},
			handler.EnqueueRequestForOwner(
				mgr.GetScheme(),
				mgr.GetRESTMapper(),
				&corev1.Namespace{},
				handler.OnlyControllerOwner(),
			)).
		WithEventFilter(predicate.NewPredicateFuncs(func(object client.Object) bool {
			if _, ok := object.(*corev1.Namespace); ok {
				switch object.GetName() {
				case mockNamespaceName, apiNamespace:
					return true
				}
			}
			return false
		})).
		Complete(r)
}

The reconciler then runs with req.Name = "rancher-desktop": line 31 fetches the rancher-desktop namespace into rddNamespace, lines 41-47 build an ownerReference pointing to rancher-desktop (itself), and lines 49-55 apply this self-referential ownerReference to the rancher-desktop namespace.

func (r *kubeNamespaceReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
	log := log.FromContext(ctx)

	var rddNamespace corev1.Namespace
	if err := r.Client.Get(ctx, req.NamespacedName, &rddNamespace); err != nil {
		log.Error(err, "Failed to get namespace", "namespace", req.NamespacedName)
		return ctrl.Result{}, err
	}
	gvk, err := r.Client.GroupVersionKindFor(&rddNamespace)
	if err != nil {
		log.Error(err, "Failed to get GVK for namespace", "namespace", &rddNamespace)
		return ctrl.Result{}, err
	}

	ownerReference := metav1apply.OwnerReference().
		WithAPIVersion(gvk.GroupVersion().String()).
		WithKind(gvk.Kind).
		WithName(rddNamespace.GetName()).
		WithUID(rddNamespace.GetUID()).
		WithBlockOwnerDeletion(true).
		WithController(true)

	err = r.Client.Apply(
		ctx,
		corev1apply.Namespace(apiNamespace).
			WithOwnerReferences(ownerReference),
		client.ForceOwnership,
		client.FieldOwner(controllerLongName),
	)
	if err != nil {
		return ctrl.Result{}, err
	}

	return ctrl.Result{}, nil
}

This overwrites the correct ownerReference (pointing to rdd-mocks) set by the earlier reconcile. The two reconcile paths then oscillate: reconcile("rdd-mocks") sets owner to rdd-mocks, reconcile("rancher-desktop") sets owner to rancher-desktop, and each update triggers the next.

Contrast with the containerNamespaceReconciler at lines 101-103, which correctly filters only for mockNamespaceName:

		WithEventFilter(predicate.NewPredicateFuncs(func(object client.Object) bool {
			if _, ok := object.(*corev1.Namespace); ok {
				return object.GetName() == mockNamespaceName

All three agents independently identified this bug. Confirmed via git blame: all lines in this file are from commit 7ce6b31.

Fix: Guard the reconciler body to ignore reconcile requests for anything other than the owner namespace:

 func (r *kubeNamespaceReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+	if req.Name != mockNamespaceName {
+		return ctrl.Result{}, nil
+	}
+
 	log := log.FromContext(ctx)

The PR description says this change "ensures that we create namespaces for all the volumes in the test data." The loop iterates over volumes and calls getVolumeName to collect their namespaces. But getVolumeName always returns the containerNamespace constant ("buildkit"), so the map only ever contains one entry. The loop gives the appearance of dynamic namespace collection while doing nothing.

	namespaces := map[string]struct{}{containerNamespace: {}}
	for _, volume := range r.volumes {
		namespace, _ := getVolumeName(volume)
		namespaces[namespace] = struct{}{}
	}

func getVolumeName(volume mobyvolume.Volume) (namespace, name string) {
	return containerNamespace, volume.Name
}

Fix: If mock volumes will eventually belong to different container namespaces, update getVolumeName to extract the namespace from volume labels. If all volumes belong to "buildkit", remove the misleading loop and add containerNamespace directly.