Helm: Chart not using helm-flag '--namespace' #7226

flyinggecko · 2021-06-09T10:16:22Z

NGINX Ingress controller version: 0.47.0

Kubernetes version (use kubectl version): Server Version: version.Info{Major:"1", Minor:"19+", GitVersion:"v1.19.9-gke.1900", GitCommit:"008fd38bf3dc201bebdd4fe26edf9bf87478309a", GitTreeState:"clean", BuildDate:"2021-04-14T09:22:08Z", GoVersion:"go1.15.8b5", Compiler:"gc", Platform:"linux/amd64"}

Environment:

Cloud provider or hardware configuration: GKE
OS (e.g. from /etc/os-release): Container-Optimized OS from Google
Kernel (e.g. uname -a): 5.4.89+ Basic structure #1 SMP Sat Feb 13 19:45:14 PST 2021
Install tools: helm v3.6.0 (I hope this is what you want to know)
Others:

What happened:

I was running helm template --namespace gitlab-managed-apps nginx-ingress ingress-nginx/ingress-nginx
The result is (just a few resources, as the output would be too long):

---
# Source: ingress-nginx/templates/controller-serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    helm.sh/chart: ingress-nginx-3.33.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/version: "0.47.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
  name: ingress-nginx
automountServiceAccountToken: true
---
# Source: ingress-nginx/templates/controller-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    helm.sh/chart: ingress-nginx-3.33.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/version: "0.47.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
  name: ingress-nginx-controller
data:
---
# ...

What you expected to happen:

Every resource, except cluster-wide resources (e.g. ClusterRole), should have the namespace set in metadata.namespace

---
# Source: ingress-nginx/templates/controller-serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    helm.sh/chart: ingress-nginx-3.33.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/version: "0.47.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
  name: ingress-nginx
  namespace: gitlab-managed-apps # <------ Is missing
automountServiceAccountToken: true
---
# Source: ingress-nginx/templates/controller-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    helm.sh/chart: ingress-nginx-3.33.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/version: "0.47.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
  name: ingress-nginx-controller
  namespace: gitlab-managed-apps # <------ Is missing
data:
---
# ...

How to reproduce it:

Just run:
helm template --namespace gitlab-managed-apps nginx-ingress ingress-nginx/ingress-nginx

Anything else we need to know:

If this is a bug, I'm willing to fix it. ;)

/kind bug
/area helm

The text was updated successfully, but these errors were encountered:

longwuyuan · 2021-06-09T10:36:19Z

__$ date Wednesday 09 June 2021 04:03:44 PM IST __$ k get ns NAME STATUS AGE default Active 32d ingress-nginx Active 40m kube-node-lease Active 32d kube-public Active 32d kube-system Active 32d logdna-agent Active 16d metallb-system Active 19d postgres Active 8d test Active 19d __$ helm -n helm-template-test template ingress-nginx-helm-test ingress-nginx/ingress-nginx | grep -i namespace namespace: "helm-template-test" - namespaces namespace: "helm-template-test" - --publish-service=$(POD_NAMESPACE)/ingress-nginx-helm-test-controller - --configmap=$(POD_NAMESPACE)/ingress-nginx-helm-test-controller - name: POD_NAMESPACE fieldPath: metadata.namespace namespace: "helm-template-test" namespace: "helm-template-test" namespace: "helm-template-test" - --host=ingress-nginx-helm-test-controller-admission,ingress-nginx-helm-test-controller-admission.$(POD_NAMESPACE).svc - --namespace=$(POD_NAMESPACE) - name: POD_NAMESPACE fieldPath: metadata.namespace - --namespace=$(POD_NAMESPACE) - name: POD_NAMESPACE fieldPath: metadata.namespace __$ helm search repo ingress-nginx NAME CHART VERSION APP VERSION DESCRIPTION ingress-nginx/ingress-nginx 3.33.0 0.47.0 Ingress controller for Kubernetes using NGINX a... __$ Thanks, ; Long

…

On 09/06/21 3:46 pm, Julian wrote: *NGINX Ingress controller version*: 0.47.0 *Kubernetes version* (use |kubectl version|): Server Version: version.Info{Major:"1", Minor:"19+", GitVersion:"v1.19.9-gke.1900", GitCommit:"008fd38bf3dc201bebdd4fe26edf9bf87478309a", GitTreeState:"clean", BuildDate:"2021-04-14T09:22:08Z", GoVersion:"go1.15.8b5", Compiler:"gc", Platform:"linux/amd64"} *Environment*: * *Cloud provider or hardware configuration*: GKE * *OS* (e.g. from /etc/os-release): Container-Optimized OS from Google * *Kernel* (e.g. |uname -a|): 5.4.89+ #1 <#1> SMP Sat Feb 13 19:45:14 PST 2021 * *Install tools*: helm v3.6.0 (I hope this is what you want to know) * *Others*: *What happened*: I was running |helm template --namespace gitlab-managed-apps nginx-ingress ingress-nginx/ingress-nginx| The result is (just a few resources, as the output would be too long): --- # Source: ingress-nginx/templates/controller-serviceaccount.yaml apiVersion:v1 kind:ServiceAccount metadata: labels: helm.sh/chart:ingress-nginx-3.33.0 app.kubernetes.io/name:ingress-nginx app.kubernetes.io/instance:ingress-nginx app.kubernetes.io/version:"0.47.0" app.kubernetes.io/managed-by:Helm app.kubernetes.io/component:controller name:ingress-nginx automountServiceAccountToken:true --- # Source: ingress-nginx/templates/controller-configmap.yaml apiVersion:v1 kind:ConfigMap metadata: labels: helm.sh/chart:ingress-nginx-3.33.0 app.kubernetes.io/name:ingress-nginx app.kubernetes.io/instance:ingress-nginx app.kubernetes.io/version:"0.47.0" app.kubernetes.io/managed-by:Helm app.kubernetes.io/component:controller name:ingress-nginx-controller data: --- # ... *What you expected to happen*: Every resource exept cluster-wide resources (e.g. ClusterRole) should have the namespace set in |metadata.namespace| --- # Source: ingress-nginx/templates/controller-serviceaccount.yaml apiVersion:v1 kind:ServiceAccount metadata: labels: helm.sh/chart:ingress-nginx-3.33.0 app.kubernetes.io/name:ingress-nginx app.kubernetes.io/instance:ingress-nginx app.kubernetes.io/version:"0.47.0" app.kubernetes.io/managed-by:Helm app.kubernetes.io/component:controller name:ingress-nginx namespace:gitlab-managed-apps # <------ Is missing automountServiceAccountToken:true --- # Source: ingress-nginx/templates/controller-configmap.yaml apiVersion:v1 kind:ConfigMap metadata: labels: helm.sh/chart:ingress-nginx-3.33.0 app.kubernetes.io/name:ingress-nginx app.kubernetes.io/instance:ingress-nginx app.kubernetes.io/version:"0.47.0" app.kubernetes.io/managed-by:Helm app.kubernetes.io/component:controller name:ingress-nginx-controller namespace:gitlab-managed-apps # <------ Is missing data: --- # ... *How to reproduce it*: Just run: |helm template --namespace gitlab-managed-apps nginx-ingress ingress-nginx/ingress-nginx| *Anything else we need to know*: If this is a bug, I'm willing to fix it. ;) /kind bug /area helm — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#7226>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABGZVWRQENKTI2PIYZZJXBTTR45QTANCNFSM46LXIEJA>.

tao12345666333 · 2021-06-19T02:54:57Z

maybe we could add namespace: {{ .Release.Namespace }} to all resources templates.

/good-first-issue

k8s-ci-robot · 2021-06-19T02:54:58Z

@tao12345666333:
This request has been marked as suitable for new contributors.

Please ensure the request meets the requirements listed here.

If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-good-first-issue command.

In response to this:

maybe we need add namespace: {{ .Release.Namespace }} to all resources templates.

/good-first-issue

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

longwuyuan · 2021-06-19T04:09:55Z

helm install command honors the --namespace flag
This issue is about the helm template command and the namespace may not exist at the time of running this command. I don't know if that is a factor.
I see at least the configmap template showing {{ .Release.Namespace}} under a if condition
I have tried helm template on a bitnami/mysql chart and it seems to do the expected thing

$ helm template --namespace nstest mysql bitnami/mysql 
  # Source: mysql/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: mysql
  namespace: nstest    --------> # --namespace flag honored
  labels:
    app.kubernetes.io/name: mysql
    helm.sh/chart: mysql-8.6.2
    app.kubernetes.io/instance: mysql
    app.kubernetes.io/managed-by: Helm
  annotations:
secrets:
  - name: mysql

While, as reported, ingress-nginx chart does not

---
$ helm template --namespace nstest ingress0 ingress-nginx/ingress-nginx
# Source: ingress-nginx/templates/controller-serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    helm.sh/chart: ingress-nginx-3.33.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress0
    app.kubernetes.io/version: "0.47.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
  name: ingress0-ingress-nginx
automountServiceAccountToken: true

I don't see {{ .Release.Namespace }} in ingress-nginx serviceaccount template yaml

_$ cat controller-serviceaccount.yaml
{{- if or .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    {{- include "ingress-nginx.labels" . | nindent 4 }}
    app.kubernetes.io/component: controller
  name: {{ template "ingress-nginx.serviceAccountName" . }}
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
{{- end }}

But I can see the {{ .Release.Namespace }} in the bitnami/mysql chart serviceaccount template yaml

__$ cat serviceaccount.yaml 
{{- if .Values.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include "mysql.serviceAccountName" . }}
  namespace: {{ .Release.Namespace }}
  labels: {{- include "common.labels.standard" . | nindent 4 }}
    {{- if .Values.commonLabels }}
    {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
    {{- end }}
  annotations:
    {{- if .Values.serviceAccount.annotations }}
    {{- include "common.tplvalues.render" ( dict "value" .Values.serviceAccount.annotations "context" $ ) | nindent 4 }}
    {{- end }}
    {{- if .Values.commonAnnotations }}
    {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
    {{- end }}
{{- if (not .Values.auth.customPasswordFiles) }}
secrets:
  - name: {{ template "mysql.secretName" . }}
{{- end }}
{{- end }}

@tao12345666333 if some more advise and guidance is available, then I can attempt a PR . I don't know the impact of adding {{ .Release.Namespace }} in all relevant template yaml files.

I can guess that clusterrole and clusterrolebinding yaml files should/need not have this. But I am not dead sure of much else.
Do I need to learn the go code of helm template command functioning.
Would it be prudent to precisely list the names of the yaml files that need to be edited for this one liner, in the metadata section. And get a signoff from you/others on which files need that oneliner

tao12345666333 · 2021-06-19T05:02:45Z

This is a known issue. As mentioned here helm/helm#3553 (comment) the helm template command will ignore the --namespace flag.

So usually when we write helm chart, we will add namespace: {{ .Release.Namespace }} by default.

I don't know the impact of adding {{ .Release.Namespace }} in all relevant template yaml files.

You only need to add this field for resources in the namespace scope
ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/#not-all-objects-are-in-a-namespace

longwuyuan · 2021-06-19T16:13:10Z

@tao12345666333 bacongobbler's comments in that issue you linked make so much sense

flyinggecko · 2021-06-21T08:17:47Z

Sorry, my bad. I hit the wrong button by accident.

There are at least some use-cases for the namespace parameter in the helm-template-functionality:

We use it to create the manifests and then let them deploy via gitlab's kubernetes agent. In that case we need to manually adjust the rendered manifest every time we update the helm values.

So, i will prepare a pr for this ;) bests

tao12345666333 · 2021-06-21T08:26:45Z

@flyinggecko Don't worry, @longwuyuan has opened a PR #7256

flyinggecko · 2021-06-23T07:39:21Z

Cool, is released and already in use. Thank you 👍

flyinggecko added the kind/bug Categorizes issue or PR as related to a bug. label Jun 9, 2021

k8s-ci-robot added the area/helm Issues or PRs related to helm charts label Jun 9, 2021

k8s-ci-robot added good first issue Denotes an issue ready for a new contributor, according to the "help wanted" guidelines. help wanted Denotes an issue that needs help from a contributor. Must meet "help wanted" guidelines. labels Jun 19, 2021

longwuyuan mentioned this issue Jun 19, 2021

namespace spec added to namespace scoped resources #7254

Closed

8 tasks

longwuyuan mentioned this issue Jun 20, 2021

added namespace field in the namespace scoped resource templates of helm chart #7256

Merged

8 tasks

flyinggecko closed this as completed Jun 21, 2021

flyinggecko reopened this Jun 21, 2021

flyinggecko closed this as completed Jun 23, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Helm: Chart not using helm-flag '--namespace' #7226

Helm: Chart not using helm-flag '--namespace' #7226

flyinggecko commented Jun 9, 2021 •

edited

Loading

longwuyuan commented Jun 9, 2021 via email

tao12345666333 commented Jun 19, 2021 •

edited

Loading

k8s-ci-robot commented Jun 19, 2021

longwuyuan commented Jun 19, 2021 •

edited

Loading

tao12345666333 commented Jun 19, 2021

longwuyuan commented Jun 19, 2021

flyinggecko commented Jun 21, 2021

tao12345666333 commented Jun 21, 2021

flyinggecko commented Jun 23, 2021

Helm: Chart not using helm-flag '--namespace' #7226

Helm: Chart not using helm-flag '--namespace' #7226

Comments

flyinggecko commented Jun 9, 2021 • edited Loading

longwuyuan commented Jun 9, 2021 via email

tao12345666333 commented Jun 19, 2021 • edited Loading

k8s-ci-robot commented Jun 19, 2021

longwuyuan commented Jun 19, 2021 • edited Loading

tao12345666333 commented Jun 19, 2021

longwuyuan commented Jun 19, 2021

flyinggecko commented Jun 21, 2021

tao12345666333 commented Jun 21, 2021

flyinggecko commented Jun 23, 2021

flyinggecko commented Jun 9, 2021 •

edited

Loading

tao12345666333 commented Jun 19, 2021 •

edited

Loading

longwuyuan commented Jun 19, 2021 •

edited

Loading