fix: apply namespaced resources only to instances in the same namespace

api/v1beta1/grafananotificationpolicy_types.go

@@ -43,6 +43,10 @@ type GrafanaNotificationPolicySpec struct {
 	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Value is immutable"
 	// +optional
 	Editable *bool `json:"editable,omitempty"`
+
+	// allow to import this resource into a Grafana instance in a different namespace
+	// +optional
+	AllowCrossNamespaceImport *bool `json:"allowCrossNamespaceImport,omitempty"`
 }
 
 type Route struct {
@@ -165,6 +169,13 @@ type GrafanaNotificationPolicyList struct {
 	Items           []GrafanaNotificationPolicy `json:"items"`
 }
 
+func (np *GrafanaNotificationPolicy) IsAllowCrossNamespaceImport() bool {
+	if np.Spec.AllowCrossNamespaceImport != nil {
+		return *np.Spec.AllowCrossNamespaceImport
+	}
+	return false
+}
+
 func init() {
 	SchemeBuilder.Register(&GrafanaNotificationPolicy{}, &GrafanaNotificationPolicyList{})
 }

config/crd/bases/grafana.integreatly.org_grafananotificationpolicies.yaml

@@ -43,6 +43,10 @@ spec:
             description: GrafanaNotificationPolicySpec defines the desired state of
               GrafanaNotificationPolicy
             properties:
+              allowCrossNamespaceImport:
+                description: allow to import this resource into a Grafana instance
+                  in a different namespace
+                type: boolean
               editable:
                 description: Whether to enable or disable editing of the notification
                   policy in Grafana UI

controllers/dashboard_controller.go

@@ -238,12 +238,13 @@ func (r *GrafanaDashboardReconciler) Reconcile(ctx context.Context, req ctrl.Req
 	success := true
 	applyErrors := make(map[string]string)
 	for _, grafana := range instances.Items {
+		grafana := grafana
+
 		// check if this is a cross namespace import
 		if grafana.Namespace != cr.Namespace && !cr.IsAllowCrossNamespaceImport() {
 			continue
 		}
 
-		grafana := grafana
 		// an admin url is required to interact with grafana
 		// the instance or route might not yet be ready
 		if grafana.Status.Stage != v1beta1.OperatorStageComplete || grafana.Status.StageStatus != v1beta1.OperatorStageResultSuccess {

controllers/datasource_controller.go

@@ -220,12 +220,13 @@ func (r *GrafanaDatasourceReconciler) Reconcile(ctx context.Context, req ctrl.Re
 
 	success := true
 	for _, grafana := range instances.Items {
+		grafana := grafana
+
 		// check if this is a cross namespace import
 		if grafana.Namespace != cr.Namespace && !cr.IsAllowCrossNamespaceImport() {
 			continue
 		}
 
-		grafana := grafana
 		// an admin url is required to interact with grafana
 		// the instance or route might not yet be ready
 		if grafana.Status.Stage != v1beta1.OperatorStageComplete || grafana.Status.StageStatus != v1beta1.OperatorStageResultSuccess {

controllers/grafanafolder_controller.go

@@ -211,12 +211,13 @@ func (r *GrafanaFolderReconciler) Reconcile(ctx context.Context, req ctrl.Reques
 
 	applyErrors := make(map[string]string)
 	for _, grafana := range instances.Items {
+		grafana := grafana
+
 		// check if this is a cross namespace import
 		if grafana.Namespace != folder.Namespace && !folder.IsAllowCrossNamespaceImport() {
 			continue
 		}
 
-		grafana := grafana
 		if grafana.Status.Stage != grafanav1beta1.OperatorStageComplete || grafana.Status.StageStatus != grafanav1beta1.OperatorStageResultSuccess {
 			controllerLog.Info("grafana instance not ready", "grafana", grafana.Name)
 			continue

controllers/notificationpolicy_controller.go

@@ -128,6 +128,12 @@ func (r *GrafanaNotificationPolicyReconciler) Reconcile(ctx context.Context, req
 	for _, grafana := range instances.Items {
 		// can be removed in go 1.22+
 		grafana := grafana
+
+		// check if this is a cross namespace import
+		if grafana.Namespace != notificationPolicy.Namespace && !notificationPolicy.IsAllowCrossNamespaceImport() {
+			continue
+		}
+
 		appliedPolicy := grafana.Annotations[annotationAppliedNotificationPolicy]
 		if appliedPolicy != "" && appliedPolicy != notificationPolicy.NamespacedResource() {
 			controllerLog.Info("instance already has a different notification policy applied - skipping", "grafana", grafana.Name)

deploy/helm/grafana-operator/crds/grafana.integreatly.org_grafananotificationpolicies.yaml

@@ -43,6 +43,10 @@ spec:
             description: GrafanaNotificationPolicySpec defines the desired state of
               GrafanaNotificationPolicy
             properties:
+              allowCrossNamespaceImport:
+                description: allow to import this resource into a Grafana instance
+                  in a different namespace
+                type: boolean
               editable:
                 description: Whether to enable or disable editing of the notification
                   policy in Grafana UI

deploy/kustomize/base/crds.yaml

@@ -1617,6 +1617,10 @@ spec:
             description: GrafanaNotificationPolicySpec defines the desired state of
               GrafanaNotificationPolicy
             properties:
+              allowCrossNamespaceImport:
+                description: allow to import this resource into a Grafana instance
+                  in a different namespace
+                type: boolean
               editable:
                 description: Whether to enable or disable editing of the notification
                   policy in Grafana UI

docs/docs/api.md

@@ -3250,6 +3250,13 @@ GrafanaNotificationPolicySpec defines the desired state of GrafanaNotificationPo
           Routes for alerts to match against<br/>
         </td>
         <td>true</td>
+      </tr><tr>
+        <td><b>allowCrossNamespaceImport</b></td>
+        <td>boolean</td>
+        <td>
+          allow to import this resource into a Grafana instance in a different namespace<br/>
+        </td>
+        <td>false</td>
       </tr><tr>
         <td><b>editable</b></td>
         <td>boolean</td>