Operator helm not syncing on labels

[AkhileshK8y]

Bug Report

What did you do?

I created a nginy helm operator based on the docs.
My watches yaml:

- group: demo.example.com
  version: v1alpha1
  kind: Nginy
  chart: helm-charts/nginy
  selector:
    matchLabels:
      syncMy: devOperator

I deployed 2 test object:

apiVersion: demo.example.com/v1alpha1
kind: Nginy
metadata:
  name: testa
  namespace:testa
  labels:
    syncMy: devOperator
spec:
  replicaCount: 3

and

apiVersion: demo.example.com/v1alpha1
kind: Nginy
metadata:
  name: testb
  namespace: testb
  labels:
    syncUr: devOperator
spec:
  replicaCount: 3

My Dockerfile

# Build the manager binary
FROM quay.io/operator-framework/helm-operator:v1.37.0

ENV HOME=/opt/helm
COPY watches.yaml ${HOME}/watches.yaml
COPY helm-charts  ${HOME}/helm-charts
WORKDIR ${HOME}

What did you expect to see?

I expected only testa object to get synced as only its label match. testb shouldn't sync.

What did you see instead? Under which circumstances?

However testb object is also getting synced. testb is syncing even if I change the label value. Things work fine if I change to v1.33.0 in my Dockerfile. Doesn't work with v1.35.0

Environment

Operator type:
helm operator v1.37.0

Kubernetes cluster type:
EKS

operator-sdk version: "v1.37.0", commit: "819984d4c1a51c8ff2ef6c23944554148ace0752", kubernetes version: "v1.29.0", go version: "go1.23.1", GOOS: "darwin", GOARCH: "amd64"

$ go version (if language is Go)

Client Version: v1.29.1 Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3 Server Version: v1.29.7-eks-a18cd3a

Possible Solution

My hunch is, it broke with below change:
1fd7f4d#diff-d47d8a84d35cfdd54322d503604e6ff0b2f5454d3f1133bfc4faa8faeb9b476d
This change went in after v1.33.0 and changes label selector code.

Additional context

https://github.com/AkhileshK8y/nginy-operator
My full code in case it helps.

[pjestin-sym]

I have the same issue, and this seems to happen when switching from version 1.16.0 to 1.36.1, so probably a regression, although that leaves a lot of versions to check 😬

[pmatun-xl]

I have noticed that when watch_namespaces is unset, the selector is not applied across all namespaces. This behavior appears to be due to changes in cmd.go introduced in commit 1fd7f4dafc954ecc79326d042b42e7d420699f44.

I haven't found anything in the documentation stating that selectors should be restricted to specific namespaces only. The selector behavior should be consistent. If it is applied to specific namespaces, it should also be applied for all namespaces.

I don't understand the reason for this restriction. I believe it should at least be documented and clarified if this is the intended behavior, or if there is any workaround to ensure selectors apply to all namespaces consistently when watch_namespaces is unset?

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[openshift-bot]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale