From 00c9983db8260f9af71bc6302ca2fb720288a275 Mon Sep 17 00:00:00 2001
From: AlinsRan <rongxin@api7.ai>
Date: Wed, 23 Sep 2026 19:06:15 +0800
Subject: [PATCH] feat(ingress-controller): expose namespace_selector

The controller limits the Ingress and apisix.apache.org/v2 resources it
syncs to the namespaces matching namespace_selector. Surface it as
config.namespaceSelector so it can be set through the chart. The field is
rendered only when it holds entries, so the default keeps selecting every
namespace.
---
 charts/ingress-controller/Chart.yaml               | 2 +-
 charts/ingress-controller/README.md                | 3 ++-
 charts/ingress-controller/templates/configmap.yaml | 4 ++++
 charts/ingress-controller/values.yaml              | 5 +++++
 4 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/charts/ingress-controller/Chart.yaml b/charts/ingress-controller/Chart.yaml
index 8b31a94..5d8198b 100644
--- a/charts/ingress-controller/Chart.yaml
+++ b/charts/ingress-controller/Chart.yaml
@@ -6,7 +6,7 @@ keywords:
   - api7
   - crd
 type: application
-version: 0.1.28
+version: 0.1.29
 appVersion: 2.2.1
 maintainers:
   - name: API7
diff --git a/charts/ingress-controller/README.md b/charts/ingress-controller/README.md
index bbb7fa9..d11ea7d 100644
--- a/charts/ingress-controller/README.md
+++ b/charts/ingress-controller/README.md
@@ -1,6 +1,6 @@
 # api7-ingress-controller
 
-![Version: 0.1.28](https://img.shields.io/badge/Version-0.1.28-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.2.1](https://img.shields.io/badge/AppVersion-2.2.1-informational?style=flat-square)
+![Version: 0.1.29](https://img.shields.io/badge/Version-0.1.29-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.2.1](https://img.shields.io/badge/AppVersion-2.2.1-informational?style=flat-square)
 
 Ingress Controller for API7
 
@@ -61,6 +61,7 @@ the controller recommends 1.31+ and only warns below it.
 | config.listenerPortMatchMode | string | `"off"` | How a Gateway API route is matched to a listener port: `off`, `auto` or `explicit`. |
 | config.logLevel | string | `"info"` |  |
 | config.metricsAddr | string | `":8080"` |  |
+| config.namespaceSelector | list | `[]` | Label selectors of the namespaces whose Ingress and apisix.apache.org/v2 resources are synced. A namespace is selected when its labels match all entries, and the values given for the same key are ORed, so `["team=a", "team=b", "env=prod"]` selects the namespaces labeled `team in (a,b)` that are also labeled `env=prod`. Empty selects all namespaces. |
 | config.probeAddr | string | `":8081"` |  |
 | config.provider.initSyncDelay | string | `"20m"` |  |
 | config.provider.syncPeriod | string | `"1h"` |  |
diff --git a/charts/ingress-controller/templates/configmap.yaml b/charts/ingress-controller/templates/configmap.yaml
index 98cf0a2..72ce085 100644
--- a/charts/ingress-controller/templates/configmap.yaml
+++ b/charts/ingress-controller/templates/configmap.yaml
@@ -22,6 +22,10 @@ data:
     exec_adc_timeout: {{ .Values.config.execADCTimeout | default "15s" }}
     disable_gateway_api: {{ .Values.config.disableGatewayApi | default false }}
     listener_port_match_mode: {{ .Values.config.listenerPortMatchMode | default "off" | quote }}
+    {{- with .Values.config.namespaceSelector }}
+    namespace_selector:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
     provider:
       type: {{ .Values.config.provider.type | default "api7ee" }}
       sync_period: {{ .Values.config.provider.syncPeriod | default "0s" }}
diff --git a/charts/ingress-controller/values.yaml b/charts/ingress-controller/values.yaml
index 4cadbde..d025f5b 100644
--- a/charts/ingress-controller/values.yaml
+++ b/charts/ingress-controller/values.yaml
@@ -66,6 +66,11 @@ config:
   disableGatewayApi: false  # Whether to disable the Gateway API support. The default value is false.
   # -- How a Gateway API route is matched to a listener port: `off`, `auto` or `explicit`.
   listenerPortMatchMode: "off"
+  # -- Label selectors of the namespaces whose Ingress and apisix.apache.org/v2 resources are
+  # synced. A namespace is selected when its labels match all entries, and the values given for
+  # the same key are ORed, so `["team=a", "team=b", "env=prod"]` selects the namespaces labeled
+  # `team in (a,b)` that are also labeled `env=prod`. Empty selects all namespaces.
+  namespaceSelector: []
   provider:
     type: "api7ee"
     syncPeriod: "1h"