multi-tenant: EnsureNamespaceSA + ns_watcher SA provisioning (v8)

pkg/router/httpTriggers.go

@@ -18,6 +18,7 @@ package router
 
 import (
 	"context"
+	"fmt"
 	"net/http"
 	"strings"
 	"time"
@@ -35,6 +36,7 @@ import (
 	eclient "github.com/fission/fission/pkg/executor/client"
 	config "github.com/fission/fission/pkg/featureconfig"
 	"github.com/fission/fission/pkg/generated/clientset/versioned"
+	genInformer "github.com/fission/fission/pkg/generated/informers/externalversions"
 	"github.com/fission/fission/pkg/info"
 	"github.com/fission/fission/pkg/throttler"
 	"github.com/fission/fission/pkg/utils"
@@ -426,3 +428,84 @@ func (ts *HTTPTriggerSet) updateRouter(ctx context.Context) {
 		ts.mutableRouter.updateRouter(router)
 	}
 }
+
+// AddNamespace dynamically registers a new namespace in the router without a restart.
+// Creates per-NS informers for HTTPTriggers and Functions, wires up event handlers,
+// and triggers a router rebuild. Safe to call repeatedly — deduplicates via NSResolver.
+func (ts *HTTPTriggerSet) AddNamespace(ctx context.Context, ns string, mgr manager.Interface) error {
+	if !utils.DefaultNSResolver().AddNamespace(ns) {
+		return nil // already registered
+	}
+	ts.logger.Info("router.AddNamespace: setting up informers", zap.String("namespace", ns))
+
+	factory := genInformer.NewFilteredSharedInformerFactory(ts.fissionClient, 30*time.Minute, ns, nil)
+	triggerInf := factory.Core().V1().HTTPTriggers().Informer()
+	funcInf := factory.Core().V1().Functions().Informer()
+
+	_, err := triggerInf.AddEventHandler(k8sCache.ResourceEventHandlerFuncs{
+		AddFunc: func(obj interface{}) {
+			trigger := obj.(*fv1.HTTPTrigger)
+			go createIngress(context.Background(), ts.logger, trigger, ts.kubeClient)
+			ts.syncTriggers()
+		},
+		DeleteFunc: func(obj interface{}) {
+			ts.syncTriggers()
+			trigger := obj.(*fv1.HTTPTrigger)
+			go deleteIngress(context.Background(), ts.logger, trigger, ts.kubeClient)
+		},
+		UpdateFunc: func(oldObj interface{}, newObj interface{}) {
+			oldTrigger := oldObj.(*fv1.HTTPTrigger)
+			newTrigger := newObj.(*fv1.HTTPTrigger)
+			if oldTrigger.ObjectMeta.ResourceVersion == newTrigger.ObjectMeta.ResourceVersion {
+				return
+			}
+			go updateIngress(context.Background(), ts.logger, oldTrigger, newTrigger, ts.kubeClient)
+			ts.syncTriggers()
+		},
+	})
+	if err != nil {
+		return fmt.Errorf("router.AddNamespace %s: trigger handler: %w", ns, err)
+	}
+
+	_, err = funcInf.AddEventHandler(k8sCache.ResourceEventHandlerFuncs{
+		AddFunc:    func(obj interface{}) { ts.syncTriggers() },
+		DeleteFunc: func(obj interface{}) { ts.syncTriggers() },
+		UpdateFunc: func(oldObj interface{}, newObj interface{}) {
+			oldFn := oldObj.(*fv1.Function)
+			fn := newObj.(*fv1.Function)
+			if oldFn.ObjectMeta.ResourceVersion == fn.ObjectMeta.ResourceVersion {
+				return
+			}
+			for key, rr := range ts.resolver.copy() {
+				if key.namespace == fn.ObjectMeta.Namespace &&
+					rr.functionMap[fn.ObjectMeta.Name] != nil &&
+					rr.functionMap[fn.ObjectMeta.Name].ObjectMeta.ResourceVersion != fn.ObjectMeta.ResourceVersion {
+					ts.logger.Debug("invalidating resolver cache")
+					_ = ts.resolver.delete(key.namespace, key.triggerName, key.triggerResourceVersion)
+					break
+				}
+			}
+			ts.syncTriggers()
+		},
+	})
+	if err != nil {
+		return fmt.Errorf("router.AddNamespace %s: func handler: %w", ns, err)
+	}
+
+	// ts.funcInformer and resolver.funcInformer are the same map reference —
+	// updating ts.funcInformer also makes the resolver aware of the new namespace.
+	ts.triggerInformer[ns] = triggerInf
+	ts.funcInformer[ns] = funcInf
+
+	mgr.AddInformers(ctx, map[string]k8sCache.SharedIndexInformer{
+		ns + "/trigger": triggerInf,
+		ns + "/func":    funcInf,
+	})
+	factory.Start(ctx.Done())
+	// Wait for cache to sync before rebuilding the router, so triggers are visible.
+	k8sCache.WaitForCacheSync(ctx.Done(), triggerInf.HasSynced, funcInf.HasSynced)
+
+	ts.logger.Info("router.AddNamespace: done", zap.String("namespace", ns))
+	ts.syncTriggers()
+	return nil
+}