Log once for excluded resources

Logging all excluded resources may be quite noisy. Instead, collect
the IDs of excluded resources and log once (or no times, if there
aren't any).

cluster/kubernetes/sync.go

@@ -62,11 +62,12 @@ func (c *Cluster) Sync(syncSet cluster.SyncSet) error {
 
 	cs := makeChangeSet()
 	var errs cluster.SyncError
+	var excluded []string
 	for _, res := range syncSet.Resources {
 		resID := res.ResourceID()
 		id := resID.String()
 		if !c.IsAllowedResource(resID) {
-			logger.Log("warning", "not applying resource; excluded by namespace constraints", "resource", id, "source", res.Source())
+			excluded = append(excluded, id)
 			continue
 		}
 		// make a record of the checksum, whether we stage it to
@@ -94,6 +95,10 @@ func (c *Cluster) Sync(syncSet cluster.SyncSet) error {
 		}
 	}
 
+	if len(excluded) > 0 {
+		logger.Log("warning", "not applying resources; excluded by namespace constraints", "resources", strings.Join(excluded, ","))
+	}
+
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	c.muSyncErrors.RLock()