From ea057e42fa02bb76b563ac823277a3d2e5402312 Mon Sep 17 00:00:00 2001
From: Adam Zhang <adam.zhang@broadcom.com>
Date: Fri, 3 Apr 2026 13:15:00 +0800
Subject: [PATCH] fix node-agent node detection logic

Add namespace in ListOptions, to fix node-agent node detection
in its deployed namespace.

Signed-off-by: Adam Zhang <adam.zhang@broadcom.com>
---
 changelogs/unreleased/9671-adam-jian-zhang |  1 +
 pkg/nodeagent/node_agent.go                |  5 ++-
 pkg/nodeagent/node_agent_test.go           | 46 +++++++++++++++++-----
 3 files changed, 42 insertions(+), 10 deletions(-)
 create mode 100644 changelogs/unreleased/9671-adam-jian-zhang

diff --git a/changelogs/unreleased/9671-adam-jian-zhang b/changelogs/unreleased/9671-adam-jian-zhang
new file mode 100644
index 000000000..a998ded6f
--- /dev/null
+++ b/changelogs/unreleased/9671-adam-jian-zhang
@@ -0,0 +1 @@
+Fix issue #9666, fix node-agent node detection in multiple instances scenario
diff --git a/pkg/nodeagent/node_agent.go b/pkg/nodeagent/node_agent.go
index a5de2465c..87efb896a 100644
--- a/pkg/nodeagent/node_agent.go
+++ b/pkg/nodeagent/node_agent.go
@@ -97,7 +97,10 @@ func isRunningInNode(ctx context.Context, namespace string, nodeName string, crC
 	}
 
 	if crClient != nil {
-		err = crClient.List(ctx, pods, &ctrlclient.ListOptions{LabelSelector: parsedSelector})
+		err = crClient.List(ctx, pods, &ctrlclient.ListOptions{
+			LabelSelector: parsedSelector,
+			Namespace:     namespace,
+		})
 	} else {
 		pods, err = kubeClient.CoreV1().Pods(namespace).List(ctx, metav1.ListOptions{LabelSelector: parsedSelector.String()})
 	}
diff --git a/pkg/nodeagent/node_agent_test.go b/pkg/nodeagent/node_agent_test.go
index cb46ee569..168e91de1 100644
--- a/pkg/nodeagent/node_agent_test.go
+++ b/pkg/nodeagent/node_agent_test.go
@@ -118,28 +118,37 @@ func TestIsRunningInNode(t *testing.T) {
 		Phase(corev1api.PodRunning).
 		NodeName("fake-node").
 		Result()
+	nodeAgentPodOtherNs := builder.ForPod("other-ns", "fake-pod-other").
+		Labels(map[string]string{"role": "node-agent"}).
+		Phase(corev1api.PodRunning).
+		NodeName("fake-node").
+		Result()
 
 	tests := []struct {
 		name          string
 		kubeClientObj []runtime.Object
+		namespace     string
 		nodeName      string
 		expectErr     string
 	}{
 		{
 			name:      "node name is empty",
+			namespace: "fake-ns",
 			expectErr: "node name is empty",
 		},
 		{
-			name:     "ds pod not found",
-			nodeName: "fake-node",
+			name:      "ds pod not found",
+			namespace: "fake-ns",
+			nodeName:  "fake-node",
 			kubeClientObj: []runtime.Object{
 				nonNodeAgentPod,
 			},
 			expectErr: "daemonset pod not found in running state in node fake-node",
 		},
 		{
-			name:     "ds po are not all running",
-			nodeName: "fake-node",
+			name:      "ds po are not all running",
+			namespace: "fake-ns",
+			nodeName:  "fake-node",
 			kubeClientObj: []runtime.Object{
 				nodeAgentPodNotRunning,
 				nodeAgentPodRunning1,
@@ -147,8 +156,9 @@ func TestIsRunningInNode(t *testing.T) {
 			expectErr: "daemonset pod not found in running state in node fake-node",
 		},
 		{
-			name:     "ds pods wrong node name",
-			nodeName: "fake-node",
+			name:      "ds pods wrong node name",
+			namespace: "fake-ns",
+			nodeName:  "fake-node",
 			kubeClientObj: []runtime.Object{
 				nodeAgentPodNotRunning,
 				nodeAgentPodRunning1,
@@ -157,8 +167,9 @@ func TestIsRunningInNode(t *testing.T) {
 			expectErr: "daemonset pod not found in running state in node fake-node",
 		},
 		{
-			name:     "succeed",
-			nodeName: "fake-node",
+			name:      "succeed",
+			namespace: "fake-ns",
+			nodeName:  "fake-node",
 			kubeClientObj: []runtime.Object{
 				nodeAgentPodNotRunning,
 				nodeAgentPodRunning1,
@@ -166,6 +177,23 @@ func TestIsRunningInNode(t *testing.T) {
 				nodeAgentPodRunning3,
 			},
 		},
+		{
+			name:      "cross-namespace isolation - pod in wrong namespace on same node",
+			namespace: "fake-ns",
+			nodeName:  "fake-node",
+			kubeClientObj: []runtime.Object{
+				nodeAgentPodOtherNs,
+			},
+			expectErr: "daemonset pod not found in running state in node fake-node",
+		},
+		{
+			name:      "cross-namespace isolation - pod in correct namespace on same node",
+			namespace: "other-ns",
+			nodeName:  "fake-node",
+			kubeClientObj: []runtime.Object{
+				nodeAgentPodOtherNs,
+			},
+		},
 	}
 
 	for _, test := range tests {
@@ -175,7 +203,7 @@ func TestIsRunningInNode(t *testing.T) {
 
 			fakeClient := fakeClientBuilder.WithRuntimeObjects(test.kubeClientObj...).Build()
 
-			err := IsRunningInNode(t.Context(), "", test.nodeName, fakeClient)
+			err := IsRunningInNode(t.Context(), test.namespace, test.nodeName, fakeClient)
 			if test.expectErr == "" {
 				assert.NoError(t, err)
 			} else {