fix(destination): Add namespace restriction to external workloads and endpoints

controller/api/destination/external-workload/endpoints_controller.go

@@ -373,7 +373,8 @@ func (ec *EndpointsController) syncService(update string) error {
 	}
 
 	ewSelector := labels.Set(svc.Spec.Selector).AsSelectorPreValidated()
-	ews, err := ec.k8sAPI.ExtWorkload().Lister().List(ewSelector)
+	ews, err := ec.k8sAPI.ExtWorkload().Lister().
+		ExternalWorkloads(namespace).List(ewSelector)
 	if err != nil {
 		// This operation should be infallible since we retrieve from the cache
 		// (we can guarantee we will receive at least an empty list), for good
@@ -385,7 +386,8 @@ func (ec *EndpointsController) syncService(update string) error {
 		discoveryv1.LabelServiceName: svc.Name,
 		discoveryv1.LabelManagedBy:   managedBy,
 	}).AsSelectorPreValidated()
-	epSlices, err := ec.k8sAPI.ES().Lister().List(esSelector)
+	epSlices, err := ec.k8sAPI.ES().Lister().
+		EndpointSlices(namespace).List(esSelector)
 	if err != nil {
 		return err
 	}

controller/api/destination/external-workload/endpoints_controller_test.go

@@ -238,10 +238,16 @@ func TestSyncServiceExternalWorkloadSelection(t *testing.T) {
 	ew2.Labels["foo"] = "boo"
 	esController.externalWorkloadsStore.Add(ew2)
 
+	// ensure this ew will not match the selector
+	altNs := "test-ns-alt"
+	ew3 := newExternalWorkload(3, altNs, true, false)
+	esController.externalWorkloadsStore.Add(ew3)
+
 	standardSyncService(t, esController, ns, "testing-1")
 	expectActions(t, actions(), 1, "create", "endpointslices")
 
-	// an endpoint slice should be created, it should only reference ew1 (not ew2)
+	// an endpoint slice should be created, it should only reference ew1 (not
+	// ew2 and not ew3)
 	slices, err := client.Client.DiscoveryV1().EndpointSlices(ns).List(context.TODO(), metav1.ListOptions{})
 	if err != nil {
 		t.Errorf("Expected no error fetching endpoint slices, got: %s", err)

justfile

@@ -263,7 +263,7 @@ _k3d-dns-ready:
 # If DOCKER_REGISTRY is not already set, use a bogus registry with a unique
 # name so that it's virtually impossible to accidentally use an incorrect image.
 export DOCKER_REGISTRY := env_var_or_default("DOCKER_REGISTRY", "test.l5d.io/" + _test-id )
-_test-id := `tr -dc 'a-z0-9' </dev/urandom | fold -w 5 | head -n 1`
+_test-id := choose('5', HEX)
 
 # The docker image tag.
 linkerd-tag := `bin/root-tag`