From 6b68cc54ba435911794fff7ed0a51411dcf35cf0 Mon Sep 17 00:00:00 2001
From: gcaracuel <633810+gcaracuel@users.noreply.github.com>
Date: Thu, 11 Sep 2025 17:56:29 +0200
Subject: [PATCH] USE_NAMESPACE_CACHE as default

---
 cmd/main.go | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/cmd/main.go b/cmd/main.go
index 38c03dc..3359bce 100644
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -30,6 +30,7 @@ import (
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/cache"
 	"sigs.k8s.io/controller-runtime/pkg/certwatcher"
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
@@ -207,6 +208,15 @@ func main() {
 		// LeaderElectionReleaseOnCancel: true,
 	}
 
+	// Configure namespace-scoped cache for enhanced security when operating in a specific namespace
+	// This limits the controller-runtime cache to only watch resources in the target namespace
+	setupLog.Info("Using namespace-scoped cache for enhanced security", "namespace", targetNamespace)
+	managerOptions.Cache = cache.Options{
+		DefaultNamespaces: map[string]cache.Config{
+			targetNamespace: {},
+		},
+	}
+
 	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), managerOptions)
 	if err != nil {
 		setupLog.Error(err, "unable to start manager")