Repository: Azure/ARO-RP
Pull request #1994 (2022-03-04 00:44:47)

Added a new function for a hardcoded filter of namespaces
### Which issue this PR addresses:

Implemented a hardcoded filter of namespace: Check the [ADO work item](https://msazure.visualstudio.com/AzureRedHatOpenShift/_boards/board/t/Skippy/Stories/?workitem=12682885) for the details

### What this PR does / why we need it:

- We use the filtering in code in ARO-RP to reduce metrics generated and send to Geneva, and inside Geneva Monitoring to reduce the number of customer-generated-alerts
- Since the list of namespaces is not changing often and there is a chance of unwanted namespaces to be included in the list if we autogenerate it from a release, so it makes sense to hardcode the list in go code for now.
- The list of the hardcoded namespaces are mainly based on the items in the [ConfigMap]( https://github.com/openshift/managed-cluster-config/blob/ade1697fd61ff033f8fe24134df6bba3a390a000/deploy/osd-managed-resources/ocp-namespaces.ConfigMap.yaml) and 2 additional namespaces `openshift-azure-operator` and `openshift-managed-upgrade-operator`. 

### Test plan for issue:
Added an unit test for the new function of hardcoded filter in `namespace_test.go`

### Is there any documentation that needs to be updated for this PR?

No, this PR is based on an [ADO work item](https://msazure.visualstudio.com/AzureRedHatOpenShift/_boards/board/t/Skippy/Stories/?workitem=12682885) we have discussed

> > Let's do something more intelligent for ensuring that when we release a new minor version, we're including the newest namespaces that upstream OCP may be introducing.
> > Write an e2e test which fetches all the namespaces within a newly created cluster, and then ensures that each namespace (with the sole exception of default) returns true from this function.
> 
> @bennerv I wanted this work item to be a quick win so we have better filtering. I believe namespaces do not change often, but I agree - it is a good idea to update `upstream-differences.md`. Let's look at this as a first iteration. So in this PR I would like to see:
> 
> * More precise filtering in the simplest way possible
> * Updated vendoring documentation
> 
> Next iteration could be something like this:
> 
> * Extract namespaces from a OCP release (similar to what OSD is doing [here](https://github.com/openshift/managed-cluster-config/blob/1d5397c516289da8f3ef4fc4c8ab306566ba8b8a/scripts/managed-resources/generate-managed-list.py#L44-L75)) and mix them with ARO-specific namespaces.
> * Update the filtering to use generated list for filtering
> 
> The tricky bit here is that we will soon-ish be looking into adding support of multiple OCP versions via Hive and I don't know how it is going to work just yet. So probably it is not worth implementing extraction right now.

@m1kola - I just created another draft PR based on the review feedback, since you created the work item and should know more context, please help to review first to see if it's what you need, then I can I request other teammates to review further

microsoft-cla[bot]: [![CLA assistant check](https://cla.opensource.microsoft.com/pull/badge/not_signed)](https://cla.opensource.microsoft.com/Azure/ARO-RP?pullRequest=1994) <br/>Thank you for your submission, we really appreciate it. Like many open source projects, we ask that you sign our [Contributor License Agreement](https://cla.opensource.microsoft.com/Azure/ARO-RP?pullRequest=1994) before we can accept your contribution.<br/><br/>:x: xiaoyu74 [sign now](https://cla.opensource.microsoft.com/Azure/ARO-RP?pullRequest=1994)<br/><sub>You have signed the CLA already but the status is still pending? Let us [recheck](https://cla.opensource.microsoft.com/check/Azure/ARO-RP?pullRequest=1994) it.</sub>
bryanro92: /azp run ci
bryanro92: /azp run e2e
azure-pipelines[bot]: <samp>
Azure Pipelines successfully started running 1 pipeline(s).<br>

</samp>
azure-pipelines[bot]: <samp>
Azure Pipelines successfully started running 1 pipeline(s).<br>

</samp>
xiaoyu74: > Few nits.
> 
> Additionally, we will have to update our vendoring documentation and ensure that we update this list of namespaces whenever there is a new minor version. Every minor version upstream OCP seems to release a new namespace or two.

Sorry, what's the vendoring documentation and how should I update it ? 
bennerv: > Sorry, what's the vendoring documentation and how should I update it ?

https://github.com/Azure/ARO-RP/blob/master/docs/upstream-differences.md
bennerv: One more comment.

We're introducing a new function, but not actually using it anywhere.  Does this story include the work to utilize this new function as well? If so, please make the appropriate updates here as well.  
xiaoyu74: > One more comment.
> 
> We're introducing a new function, but not actually using it anywhere. Does this story include the work to utilize this new function as well? If so, please make the appropriate updates here as well.

I think this [work-item-12682885](https://msazure.visualstudio.com/AzureRedHatOpenShift/_workitems/edit/12682885) is just to implement a new function of a hardcoded filter of namespaces, @m1kola should have another work item which depends on it, will double check with him. 
xiaoyu74: > Could you please move changes into #1994 and close this PR? We had quite a lot of discussions around how this should be implemented in the original PR and preserving this history might be useful for the future iterations around filtering.

Hi @m1kola , do you want to me to move the changes from the draft PR #1999 to this #1994 and close this #1994 which means we don't need to implement this hardcoded filter of namespaces for now ? 
xiaoyu74: Submitted a new commit based on @m1kola clarifications, just a brief summary about the new commit:
- Implemented a more precise hardcoded filtering function with the specified namespaces we care about
- Removed the previous filtering functions in the namespace.go and updated the unit test.
- Updated the vendoring documentation
- Applied the new filtering function to the monitor
xiaoyu74: @m1kola - As you mentioned we will need to replace the previous filtering functions with the new I created which means I need to do some extra work to update the unit tests and other monitoring code rely on the new function to make the CI pipeline works. (I used to just appended the new function and keep the previous functions so we don't have to update anything as I remember you want to use the new function in the next iteration). 

So, it's still what we want to replace the previous filtering right ? So I will update the code relying on the new function accordingly.

xiaoyu74: The CI pipeline has passed. Need to do some debugging on the E2E test failed 
xiaoyu74: @m1kola - I have replaced the filtering with the new hard-coded one and fixed the CI and E2E test issues and it's all passed now. Please feel free to review. 

One thing I need to your help is to check if the current hard-coded list of the namespaces are all what we exactly care about or we need to append some more. Thanks.
xiaoyu74: @m1kola @gvanderpotte - Any updates about this PR ?  Looking forward to getting your feedback. Thanks

Patch:
diff --git a/docs/upstream-differences.md b/docs/upstream-differences.md
index 1dbc92a10..f42a9a2c3 100644
--- a/docs/upstream-differences.md
+++ b/docs/upstream-differences.md
@@ -88,3 +88,5 @@ Once installer fork is ready:
 1. After this point, you should be able to create a dev cluster using the RP and it should use the new release.
 1. `make discoverycache`.
     * This command requires a running cluster with the new version.
+1. The list of the hard-coded namespaces in `pkg/util/namespace/namespace.go` needs to be updated regularly as every
+   minor version of upstream OCP introduces a new namespace or two.
\ No newline at end of file
diff --git a/pkg/frontend/validate.go b/pkg/frontend/validate.go
index 71c4defb8..bd804995e 100644
--- a/pkg/frontend/validate.go
+++ b/pkg/frontend/validate.go
@@ -77,7 +77,7 @@ func (f *frontend) validateOpenShiftUniqueKey(ctx context.Context, doc *api.Open
 var rxKubernetesString = regexp.MustCompile(`(?i)^[-a-z0-9.]{0,255}$`)
 
 func validateAdminKubernetesObjectsNonCustomer(method, groupKind, namespace, name string) error {
-	if !utilnamespace.IsOpenShift(namespace) {
+	if !utilnamespace.IsOpenShiftNamespace(namespace) {
 		return api.NewCloudError(http.StatusForbidden, api.CloudErrorCodeForbidden, "", "Access to the provided namespace '%s' is forbidden.", namespace)
 	}
 
diff --git a/pkg/monitor/cluster/daemonsetstatuses.go b/pkg/monitor/cluster/daemonsetstatuses.go
index d4523ce81..de8f3e823 100644
--- a/pkg/monitor/cluster/daemonsetstatuses.go
+++ b/pkg/monitor/cluster/daemonsetstatuses.go
@@ -24,7 +24,7 @@ func (mon *Monitor) emitDaemonsetStatuses(ctx context.Context) error {
 		count += int64(len(dss.Items))
 
 		for _, ds := range dss.Items {
-			if !namespace.IsOpenShift(ds.Namespace) {
+			if !namespace.IsOpenShiftNamespace(ds.Namespace) {
 				continue
 			}
 
diff --git a/pkg/monitor/cluster/deploymentstatuses.go b/pkg/monitor/cluster/deploymentstatuses.go
index ed02e290b..771fe8989 100644
--- a/pkg/monitor/cluster/deploymentstatuses.go
+++ b/pkg/monitor/cluster/deploymentstatuses.go
@@ -24,7 +24,7 @@ func (mon *Monitor) emitDeploymentStatuses(ctx context.Context) error {
 		count += int64(len(ds.Items))
 
 		for _, d := range ds.Items {
-			if !namespace.IsOpenShift(d.Namespace) {
+			if !namespace.IsOpenShiftNamespace(d.Namespace) {
 				continue
 			}
 
diff --git a/pkg/monitor/cluster/jobconditions.go b/pkg/monitor/cluster/jobconditions.go
index f45104ca3..9941f9380 100644
--- a/pkg/monitor/cluster/jobconditions.go
+++ b/pkg/monitor/cluster/jobconditions.go
@@ -30,7 +30,7 @@ func (mon *Monitor) emitJobConditions(ctx context.Context) error {
 		count += int64(len(jobs.Items))
 
 		for _, job := range jobs.Items {
-			if !namespace.IsOpenShift(job.Namespace) {
+			if !namespace.IsOpenShiftNamespace(job.Namespace) {
 				continue
 			}
 
diff --git a/pkg/monitor/cluster/podconditions.go b/pkg/monitor/cluster/podconditions.go
index 119db6454..48956d19b 100644
--- a/pkg/monitor/cluster/podconditions.go
+++ b/pkg/monitor/cluster/podconditions.go
@@ -51,7 +51,7 @@ func (mon *Monitor) emitPodConditions(ctx context.Context) error {
 
 func (mon *Monitor) _emitPodConditions(ps *corev1.PodList) {
 	for _, p := range ps.Items {
-		if !namespace.IsOpenShift(p.Namespace) {
+		if !namespace.IsOpenShiftNamespace(p.Namespace) {
 			continue
 		}
 
@@ -89,7 +89,7 @@ func (mon *Monitor) _emitPodConditions(ps *corev1.PodList) {
 
 func (mon *Monitor) _emitPodContainerStatuses(ps *corev1.PodList) {
 	for _, p := range ps.Items {
-		if !namespace.IsOpenShift(p.Namespace) {
+		if !namespace.IsOpenShiftNamespace(p.Namespace) {
 			continue
 		}
 
@@ -126,7 +126,7 @@ func (mon *Monitor) _emitPodContainerStatuses(ps *corev1.PodList) {
 
 func (mon *Monitor) _emitPodContainerRestartCounter(ps *corev1.PodList) {
 	for _, p := range ps.Items {
-		if !namespace.IsOpenShiftSystemNamespace(p.Namespace) {
+		if !namespace.IsOpenShiftNamespace(p.Namespace) {
 			continue
 		}
 
diff --git a/pkg/monitor/cluster/prometheusalerts.go b/pkg/monitor/cluster/prometheusalerts.go
index c0208e981..8df500943 100644
--- a/pkg/monitor/cluster/prometheusalerts.go
+++ b/pkg/monitor/cluster/prometheusalerts.go
@@ -80,7 +80,7 @@ func (mon *Monitor) emitPrometheusAlerts(ctx context.Context) error {
 	mon.emitGauge("prometheus.alerts.count", int64(len(alerts)), nil)
 
 	for _, alert := range alerts {
-		if !namespace.IsOpenShift(string(alert.Labels["namespace"])) {
+		if !namespace.IsOpenShiftNamespace(string(alert.Labels["namespace"])) {
 			continue
 		}
 
diff --git a/pkg/monitor/cluster/replicasetstatuses.go b/pkg/monitor/cluster/replicasetstatuses.go
index fc5fc8dc2..1b9d30bbd 100644
--- a/pkg/monitor/cluster/replicasetstatuses.go
+++ b/pkg/monitor/cluster/replicasetstatuses.go
@@ -24,7 +24,7 @@ func (mon *Monitor) emitReplicasetStatuses(ctx context.Context) error {
 		count += int64(len(rss.Items))
 
 		for _, rs := range rss.Items {
-			if !namespace.IsOpenShift(rs.Namespace) {
+			if !namespace.IsOpenShiftNamespace(rs.Namespace) {
 				continue
 			}
 
diff --git a/pkg/monitor/cluster/statefulsetstatuses.go b/pkg/monitor/cluster/statefulsetstatuses.go
index d348eec7d..57a95db9c 100644
--- a/pkg/monitor/cluster/statefulsetstatuses.go
+++ b/pkg/monitor/cluster/statefulsetstatuses.go
@@ -24,7 +24,7 @@ func (mon *Monitor) emitStatefulsetStatuses(ctx context.Context) error {
 		count += int64(len(sss.Items))
 
 		for _, ss := range sss.Items {
-			if !namespace.IsOpenShift(ss.Namespace) {
+			if !namespace.IsOpenShiftNamespace(ss.Namespace) {
 				continue
 			}
 
diff --git a/pkg/util/namespace/namespace.go b/pkg/util/namespace/namespace.go
index fd7fd785c..3b9a98979 100644
--- a/pkg/util/namespace/namespace.go
+++ b/pkg/util/namespace/namespace.go
@@ -3,23 +3,74 @@ package namespace
 // Copyright (c) Microsoft Corporation.
 // Licensed under the Apache License 2.0.
 
-import (
-	"strings"
-)
+// IsOpenShiftNamespace returns true if ns is a namespace in the defined hardcoded map.
+// We should only add new namespaces into this hardcoded list but never delete
+// the existing ones in the namespace list to avoid backward compatibility issues.
+func IsOpenShiftNamespace(ns string) bool {
+	nsmap := map[string]struct{}{
+		// Allow validation against non-namespaced objects via Geneva actions
+		"": {},
 
-// IsOpenShift returns true if ns is an openshift managed namespace, including the default namespace
-func IsOpenShift(ns string) bool {
-	return ns == "" ||
-		ns == "default" ||
-		ns == "openshift" ||
-		strings.HasPrefix(ns, "kube-") ||
-		strings.HasPrefix(ns, "openshift-")
-}
+		// ARO specific namespaces
+		"openshift-azure-logging":            {},
+		"openshift-azure-operator":           {},
+		"openshift-managed-upgrade-operator": {},
 
-// IsOpenShiftSystemNamespace returns true if ns is an openshift managed namespace, without the default namespace
-func IsOpenShiftSystemNamespace(ns string) bool {
-	return ns == "" ||
-		ns == "openshift" ||
-		strings.HasPrefix(ns, "kube-") ||
-		strings.HasPrefix(ns, "openshift-")
+		// OCP namespaces
+		"openshift":                                        {},
+		"openshift-apiserver":                              {},
+		"openshift-apiserver-operator":                     {},
+		"openshift-authentication-operator":                {},
+		"openshift-cloud-controller-manager":               {},
+		"openshift-cloud-controller-manager-operator":      {},
+		"openshift-cloud-credential-operator":              {},
+		"openshift-cluster-csi-drivers":                    {},
+		"openshift-cluster-machine-approver":               {},
+		"openshift-cluster-node-tuning-operator":           {},
+		"openshift-cluster-samples-operator":               {},
+		"openshift-cluster-storage-operator":               {},
+		"openshift-config":                                 {},
+		"openshift-config-managed":                         {},
+		"openshift-config-operator":                        {},
+		"openshift-console":                                {},
+		"openshift-console-operator":                       {},
+		"openshift-console-user-settings":                  {},
+		"openshift-controller-manager":                     {},
+		"openshift-controller-manager-operator":            {},
+		"openshift-dns":                                    {},
+		"openshift-dns-operator":                           {},
+		"openshift-etcd":                                   {},
+		"openshift-etcd-operator":                          {},
+		"openshift-host-network":                           {},
+		"openshift-image-registry":                         {},
+		"openshift-ingress":                                {},
+		"openshift-ingress-canary":                         {},
+		"openshift-ingress-operator":                       {},
+		"openshift-insights":                               {},
+		"openshift-kni-infra":                              {},
+		"openshift-kube-apiserver":                         {},
+		"openshift-kube-apiserver-operator":                {},
+		"openshift-kube-controller-manager":                {},
+		"openshift-kube-controller-manager-operator":       {},
+		"openshift-kube-scheduler":                         {},
+		"openshift-kube-scheduler-operator":                {},
+		"openshift-kube-storage-version-migrator":          {},
+		"openshift-kube-storage-version-migrator-operator": {},
+		"openshift-machine-api":                            {},
+		"openshift-machine-config-operator":                {},
+		"openshift-marketplace":                            {},
+		"openshift-monitoring":                             {},
+		"openshift-multus":                                 {},
+		"openshift-network-diagnostics":                    {},
+		"openshift-network-operator":                       {},
+		"openshift-oauth-apiserver":                        {},
+		"openshift-openstack-infra":                        {},
+		"openshift-operators":                              {},
+		"openshift-ovirt-infra":                            {},
+		"openshift-sdn":                                    {},
+		"openshift-service-ca":                             {},
+		"openshift-service-ca-operator":                    {},
+	}
+	_, ok := nsmap[ns]
+	return ok
 }


Test patch:
diff --git a/pkg/frontend/admin_openshiftcluster_kubernetesobjects_test.go b/pkg/frontend/admin_openshiftcluster_kubernetesobjects_test.go
index 9737efd37..5ca0f2e18 100644
--- a/pkg/frontend/admin_openshiftcluster_kubernetesobjects_test.go
+++ b/pkg/frontend/admin_openshiftcluster_kubernetesobjects_test.go
@@ -45,7 +45,7 @@ func TestAdminKubernetesObjectsGetAndDelete(t *testing.T) {
 			name:         "cluster exist in db - get",
 			resourceID:   fmt.Sprintf("/subscriptions/%s/resourcegroups/resourceGroup/providers/Microsoft.RedHatOpenShift/openShiftClusters/resourceName", mockSubID),
 			objKind:      "ConfigMap",
-			objNamespace: "openshift-project",
+			objNamespace: "openshift",
 			objName:      "config",
 			mocks: func(tt *test, k *mock_adminactions.MockKubeActions) {
 				k.EXPECT().
@@ -61,7 +61,7 @@ func TestAdminKubernetesObjectsGetAndDelete(t *testing.T) {
 			name:         "cluster exist in db - list",
 			resourceID:   fmt.Sprintf("/subscriptions/%s/resourcegroups/resourceGroup/providers/Microsoft.RedHatOpenShift/openShiftClusters/resourceName", mockSubID),
 			objKind:      "ConfigMap",
-			objNamespace: "openshift-project",
+			objNamespace: "openshift",
 			mocks: func(tt *test, k *mock_adminactions.MockKubeActions) {
 				k.EXPECT().
 					KubeList(gomock.Any(), tt.objKind, tt.objNamespace).
@@ -75,7 +75,7 @@ func TestAdminKubernetesObjectsGetAndDelete(t *testing.T) {
 			method:       http.MethodGet,
 			name:         "no groupKind provided",
 			resourceID:   fmt.Sprintf("/subscriptions/%s/resourcegroups/resourceGroup/providers/Microsoft.RedHatOpenShift/openShiftClusters/resourceName", mockSubID),
-			objNamespace: "openshift-project",
+			objNamespace: "openshift",
 			objName:      "config",
 			mocks: func(tt *test, k *mock_adminactions.MockKubeActions) {
 			},
@@ -87,7 +87,7 @@ func TestAdminKubernetesObjectsGetAndDelete(t *testing.T) {
 			name:         "secret requested",
 			resourceID:   fmt.Sprintf("/subscriptions/%s/resourcegroups/resourceGroup/providers/Microsoft.RedHatOpenShift/openShiftClusters/resourceName", mockSubID),
 			objKind:      "Secret",
-			objNamespace: "openshift-project",
+			objNamespace: "openshift",
 			objName:      "config",
 			mocks: func(tt *test, k *mock_adminactions.MockKubeActions) {
 			},
@@ -99,7 +99,7 @@ func TestAdminKubernetesObjectsGetAndDelete(t *testing.T) {
 			name:         "cluster exist in db",
 			resourceID:   fmt.Sprintf("/subscriptions/%s/resourcegroups/resourceGroup/providers/Microsoft.RedHatOpenShift/openShiftClusters/resourceName", mockSubID),
 			objKind:      "ConfigMap",
-			objNamespace: "openshift-project",
+			objNamespace: "openshift",
 			objName:      "config",
 			mocks: func(tt *test, k *mock_adminactions.MockKubeActions) {
 				k.EXPECT().
@@ -113,7 +113,7 @@ func TestAdminKubernetesObjectsGetAndDelete(t *testing.T) {
 			method:       http.MethodDelete,
 			name:         "no groupKind provided",
 			resourceID:   fmt.Sprintf("/subscriptions/%s/resourcegroups/resourceGroup/providers/Microsoft.RedHatOpenShift/openShiftClusters/resourceName", mockSubID),
-			objNamespace: "openshift-project",
+			objNamespace: "openshift",
 			objName:      "config",
 			mocks: func(tt *test, k *mock_adminactions.MockKubeActions) {
 			},
@@ -125,7 +125,7 @@ func TestAdminKubernetesObjectsGetAndDelete(t *testing.T) {
 			name:         "no name provided",
 			resourceID:   fmt.Sprintf("/subscriptions/%s/resourcegroups/resourceGroup/providers/Microsoft.RedHatOpenShift/openShiftClusters/resourceName", mockSubID),
 			objKind:      "this",
-			objNamespace: "openshift-project",
+			objNamespace: "openshift",
 			mocks: func(tt *test, k *mock_adminactions.MockKubeActions) {
 			},
 			wantStatusCode: http.StatusBadRequest,
@@ -136,7 +136,7 @@ func TestAdminKubernetesObjectsGetAndDelete(t *testing.T) {
 			name:         "secret requested",
 			resourceID:   fmt.Sprintf("/subscriptions/%s/resourcegroups/resourceGroup/providers/Microsoft.RedHatOpenShift/openShiftClusters/resourceName", mockSubID),
 			objKind:      "Secret",
-			objNamespace: "openshift-project",
+			objNamespace: "openshift",
 			objName:      "config",
 			mocks: func(tt *test, k *mock_adminactions.MockKubeActions) {
 			},
@@ -225,21 +225,21 @@ func TestValidateAdminKubernetesObjectsNonCustomer(t *testing.T) {
 		{
 			test:      "invalid groupKind",
 			groupKind: "$",
-			namespace: "openshift-ns",
+			namespace: "openshift",
 			name:      "Valid-NAME-01",
 			wantErr:   "400: InvalidParameter: : The provided groupKind '$' is invalid.",
 		},
 		{
 			test:      "forbidden groupKind",
 			groupKind: "Secret",
-			namespace: "openshift-ns",
+			namespace: "openshift",
 			name:      "Valid-NAME-01",
 			wantErr:   "403: Forbidden: : Access to secrets is forbidden.",
 		},
 		{
 			test:      "forbidden groupKind",
 			groupKind: "Anything.oauth.openshift.io",
-			namespace: "openshift-ns",
+			namespace: "openshift",
 			name:      "Valid-NAME-01",
 			wantErr:   "403: Forbidden: : Access to secrets is forbidden.",
 		},
@@ -269,7 +269,7 @@ func TestValidateAdminKubernetesObjectsNonCustomer(t *testing.T) {
 		},
 		{
 			test:      "empty groupKind",
-			namespace: "openshift-ns",
+			namespace: "openshift",
 			name:      "Valid-NAME-01",
 			wantErr:   "400: InvalidParameter: : The provided groupKind '' is invalid.",
 		},
@@ -278,12 +278,12 @@ func TestValidateAdminKubernetesObjectsNonCustomer(t *testing.T) {
 			groupKind: "Valid-kind.openshift.io",
 			namespace: "openshift-/",
 			name:      "Valid-NAME-01",
-			wantErr:   "400: InvalidParameter: : The provided namespace 'openshift-/' is invalid.",
+			wantErr:   "403: Forbidden: : Access to the provided namespace 'openshift-/' is forbidden.",
 		},
 		{
 			test:      "invalid name",
 			groupKind: "Valid-kind.openshift.io",
-			namespace: "openshift-ns",
+			namespace: "openshift",
 			name:      longName,
 			wantErr:   "400: InvalidParameter: : The provided name '" + longName + "' is invalid.",
 		},
@@ -291,14 +291,14 @@ func TestValidateAdminKubernetesObjectsNonCustomer(t *testing.T) {
 			test:      "post: empty name",
 			method:    http.MethodPost,
 			groupKind: "Valid-kind.openshift.io",
-			namespace: "openshift-ns",
+			namespace: "openshift",
 			wantErr:   "400: InvalidParameter: : The provided name '' is invalid.",
 		},
 		{
 			test:      "delete: empty name",
 			method:    http.MethodDelete,
 			groupKind: "Valid-kind.openshift.io",
-			namespace: "openshift-ns",
+			namespace: "openshift",
 			wantErr:   "400: InvalidParameter: : The provided name '' is invalid.",
 		},
 	} {
@@ -356,6 +356,10 @@ func TestAdminPostKubernetesObjects(t *testing.T) {
 			objInBody: &unstructured.Unstructured{
 				Object: map[string]interface{}{
 					"kind": "Secret",
+					"metadata": map[string]interface{}{
+						"namespace": "openshift",
+						"name":      "secret",
+					},
 				},
 			},
 			mocks:          func(tt *test, k *mock_adminactions.MockKubeActions) {},
diff --git a/pkg/monitor/cluster/podconditions_test.go b/pkg/monitor/cluster/podconditions_test.go
index ceb069968..993bebffd 100644
--- a/pkg/monitor/cluster/podconditions_test.go
+++ b/pkg/monitor/cluster/podconditions_test.go
@@ -236,7 +236,7 @@ func TestEmitPodContainerRestartCounter(t *testing.T) {
 		&corev1.Pod{ // #6 Multi-container pod
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      "multi-container-pod",
-				Namespace: "openshift-test",
+				Namespace: "openshift",
 			},
 			Status: corev1.PodStatus{
 				ContainerStatuses: []corev1.ContainerStatus{
@@ -286,7 +286,7 @@ func TestEmitPodContainerRestartCounter(t *testing.T) {
 
 	m.EXPECT().EmitGauge("pod.restartcounter", int64(restartCounterThreshold*2), map[string]string{
 		"name":      "multi-container-pod",
-		"namespace": "openshift-test",
+		"namespace": "openshift",
 	})
 
 	ps, _ := cli.CoreV1().Pods("").List(context.Background(), metav1.ListOptions{})
diff --git a/pkg/util/namespace/namespace_test.go b/pkg/util/namespace/namespace_test.go
index ae2cd2729..23821b025 100644
--- a/pkg/util/namespace/namespace_test.go
+++ b/pkg/util/namespace/namespace_test.go
@@ -7,73 +7,62 @@ import (
 	"testing"
 )
 
-func TestIsOpenShift(t *testing.T) {
+func TestIsOpenShiftNamespace(t *testing.T) {
 	for _, tt := range []struct {
 		namespace string
 		want      bool
 	}{
 		{
-			want: true,
+			namespace: "",
+			want:      true,
 		},
 		{
-			namespace: "openshift-ns",
+			namespace: "openshift-apiserver",
 			want:      true,
 		},
 		{
-			namespace: "openshift",
+			namespace: "openshift-azure-operator",
 			want:      true,
 		},
 		{
-			namespace: "kube-ns",
+			namespace: "openshift-azure-logging",
 			want:      true,
 		},
 		{
-			namespace: "default",
-			want:      true,
+			namespace: "openshift-gitops",
+			want:      false,
 		},
 		{
-			namespace: "customer",
+			namespace: "openshift-authentication",
+			want:      false,
 		},
-	} {
-		t.Run(tt.namespace, func(t *testing.T) {
-			got := IsOpenShift(tt.namespace)
-			if tt.want != got {
-				t.Error(got)
-			}
-		})
-	}
-}
-
-func TestIsOpenShiftSystemNamespace(t *testing.T) {
-	for _, tt := range []struct {
-		namespace string
-		want      bool
-	}{
 		{
-			want: true,
+			namespace: "default",
+			want:      false,
 		},
 		{
-			namespace: "openshift-ns",
-			want:      true,
+			namespace: "customer",
+			want:      false,
 		},
 		{
-			namespace: "openshift",
-			want:      true,
+			namespace: "openshift-/",
+			want:      false,
 		},
 		{
-			namespace: "kube-ns",
-			want:      true,
+			namespace: "openshift-ns",
+			want:      false,
 		},
 		{
-			namespace: "default",
+			namespace: "kube-ns",
 			want:      false,
 		},
 		{
-			namespace: "customer",
+			namespace: "openshift-operator-lifecycle-manager",
+			want:      false,
 		},
 	} {
 		t.Run(tt.namespace, func(t *testing.T) {
-			got := IsOpenShiftSystemNamespace(tt.namespace)
+			got := IsOpenShiftNamespace(tt.namespace)
 			if tt.want != got {
 				t.Error(got)
 			}
diff --git a/test/e2e/adminapi_kubernetesobjects.go b/test/e2e/adminapi_kubernetesobjects.go
index e91302982..7f665e69a 100644
--- a/test/e2e/adminapi_kubernetesobjects.go
+++ b/test/e2e/adminapi_kubernetesobjects.go
@@ -26,7 +26,7 @@ var _ = Describe("[Admin API] Kubernetes objects action", func() {
 	const objName = "e2e-test-object"
 
 	When("in a standard openshift namespace", func() {
-		const namespace = "default"
+		const namespace = "openshift"
 
 		It("should be able to create, get, list, update and delete objects", func() {
 			defer func() {