Deep Review: 20260325-112652-pr-188

The WithEventFilter at line 75 applies to all event sources. Both For and Watches target corev1.Namespace, so the type assertion at line 76 always succeeds and the name check at line 77 always compares against mockNamespaceName ("rdd-mocks"). Events on the owned rancher-desktop namespace are rejected before EnqueueRequestForOwner runs.

Other mock reconcilers avoid this problem because their primary and secondary types differ (e.g., corev1.Namespace vs. containersv1alpha1.ContainerNamespace), so the type assertion distinguishes the two event streams. The kubeNamespaceReconciler is unique in watching corev1.Namespace for both.

Practical impact is low: the reconciler fires once on rdd-mocks creation and creates rancher-desktop. If rancher-desktop is later deleted, nothing recreates it until a restart. Nobody deletes it during normal operation, but the dead code misleads future readers into thinking the controller self-heals.

func (r *kubeNamespaceReconciler) SetupWithManager(mgr ctrl.Manager) error {
	return ctrl.NewControllerManagedBy(mgr).
		For(&corev1.Namespace{}).
		Named("mock-kube-namespace-reconciler").
		Watches(
			&corev1.Namespace{},
			handler.EnqueueRequestForOwner(
				mgr.GetScheme(),
				mgr.GetRESTMapper(),
				&corev1.Namespace{},
				handler.OnlyControllerOwner(),
			)).
		WithEventFilter(predicate.NewPredicateFuncs(func(object client.Object) bool {
			if _, ok := object.(*corev1.Namespace); ok {
				return object.GetName() == mockNamespaceName
			}
			return false
		})).
		Complete(r)
}

Fix: Remove the Watches clause. It cannot work with a shared-type predicate, and removing it eliminates the false impression of self-healing.

 func (r *kubeNamespaceReconciler) SetupWithManager(mgr ctrl.Manager) error {
 	return ctrl.NewControllerManagedBy(mgr).
 		For(&corev1.Namespace{}).
 		Named("mock-kube-namespace-reconciler").
-		Watches(
-			&corev1.Namespace{},
-			handler.EnqueueRequestForOwner(
-				mgr.GetScheme(),
-				mgr.GetRESTMapper(),
-				&corev1.Namespace{},
-				handler.OnlyControllerOwner(),
-			)).
 		WithEventFilter(predicate.NewPredicateFuncs(func(object client.Object) bool {

containers and volumes are assigned via var=${output} (plain string, not an array). In bash, "${var[@]}" on a non-array expands as a single quoted word. With the current single-entry test data this works by accident, but adding a second entry to containers.json or volumes.json would pass a newline-embedded string as one argument instead of separate arguments. The original code (replaced in commit e9fa971) handled multiple entries with a while IFS= read -r loop.

@test "containers are created" {
    rdd ctl wait --for=create namespace rdd-mocks --timeout=30s
    rdd ctl wait --for=create namespace "${NAMESPACE}" --timeout=30s

    run -0 cat "${TEST_DATA_PATH}/containers.json"
    run -0 jq_output '.[].Id'
    containers=${output}

    rdd ctl wait --for=create --namespace="${NAMESPACE}" container "${containers[@]}" --timeout=30s
}

@test "volumes are created" {
    rdd ctl wait --for=create namespace rdd-mocks --timeout=30s

    run -0 cat "${TEST_DATA_PATH}/volumes.json"
    run -0 jq_output '.[].Name'
    volumes=${output}

    rdd ctl wait --for=create --namespace="${NAMESPACE}" volume "${volumes[@]}" --timeout=30s
}

Fix:

-    containers=${output}
-
-    rdd ctl wait --for=create --namespace="${NAMESPACE}" container "${containers[@]}" --timeout=30s
+    readarray -t containers <<<"${output}"
+    rdd ctl wait --for=create --namespace="${NAMESPACE}" container "${containers[@]}" --timeout=30s