CRDs & Custom Resources

apiVersion: apiextensions.k8s.io/v1  
kind: CustomResourceDefinition  
metadata:  
  # Name must match: <plural>.<group>  
  name: databases.example.com  
spec:  
  # Group for REST API: /apis/<group>/<version>  
  group: example.com  
  
  # Scope: Namespaced or Cluster  
  scope: Namespaced  
  
  names:  
    # Plural name for URL: /apis/example.com/v1/databases  
    plural: databases  
    # Singular name for display  
    singular: database  
    # Kind for manifests  
    kind: Database  
    # Short name for kubectl  
    shortNames:  
    - db  
  
  # Versions define the API evolution  
  versions:  
  - name: v1  
    # Served: API serves this version  
    served: true  
    # Storage: One version must be storage version  
    storage: true  
    schema:  
      openAPIV3Schema:  
        type: object  
        properties:  
          spec:  
            type: object  
            properties:  
              size:  
                type: string  
                pattern: '^[0-9]+Gi$'  
              replicas:  
                type: integer  
                minimum: 1  
                maximum: 10  
            required:  
            - size  
            - replicas  
          status:  
            type: object  
            properties:  
              phase:  
                type: string  
                enum:  
                - Pending  
                - Running  
                - Failed  
    # Additional printer columns for kubectl get  
    additionalPrinterColumns:  
    - name: Size  
      type: string  
      jsonPath: .spec.size  
    - name: Replicas  
      type: integer  
      jsonPath: .spec.replicas  
    - name: Status  
      type: string  
      jsonPath: .status.phase  
    - name: Age  
      type: date  
      jsonPath: .metadata.creationTimestamp

apiVersion: example.com/v1  
kind: Database  
metadata:  
  name: production-db  
  namespace: apps  
spec:  
  # Desired state  
  engine: postgresql  
  version: "14.5"  
  size: 500Gi  
  replicas: 3  
  backup:  
    enabled: true  
    schedule: "0 2 * * *"  
status:  
  # Actual state (written by controller)  
  phase: Running  
  endpoint: "postgres.example.com:5432"  
  lastBackup: "2025-10-31T02:00:00Z"

// Controller reconciliation function  
func (r *DatabaseReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {  
    // 1. Fetch the Custom Resource  
    db := &examplev1.Database{}  
    if err := r.Get(ctx, req.NamespacedName, db); err != nil {  
        if errors.IsNotFound(err) {  
            // Resource deleted, cleanup  
            return ctrl.Result{}, r.cleanup(ctx, req)  
        }  
        return ctrl.Result{}, err  
    }  
  
    // 2. Get current state  
    actualState, err := r.getCurrentDatabaseState(ctx, db)  
    if err != nil {  
        return ctrl.Result{}, err  
    }  
  
    // 3. Compare desired vs actual  
    if actualState.Replicas != db.Spec.Replicas {  
        // 4. Reconcile - scale database  
        if err := r.scaleDatabase(ctx, db, db.Spec.Replicas); err != nil {  
            // Requeue on error  
            return ctrl.Result{RequeueAfter: 30 * time.Second}, err  
        }  
    }  
  
    if actualState.Version != db.Spec.Version {  
        // Upgrade database version  
        if err := r.upgradeDatabase(ctx, db); err != nil {  
            return ctrl.Result{RequeueAfter: 60 * time.Second}, err  
        }  
    }  
  
    // 5. Update status subresource  
    db.Status.Phase = "Running"  
    db.Status.Endpoint = actualState.Endpoint  
    if err := r.Status().Update(ctx, db); err != nil {  
        return ctrl.Result{}, err  
    }  
  
    // Success - requeue periodically for drift detection  
    return ctrl.Result{RequeueAfter: 5 * time.Minute}, nil  
}

apiVersion: example.com/v1  
kind: Database  
metadata:  
  name: prod-db  
  generation: 5  # Increments on spec changes  
spec:  
  # What user wants  
  replicas: 3  
  version: "14.5"  
status:  
  # What controller observes  
  observedGeneration: 5  # Tracks which spec was reconciled  
  conditions:  
  - type: Ready  
    status: "True"  
    lastTransitionTime: "2025-10-31T10:00:00Z"  
    reason: AllReplicasReady  
    message: "3/3 replicas are running"  
  - type: BackupCompleted  
    status: "True"  
    lastTransitionTime: "2025-10-31T02:00:00Z"  
  replicas: 3  # Actual count  
  phase: Running

apiVersion: apiextensions.k8s.io/v1  
kind: CustomResourceDefinition  
metadata:  
  name: databases.example.com  
spec:  
  group: example.com  
  names:  
    kind: Database  
    plural: databases  
  scope: Namespaced  
  
  versions:  
  # Old version - still served for compatibility  
  - name: v1alpha1  
    served: true  # Accept requests  
    storage: false  # Not the storage version  
    deprecated: true  
    deprecationWarning: "v1alpha1 is deprecated, use v1"  
    schema:  
      openAPIV3Schema:  
        type: object  
        properties:  
          spec:  
            type: object  
            properties:  
              size:  
                type: string  
  
  # Current stable version  
  - name: v1  
    served: true  
    storage: true  # Only one version can be storage version  
    schema:  
      openAPIV3Schema:  
        type: object  
        properties:  
          spec:  
            type: object  
            properties:  
              storage:  # Renamed from 'size'  
                type: object  
                properties:  
                  size:  
                    type: string  
                  class:  
                    type: string  
              replicas:  
                type: integer  
                minimum: 1  
  
  # Conversion strategy  
  conversion:  
    strategy: Webhook  
    webhook:  
      clientConfig:  
        service:  
          namespace: system  
          name: conversion-webhook  
          path: /convert  
      conversionReviewVersions:  
      - v1  
      - v1beta1

schema:  
  openAPIV3Schema:  
    type: object  
    required:  # Mandatory fields  
    - spec  
    properties:  
      spec:  
        type: object  
        properties:  
          # String validation  
          name:  
            type: string  
            minLength: 3  
            maxLength: 63  
            pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$'  
  
          # Enum validation  
          tier:  
            type: string  
            enum:  
            - free  
            - premium  
            - enterprise  
  
          # Number validation  
          replicas:  
            type: integer  
            minimum: 1  
            maximum: 100  
            multipleOf: 1  
  
          storage:  
            type: string  
            pattern: '^[0-9]+(Gi|Ti)$'  
  
          # Object validation  
          backup:  
            type: object  
            required:  
            - schedule  
            properties:  
              schedule:  
                type: string  
                pattern: '^(@(annually|yearly|monthly|weekly|daily|hourly))|((((\d+,)+\d+|(\d+(\/|-)\d+)|\d+|\*) ?){5})$'  
              retention:  
                type: integer  
                minimum: 1  
                maximum: 365  
  
          # Array validation  
          regions:  
            type: array  
            minItems: 1  
            maxItems: 5  
            uniqueItems: true  
            items:  
              type: string  
              enum:  
              - us-east-1  
              - us-west-2  
              - eu-west-1  
  
          # Conditional validation (oneOf)  
          storageType:  
            type: string  
            enum:  
            - local  
            - cloud  
  
          storageConfig:  
            oneOf:  
            - properties:  
                storageType:  
                  const: local  
                path:  
                  type: string  
              required:  
              - path  
            - properties:  
                storageType:  
                  const: cloud  
                provider:  
                  type: string  
                bucket:  
                  type: string  
              required:  
              - provider  
              - bucket

# 1. Resource limits validation  
resources:  
  type: object  
  properties:  
    cpu:  
      type: string  
      pattern: '^[0-9]+(m|)$'  # 100m, 1, 2  
    memory:  
      type: string  
      pattern: '^[0-9]+(Mi|Gi)$'  # 512Mi, 2Gi  
  
# 2. Domain name validation  
domain:  
  type: string  
  pattern: '^([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}$'  
  
# 3. Semantic version validation  
version:  
  type: string  
  pattern: '^v?[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$'  
  
# 4. CIDR validation  
cidr:  
  type: string  
  pattern: '^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]{1,2}$'  
  
# 5. Default values  
enabled:  
  type: boolean  
  default: false  
  
# 6. Immutable fields (via CEL in Kubernetes 1.25+)  
x-kubernetes-validations:  
- rule: "self.name == oldSelf.name"  
  message: "name is immutable"

apiVersion: admissionregistration.k8s.io/v1  
kind: ValidatingWebhookConfiguration  
metadata:  
  name: database-validator  
webhooks:  
- name: validate.databases.example.com  
  clientConfig:  
    service:  
      namespace: database-system  
      name: webhook-service  
      path: /validate  
      port: 443  
    caBundle: <base64-encoded-ca-cert>  
  
  rules:  
  - apiGroups:  
    - example.com  
    apiVersions:  
    - v1  
    operations:  
    - CREATE  
    - UPDATE  
    resources:  
    - databases  
    scope: Namespaced  
  
  admissionReviewVersions:  
  - v1  
  - v1beta1  
  
  sideEffects: None  
  timeoutSeconds: 10  
  failurePolicy: Fail  # or Ignore  
  
  namespaceSelector:  
    matchLabels:  
      environment: production

func (h *DatabaseValidator) Handle(ctx context.Context, req admission.Request) admission.Response {  
    db := &Database{}  
    if err := json.Unmarshal(req.Object.Raw, db); err != nil {  
        return admission.Errored(http.StatusBadRequest, err)  
    }  
  
    // Business logic validation  
  
    // 1. Check quota  
    if db.Spec.Replicas > h.maxReplicasPerNamespace {  
        return admission.Denied(fmt.Sprintf(  
            "Replica count %d exceeds namespace limit %d",  
            db.Spec.Replicas, h.maxReplicasPerNamespace,  
        ))  
    }  
  
    // 2. Validate resource availability  
    totalStorage := h.calculateNamespaceStorage(ctx, req.Namespace)  
    requestedStorage := parseStorage(db.Spec.Size)  
    if totalStorage + requestedStorage > h.namespaceQuota {  
        return admission.Denied("Storage quota exceeded")  
    }  
  
    // 3. Cross-field validation  
    if db.Spec.Tier == "free" && db.Spec.Replicas > 1 {  
        return admission.Denied("Free tier does not support replication")  
    }  
  
    // 4. External validation (e.g., license check)  
    if db.Spec.Tier == "enterprise" {  
        if !h.validateLicense(ctx, req.Namespace) {  
            return admission.Denied("No valid enterprise license found")  
        }  
    }  
  
    // 5. Immutability check on UPDATE  
    if req.Operation == admissionv1.Update {  
        oldDB := &Database{}  
        json.Unmarshal(req.OldObject.Raw, oldDB)  
  
        if db.Spec.Engine != oldDB.Spec.Engine {  
            return admission.Denied("Cannot change database engine")  
        }  
    }  
  
    return admission.Allowed("")  
}

func (h *DatabaseDefaulter) Handle(ctx context.Context, req admission.Request) admission.Response {  
    db := &Database{}  
    if err := json.Unmarshal(req.Object.Raw, db); err != nil {  
        return admission.Errored(http.StatusBadRequest, err)  
    }  
  
    // Apply defaults  
    if db.Spec.Version == "" {  
        db.Spec.Version = h.defaultVersion  // e.g., "14.5"  
    }  
  
    if db.Spec.Replicas == 0 {  
        db.Spec.Replicas = 1  
    }  
  
    // Inject labels  
    if db.Labels == nil {  
        db.Labels = make(map[string]string)  
    }  
    db.Labels["managed-by"] = "database-operator"  
    db.Labels["tier"] = db.Spec.Tier  
  
    // Add annotations  
    if db.Annotations == nil {  
        db.Annotations = make(map[string]string)  
    }  
    db.Annotations["last-defaulted"] = time.Now().Format(time.RFC3339)  
  
    // Marshal modified object  
    marshaledDB, err := json.Marshal(db)  
    if err != nil {  
        return admission.Errored(http.StatusInternalServerError, err)  
    }  
  
    // Return patch  
    return admission.PatchResponseFromRaw(req.Object.Raw, marshaledDB)  
}

versions:  
- name: v1  
  served: true  
  storage: true  
  schema:  
    # ... schema definition ...  
  
  # Enable status subresource  
  subresources:  
    status: {}

// User updates spec  
db.Spec.Replicas = 5  
client.Update(ctx, db)  // Updates spec only  
  
// Controller updates status  
db.Status.Phase = "Scaling"  
db.Status.Replicas = 3  
client.Status().Update(ctx, db)  // Updates status only

subresources:  
  status: {}  
  scale:  
    # Path to replica count in spec  
    specReplicasPath: .spec.replicas  
    # Path to replica count in status  
    statusReplicasPath: .status.replicas  
    # Optional: label selector path  
    labelSelectorPath: .status.labelSelector

kubectl scale database/my-db --replicas=10  
kubectl autoscale database/my-db --min=3 --max=20 --cpu-percent=75

apiVersion: apiextensions.k8s.io/v1  
kind: CustomResourceDefinition  
metadata:  
  name: appconfigs.config.example.com  
spec:  
  group: config.example.com  
  names:  
    kind: AppConfig  
    plural: appconfigs  
    singular: appconfig  
  scope: Namespaced  
  versions:  
  - name: v1  
    served: true  
    storage: true  
    schema:  
      openAPIV3Schema:  
        type: object  
        properties:  
          spec:  
            type: object  
            properties:  
              application:  
                type: string  
              environment:  
                type: string  
                enum: [dev, staging, production]  
              config:  
                type: object  
                x-kubernetes-preserve-unknown-fields: true  
              secretRefs:  
                type: array  
                items:  
                  type: string

apiVersion: config.example.com/v1  
kind: AppConfig  
metadata:  
  name: frontend-prod  
  namespace: production  
spec:  
  application: frontend  
  environment: production  
  config:  
    apiEndpoint: https://api.example.com  
    features:  
      newUI: true  
      betaFeatures: false  
    cache:  
      ttl: 3600  
      maxSize: 1000  
  secretRefs:  
  - api-credentials  
  - oauth-config

func (r *AppConfigReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {  
    config := &AppConfig{}  
    if err := r.Get(ctx, req.NamespacedName, config); err != nil {  
        return ctrl.Result{}, client.IgnoreNotFound(err)  
    }  
  
    // 1. Generate ConfigMap from config  
    configMap := &corev1.ConfigMap{  
        ObjectMeta: metav1.ObjectMeta{  
            Name:      config.Name + "-config",  
            Namespace: config.Namespace,  
            OwnerReferences: []metav1.OwnerReference{  
                *metav1.NewControllerRef(config, AppConfigGVK),  
            },  
        },  
        Data: map[string]string{  
            "config.json": marshalConfig(config.Spec.Config),  
        },  
    }  
  
    if err := r.CreateOrUpdate(ctx, configMap); err != nil {  
        return ctrl.Result{}, err  
    }  
  
    // 2. Validate secret references  
    for _, secretName := range config.Spec.SecretRefs {  
        secret := &corev1.Secret{}  
        if err := r.Get(ctx, client.ObjectKey{  
            Name: secretName,  
            Namespace: config.Namespace,  
        }, secret); err != nil {  
            config.Status.Conditions = append(config.Status.Conditions, Condition{  
                Type: "SecretReady",  
                Status: "False",  
                Reason: "SecretNotFound",  
                Message: fmt.Sprintf("Secret %s not found", secretName),  
            })  
            return ctrl.Result{RequeueAfter: 30 * time.Second}, nil  
        }  
    }  
  
    // 3. Update status  
    config.Status.Phase = "Ready"  
    config.Status.ConfigMapName = configMap.Name  
    r.Status().Update(ctx, config)  
  
    return ctrl.Result{RequeueAfter: 5 * time.Minute}, nil  
}

func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {  
    // ✅ Good: Check if resource exists  
    configMap := &corev1.ConfigMap{}  
    err := r.Get(ctx, client.ObjectKey{  
        Name:      "my-config",  
        Namespace: req.Namespace,  
    }, configMap)  
  
    if errors.IsNotFound(err) {  
        // Create only if doesn't exist  
        configMap = buildConfigMap()  
        return ctrl.Result{}, r.Create(ctx, configMap)  
    }  
  
    // ❌ Bad: Always create  
    // return ctrl.Result{}, r.Create(ctx, buildConfigMap())  
    // This will fail on subsequent reconciliations  
}

// Set owner reference for automatic cleanup  
func (r *Reconciler) createChildResource(ctx context.Context, parent *MyResource) error {  
    child := &corev1.ConfigMap{  
        ObjectMeta: metav1.ObjectMeta{  
            Name:      parent.Name + "-config",  
            Namespace: parent.Namespace,  
        },  
        Data: map[string]string{  
            "key": "value",  
        },  
    }  
  
    // Set owner reference - when parent is deleted, child is auto-deleted  
    if err := controllerutil.SetControllerReference(parent, child, r.Scheme); err != nil {  
        return err  
    }  
  
    return r.Create(ctx, child)  
}

apiVersion: v1  
kind: ConfigMap  
metadata:  
  name: my-resource-config  
  namespace: default  
  ownerReferences:  
  - apiVersion: example.com/v1  
    kind: MyResource  
    name: my-resource  
    uid: 12345-67890  
    controller: true  
    blockOwnerDeletion: true  
data:  
  key: value

const finalizerName = "example.com/finalizer"  
  
func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {  
    resource := &MyResource{}  
    if err := r.Get(ctx, req.NamespacedName, resource); err != nil {  
        return ctrl.Result{}, client.IgnoreNotFound(err)  
    }  
  
    // Handle deletion  
    if !resource.DeletionTimestamp.IsZero() {  
        if controllerutil.ContainsFinalizer(resource, finalizerName) {  
            // Perform cleanup (e.g., delete external resources)  
            if err := r.cleanupExternalResources(ctx, resource); err != nil {  
                return ctrl.Result{}, err  
            }  
  
            // Remove finalizer  
            controllerutil.RemoveFinalizer(resource, finalizerName)  
            if err := r.Update(ctx, resource); err != nil {  
                return ctrl.Result{}, err  
            }  
        }  
        return ctrl.Result{}, nil  
    }  
  
    // Add finalizer if not present  
    if !controllerutil.ContainsFinalizer(resource, finalizerName) {  
        controllerutil.AddFinalizer(resource, finalizerName)  
        if err := r.Update(ctx, resource); err != nil {  
            return ctrl.Result{}, err  
        }  
    }  
  
    // Normal reconciliation logic...  
    return ctrl.Result{}, nil  
}

func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {  
    // 1. Success - don't requeue  
    return ctrl.Result{}, nil  
  
    // 2. Success - requeue after delay (periodic reconciliation)  
    return ctrl.Result{RequeueAfter: 5 * time.Minute}, nil  
  
    // 3. Error - requeue with exponential backoff (automatic)  
    return ctrl.Result{}, fmt.Errorf("temporary error")  
  
    // 4. Immediate requeue  
    return ctrl.Result{Requeue: true}, nil  
  
    // 5. Conditional requeue  
    if resource.Status.Phase == "Pending" {  
        // Requeue quickly during provisioning  
        return ctrl.Result{RequeueAfter: 10 * time.Second}, nil  
    }  
    // Slower requeue for stable resources  
    return ctrl.Result{RequeueAfter: 5 * time.Minute}, nil  
}

# Initialize project  
operator-sdk init --domain example.com --repo github.com/example/my-operator  
  
# Create API and controller  
operator-sdk create api --group apps --version v1 --kind MyApp --resource --controller  
  
# Generate CRD manifests  
make manifests  
  
# Install CRDs  
make install  
  
# Run locally  
make run  
  
# Build and push image  
make docker-build docker-push IMG=example.com/my-operator:v1.0.0  
  
# Deploy to cluster  
make deploy IMG=example.com/my-operator:v1.0.0

// ❌ Bad: Fetch everything on every reconciliation  
func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {  
    resource := &MyResource{}  
    r.Get(ctx, req.NamespacedName, resource)  
  
    // Fetch all pods every time  
    podList := &corev1.PodList{}  
    r.List(ctx, podList, client.InNamespace(req.Namespace))  
  
    for _, pod := range podList.Items {  
        // Process each pod...  
    }  
}  
  
// ✅ Good: Use label selectors and owner references  
func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {  
    resource := &MyResource{}  
    r.Get(ctx, req.NamespacedName, resource)  
  
    // Only fetch related pods  
    podList := &corev1.PodList{}  
    r.List(ctx, podList,  
        client.InNamespace(req.Namespace),  
        client.MatchingLabels{"app": resource.Name},  
    )  
  
    // Even better: use owner reference filtering  
    ownedPods := &corev1.PodList{}  
    r.List(ctx, ownedPods,  
        client.InNamespace(req.Namespace),  
        client.MatchingFields{"metadata.ownerReferences.uid": string(resource.UID)},  
    )  
}

import (  
    "sigs.k8s.io/controller-runtime/pkg/predicate"  
)  
  
func (r *Reconciler) SetupWithManager(mgr ctrl.Manager) error {  
    return ctrl.NewControllerManagedBy(mgr).  
        For(&MyResource{}).  
        WithEventFilter(predicate.Funcs{  
            // Only reconcile on spec changes, not status  
            UpdateFunc: func(e event.UpdateEvent) bool {  
                oldObj := e.ObjectOld.(*MyResource)  
                newObj := e.ObjectNew.(*MyResource)  
                return !reflect.DeepEqual(oldObj.Spec, newObj.Spec)  
            },  
            // Ignore deletion events if no finalizers  
            DeleteFunc: func(e event.DeleteEvent) bool {  
                return len(e.Object.GetFinalizers()) > 0  
            },  
        }).  
        Complete(r)  
}

import (  
    "golang.org/x/time/rate"  
    "k8s.io/client-go/util/workqueue"  
)  
  
func main() {  
    mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{  
        // Controller-specific rate limiter  
        Controller: ctrl.ControllerOptions{  
            MaxConcurrentReconciles: 10,  // Worker pool size  
            RateLimiter: workqueue.NewMaxOfRateLimiter(  
                // Base rate: 10 req/sec, burst 100  
                workqueue.NewItemExponentialFailureRateLimiter(5*time.Millisecond, 1000*time.Second),  
                &workqueue.BucketRateLimiter{Limiter: rate.NewLimiter(rate.Limit(10), 100)},  
            ),  
        },  
    })  
}

// ❌ Bad: Update resources one by one  
for _, obj := range objects {  
    if err := r.Update(ctx, obj); err != nil {  
        return err  
    }  
}  
  
// ✅ Good: Use batch operations or strategic merge  
patch := client.MergeFrom(oldObj.DeepCopy())  
newObj.Spec.Replicas = 5  
if err := r.Patch(ctx, newObj, patch); err != nil {  
    return err  
}

# Namespace-scoped CRD  
spec:  
  scope: Namespaced  
  # Resources exist within namespaces  
  # RBAC can be namespace-specific  
  # Good for: application-level resources  
  
# Cluster-scoped CRD  
spec:  
  scope: Cluster  
  # Resources are cluster-wide  
  # Requires cluster-level permissions  
  # Good for: infrastructure resources (storage classes, nodes)

# Role allowing users to manage their own databases  
apiVersion: rbac.authorization.k8s.io/v1  
kind: Role  
metadata:  
  name: database-admin  
  namespace: team-a  
rules:  
- apiGroups: ["db.example.com"]  
  resources: ["databases"]  
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]  
  
---  
# Operator needs cluster-wide view  
apiVersion: rbac.authorization.k8s.io/v1  
kind: ClusterRole  
metadata:  
  name: database-operator  
rules:  
- apiGroups: ["db.example.com"]  
  resources: ["databases"]  
  verbs: ["get", "list", "watch", "create", "update", "patch"]  
- apiGroups: ["db.example.com"]  
  resources: ["databases/status"]  
  verbs: ["get", "update", "patch"]  
- apiGroups: ["apps"]  
  resources: ["statefulsets"]  
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

// Watch only specific namespaces  
func (r *Reconciler) SetupWithManager(mgr ctrl.Manager) error {  
    return ctrl.NewControllerManagedBy(mgr).  
        For(&MyResource{}).  
        WithEventFilter(predicate.NewPredicateFuncs(func(obj client.Object) bool {  
            // Only reconcile resources in allowed namespaces  
            allowedNamespaces := []string{"prod", "staging"}  
            for _, ns := range allowedNamespaces {  
                if obj.GetNamespace() == ns {  
                    return true  
                }  
            }  
            return false  
        })).  
        Complete(r)  
}