layer1: centralize managed namespace labels step 13

doc/thinking/2026-04-26-namespace-manager-step13.md

@@ -0,0 +1,20 @@
+# 2026-04-26 — NamespaceManager rewrite, step 13
+
+## Цель шага
+
+Централизовать managed namespace label contract в `utils`.
+
+## Что меняем
+
+1. Добавляем в `utils`:
+   - `ManagedNamespaceLabelKey`
+   - `ManagedNamespaceLabelValue`
+   - `ManagedNamespaceLabelSelector()`
+   - `IsManagedNamespace()`
+2. Переводим watcher-ы executor/router/buildermgr на единый helper.
+
+## Что НЕ меняем
+
+- не подключаем новый manager к watcher-ам;
+- не меняем поведение onboarding;
+- не трогаем runtime reconcile.

pkg/buildermgr/ns_watcher.go

@@ -20,8 +20,6 @@ import (
 	"github.com/fission/fission/pkg/utils/manager"
 )
 
-const builderManagedNSLabel = "fission.io/managed"
-
 // StartNSWatcher watches for Namespaces labeled fission.io/managed=true
 // and immediately registers per-NS informers in envWatcher and pkgWatcher.
 func StartNSWatcher(
@@ -36,7 +34,7 @@ func StartNSWatcher(
 		kubeClient,
 		30*time.Minute,
 		k8sInformers.WithTweakListOptions(func(opts *metav1.ListOptions) {
-			opts.LabelSelector = builderManagedNSLabel + "=true"
+			opts.LabelSelector = utils.ManagedNamespaceLabelSelector()
 		}),
 	)
 
@@ -54,7 +52,7 @@ func StartNSWatcher(
 		},
 		UpdateFunc: func(_, newObj interface{}) {
 			nsObj, ok := newObj.(*corev1.Namespace)
-			if !ok || nsObj.Labels[builderManagedNSLabel] != "true" {
+			if !ok || !utils.IsManagedNamespace(nsObj.Labels) {
 				return
 			}
 			utils.DefaultNSResolver().AddNamespace(nsObj.Name)
@@ -65,7 +63,7 @@ func StartNSWatcher(
 
 	mgr.Add(ctx, func(ctx context.Context) {
 		logger.Info("buildermgr.NSWatcher: started",
-			zap.String("label", builderManagedNSLabel+"=true"))
+			zap.String("label", utils.ManagedNamespaceLabelSelector()))
 		factory.Start(ctx.Done())
 		factory.WaitForCacheSync(ctx.Done())
 		logger.Info("buildermgr.NSWatcher: cache synced — watching for new namespaces")

pkg/executor/multitenant/ns_watcher.go

@@ -77,16 +77,6 @@ import (
 	"github.com/fission/fission/pkg/utils/manager"
 )
 
-// ManagedNSLabel is the Kubernetes label key that marks a Namespace as dynamically managed
-// by Fission multi-tenant mode. The expected value is "true".
-//
-// Platforms MUST set this label on every user Namespace they create:
-//
-//	metadata:
-//	  labels:
-//	    fission.io/managed: "true"
-const ManagedNSLabel = "fission.io/managed"
-
 // StartNSWatcher registers a Kubernetes Namespace Informer that reacts immediately
 // when a Namespace with label fission.io/managed=true is created or relabeled.
 //
@@ -109,7 +99,7 @@ func StartNSWatcher(
 		kubernetesClient,
 		30*time.Minute,
 		k8sInformers.WithTweakListOptions(func(opts *metav1.ListOptions) {
-			opts.LabelSelector = ManagedNSLabel + "=true"
+			opts.LabelSelector = utils.ManagedNamespaceLabelSelector()
 		}),
 	)
 
@@ -131,7 +121,7 @@ func StartNSWatcher(
 			if !ok {
 				return
 			}
-			if nsObj.Labels[ManagedNSLabel] != "true" {
+			if !utils.IsManagedNamespace(nsObj.Labels) {
 				return // label was removed — nothing to do (executor keeps existing registrations)
 			}
 			registerNamespace(ctx, logger, kubernetesClient, nsObj.Name, executorTypes, mgr)
@@ -139,7 +129,7 @@ func StartNSWatcher(
 	})
 
 	mgr.Add(ctx, func(ctx context.Context) {
-		logger.Info("multitenant.NSWatcher: started", zap.String("label", ManagedNSLabel+"=true"))
+		logger.Info("multitenant.NSWatcher: started", zap.String("label", utils.ManagedNamespaceLabelSelector()))
 		factory.Start(ctx.Done())
 		factory.WaitForCacheSync(ctx.Done())
 		logger.Info("multitenant.NSWatcher: cache synced — watching for new namespaces")

pkg/router/ns_watcher.go

@@ -16,11 +16,10 @@ import (
 	"k8s.io/client-go/kubernetes"
 	k8sCache "k8s.io/client-go/tools/cache"
 
+	"github.com/fission/fission/pkg/utils"
 	"github.com/fission/fission/pkg/utils/manager"
 )
 
-const routerManagedNSLabel = "fission.io/managed"
-
 // StartNSWatcher registers a Kubernetes Namespace Informer for the router.
 // Whenever a Namespace with label fission.io/managed=true appears (or is relabeled),
 // the router immediately subscribes to HTTPTriggers and Functions in that namespace.
@@ -35,7 +34,7 @@ func StartNSWatcher(
 		kubeClient,
 		30*time.Minute,
 		k8sInformers.WithTweakListOptions(func(opts *metav1.ListOptions) {
-			opts.LabelSelector = routerManagedNSLabel + "=true"
+			opts.LabelSelector = utils.ManagedNamespaceLabelSelector()
 		}),
 	)
 
@@ -54,7 +53,7 @@ func StartNSWatcher(
 		},
 		UpdateFunc: func(_, newObj interface{}) {
 			nsObj, ok := newObj.(*corev1.Namespace)
-			if !ok || nsObj.Labels[routerManagedNSLabel] != "true" {
+			if !ok || !utils.IsManagedNamespace(nsObj.Labels) {
 				return
 			}
 			if err := ts.AddNamespace(ctx, nsObj.Name, mgr); err != nil {
@@ -66,7 +65,7 @@ func StartNSWatcher(
 
 	mgr.Add(ctx, func(ctx context.Context) {
 		logger.Info("router.NSWatcher: started",
-			zap.String("label", routerManagedNSLabel+"=true"))
+			zap.String("label", utils.ManagedNamespaceLabelSelector()))
 		factory.Start(ctx.Done())
 		factory.WaitForCacheSync(ctx.Done())
 		logger.Info("router.NSWatcher: cache synced — watching for new namespaces")

pkg/utils/namespace.go

@@ -17,8 +17,18 @@ const (
 	ENV_BUILDER_NAMESPACE    string = "FISSION_BUILDER_NAMESPACE"
 	ENV_DEFAULT_NAMESPACE    string = "FISSION_DEFAULT_NAMESPACE"
 	ENV_ADDITIONAL_NAMESPACE string = "FISSION_RESOURCE_NAMESPACES"
+	ManagedNamespaceLabelKey string = "fission.io/managed"
+	ManagedNamespaceLabelValue string = "true"
 )
 
+func ManagedNamespaceLabelSelector() string {
+	return ManagedNamespaceLabelKey + "=" + ManagedNamespaceLabelValue
+}
+
+func IsManagedNamespace(labels map[string]string) bool {
+	return labels[ManagedNamespaceLabelKey] == ManagedNamespaceLabelValue
+}
+
 type (
 	NamespaceResolver struct {
 		mu sync.RWMutex // protects FissionResourceNS

pkg/utils/namespace_test.go

@@ -216,6 +216,18 @@ func TestNamespaceResolver(t *testing.T) {
 		}
 	})
 
+	t.Run("managed namespace label helpers", func(t *testing.T) {
+		if ManagedNamespaceLabelSelector() != "fission.io/managed=true" {
+			t.Fatalf("unexpected managed namespace selector: %s", ManagedNamespaceLabelSelector())
+		}
+		if !IsManagedNamespace(map[string]string{ManagedNamespaceLabelKey: ManagedNamespaceLabelValue}) {
+			t.Fatalf("expected managed namespace to be detected")
+		}
+		if IsManagedNamespace(map[string]string{ManagedNamespaceLabelKey: "false"}) {
+			t.Fatalf("expected non-managed namespace to be rejected")
+		}
+	})
+
 	t.Run("getNamespace", func(t *testing.T) {
 		for _, test := range []struct {
 			name                string