From 51d8101e299b313731de43fa1cbab3ee7e810dd3 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Wed, 1 Oct 2025 10:00:37 -0400
Subject: [PATCH 1/2] Prevent MatchingActiveLeases selector from shadowing
 label selector

---
 internal/controller/exporter_controller.go   | 5 ++++-
 internal/controller/lease.go                 | 7 ++-----
 internal/controller/lease_controller.go      | 4 +++-
 internal/service/client/v1/client_service.go | 4 ++--
 internal/service/controller_service.go       | 5 ++++-
 5 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/internal/controller/exporter_controller.go b/internal/controller/exporter_controller.go
index 0862f77c..8bc3870b 100644
--- a/internal/controller/exporter_controller.go
+++ b/internal/controller/exporter_controller.go
@@ -24,6 +24,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -117,7 +118,9 @@ func (r *ExporterReconciler) reconcileStatusLeaseRef(
 		ctx,
 		&leases,
 		client.InNamespace(exporter.Namespace),
-		MatchingActiveLeases(),
+		client.MatchingLabelsSelector{
+			Selector: MatchingActiveLeases(labels.Everything()),
+		},
 	); err != nil {
 		return fmt.Errorf("reconcileStatusLeaseRef: failed to list active leases: %w", err)
 	}
diff --git a/internal/controller/lease.go b/internal/controller/lease.go
index 83a96bd7..cd46ebf0 100644
--- a/internal/controller/lease.go
+++ b/internal/controller/lease.go
@@ -4,12 +4,11 @@ import (
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/selection"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	jumpstarterdevv1alpha1 "github.com/jumpstarter-dev/jumpstarter-controller/api/v1alpha1"
 )
 
-func MatchingActiveLeases() client.ListOption {
+func MatchingActiveLeases(prev labels.Selector) labels.Selector {
 	// TODO: use field selector once KEP-4358 is stabilized
 	// Reference: https://github.com/kubernetes/kubernetes/pull/122717
 	requirement, err := labels.NewRequirement(
@@ -20,7 +19,5 @@ func MatchingActiveLeases() client.ListOption {
 
 	utilruntime.Must(err)
 
-	return client.MatchingLabelsSelector{
-		Selector: labels.Everything().Add(*requirement),
-	}
+	return prev.Add(*requirement)
 }
diff --git a/internal/controller/lease_controller.go b/internal/controller/lease_controller.go
index bcb548fc..6b87c90e 100644
--- a/internal/controller/lease_controller.go
+++ b/internal/controller/lease_controller.go
@@ -377,7 +377,9 @@ func (r *LeaseReconciler) ListActiveLeases(ctx context.Context, namespace string
 		ctx,
 		&activeLeases,
 		client.InNamespace(namespace),
-		MatchingActiveLeases(),
+		client.MatchingLabelsSelector{
+			Selector: MatchingActiveLeases(labels.Everything()),
+		},
 	); err != nil {
 		return nil, err
 	}
diff --git a/internal/service/client/v1/client_service.go b/internal/service/client/v1/client_service.go
index 76e4f8cb..597200e1 100644
--- a/internal/service/client/v1/client_service.go
+++ b/internal/service/client/v1/client_service.go
@@ -138,10 +138,10 @@ func (s *ClientService) ListLeases(ctx context.Context, req *cpb.ListLeasesReque
 	var jleases jumpstarterdevv1alpha1.LeaseList
 	if err := s.List(ctx, &jleases, &kclient.ListOptions{
 		Namespace:     namespace,
-		LabelSelector: selector,
+		LabelSelector: controller.MatchingActiveLeases(selector),
 		Limit:         int64(req.PageSize),
 		Continue:      req.PageToken,
-	}, controller.MatchingActiveLeases()); err != nil {
+	}); err != nil {
 		return nil, err
 	}
 
diff --git a/internal/service/controller_service.go b/internal/service/controller_service.go
index b85f4478..5b8eb698 100644
--- a/internal/service/controller_service.go
+++ b/internal/service/controller_service.go
@@ -54,6 +54,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
 	k8suuid "k8s.io/apimachinery/pkg/util/uuid"
@@ -670,7 +671,9 @@ func (s *ControllerService) ListLeases(
 		ctx,
 		&leases,
 		client.InNamespace(jclient.Namespace),
-		controller.MatchingActiveLeases(),
+		client.MatchingLabelsSelector{
+			Selector: controller.MatchingActiveLeases(labels.Everything()),
+		},
 	); err != nil {
 		return nil, err
 	}

From 8885f21631604aea8c1c4fb29bdf9a503fc5fb5d Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Wed, 1 Oct 2025 10:12:29 -0400
Subject: [PATCH 2/2] [HACK]

---
 .github/workflows/e2e.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
index 495c94cd..4bdd1426 100644
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -14,7 +14,7 @@ jobs:
           - ubuntu-24.04-arm
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: jumpstarter-dev/jumpstarter-e2e@main
+      - uses: jumpstarter-dev/jumpstarter-e2e@lease-selector
         with:
           controller-ref: ${{ github.ref }}
           # use the matching branch on the jumpstarter repo