Namespace override

This patch makes it possible to install the subcharts in different namespaces as needed. Signed-off-by: Kevin Fox <[email protected]>
2023-03-13 15:03:16 -07:00
parent 661000a29a
commit 03db6bb5fe
40 changed files with 221 additions and 58 deletions
@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: DaemonSet
 metadata:
  name: {{ include "spiffe-csi-driver.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spiffe-csi-driver.namespace" . }}
  labels:
    {{- include "spiffe-csi-driver.labels" . | nindent 4 }}
 spec:
@@ -41,6 +41,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
 | insecureScheme.nginx.image.version | string | `"1.23.2-alpine"` |  |
 | insecureScheme.nginx.resources | object | `{}` |  |
 | nameOverride | string | `""` |  |
+| namespaceOverride | string | `""` |  |
 | nodeSelector | object | `{}` |  |
 | podAnnotations | object | `{}` |  |
 | podSecurityContext | object | `{}` |  |
@@ -23,6 +23,17 @@ If release name contains chart name it will be used as a full name.
 {{- end }}
 {{- end }}

+{{/*
+Allow the release namespace to be overridden for multi-namespace deployments in combined charts
+*/}}
+{{- define "spiffe-oidc-discovery-provider.namespace" -}}
+  {{- if .Values.namespaceOverride -}}
+    {{- .Values.namespaceOverride -}}
+  {{- else -}}
+    {{- .Release.Namespace -}}
+  {{- end -}}
+{{- end -}}
+
 {{/*
 Create chart name and version as used by the chart label.
 */}}
@@ -3,15 +3,15 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
  name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
 data:
  oidc-discovery-provider.conf: |
    log_level = "{{ .Values.config.logLevel }}"

    domains = [
      "{{ include "spiffe-oidc-discovery-provider.fullname" . }}",
-      "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}",
-      "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local",
+      "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}",
+      "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.cluster.local",
    {{- if gt (len .Values.config.domains) 0 }}
      "{{- join "\",\n      \"" .Values.config.domains }}"
    {{- end }}
@@ -3,6 +3,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
+  namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
  labels:
    {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
 spec:
@@ -3,6 +3,7 @@ apiVersion: autoscaling/v2beta1
 kind: HorizontalPodAutoscaler
 metadata:
  name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
+  namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
  labels:
    {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
 spec:
@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
  name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
  {{- with .Values.service.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
@@ -3,6 +3,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}
+  namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
  labels:
    {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
  {{- with .Values.serviceAccount.annotations }}
@@ -2,6 +2,7 @@ apiVersion: v1
 kind: Pod
 metadata:
  name: "{{ include "spiffe-oidc-discovery-provider.fullname" . }}-test-connection"
+  namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
  labels:
    {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
  annotations:
@@ -19,13 +20,13 @@ spec:
    - name: wget-service-name-namespace
      image: busybox
      command: ['wget']
-      args: ['-O', '/dev/null', '{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}:{{ .Values.service.port }}/.well-known/openid-configuration']
+      args: ['-O', '/dev/null', '{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
      securityContext:
        {{- toYaml .Values.securityContext | nindent 8 }}
    - name: wget-service-name-namespace-svc-cluster-local
      image: busybox
      command: ['wget']
-      args: ['-O', '/dev/null', '{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}/.well-known/openid-configuration']
+      args: ['-O', '/dev/null', '{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.cluster.local:{{ .Values.service.port }}/.well-known/openid-configuration']
      securityContext:
        {{- toYaml .Values.securityContext | nindent 8 }}
  restartPolicy: Never
@@ -6,6 +6,8 @@ agentSocket: spire-agent.sock

 replicaCount: 1

+namespaceOverride: ""
+
 image:
  # registry: gcr.io
  # repository: spiffe-io/oidc-discovery-provider
@@ -30,6 +30,7 @@ A Helm chart to install the SPIRE agent.
 | initContainers | list | `[]` |  |
 | logLevel | string | `"info"` |  |
 | nameOverride | string | `""` |  |
+| namespaceOverride | string | `""` |  |
 | nodeSelector | object | `{}` |  |
 | podAnnotations | object | `{}` |  |
 | podSecurityContext | object | `{}` |  |
@@ -37,6 +38,7 @@ A Helm chart to install the SPIRE agent.
 | resources | object | `{}` |  |
 | securityContext | object | `{}` |  |
 | server.address | string | `""` |  |
+| server.namespaceOverride | string | `""` |  |
 | server.port | int | `8081` |  |
 | serviceAccount.annotations | object | `{}` |  |
 | serviceAccount.create | bool | `true` |  |
@@ -23,6 +23,25 @@ If release name contains chart name it will be used as a full name.
 {{- end }}
 {{- end }}

+{{/*
+Allow the release namespace to be overridden for multi-namespace deployments in combined charts
+*/}}
+{{- define "spire-agent.namespace" -}}
+  {{- if .Values.namespaceOverride -}}
+    {{- .Values.namespaceOverride -}}
+  {{- else -}}
+    {{- .Release.Namespace -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "spire-agent.server.namespace" -}}
+  {{- if .Values.server.namespaceOverride -}}
+    {{- .Values.server.namespaceOverride -}}
+  {{- else -}}
+    {{- .Release.Namespace -}}
+  {{- end -}}
+{{- end -}}
+
 {{/*
 Create chart name and version as used by the chart label.
 */}}
@@ -77,7 +96,7 @@ Create the name of the service account to use
 {{- if .Values.server.address }}
 {{- .Values.server.address }}
 {{- else }}
-{{ .Release.Name }}-server
+{{ .Release.Name }}-server.{{ include "spire-agent.server.namespace" . }}
 {{- end }}
 {{- end }}

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
  name: {{ include "spire-agent.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-agent.namespace" . }}
 data:
  agent.conf: |
    agent {
@@ -3,7 +3,7 @@ apiVersion: apps/v1
 kind: DaemonSet
 metadata:
  name: {{ include "spire-agent.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-agent.namespace" . }}
  labels:
    {{- include "spire-agent.labels" . | nindent 4 }}
 spec:
@@ -16,11 +16,10 @@ kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
  name: {{ include "spire-agent.fullname" . }}
-  namespace: {{ .Release.Namespace }}
 subjects:
  - kind: ServiceAccount
-    name: {{ include "spire-agent.fullname" . }}
-    namespace: {{ .Release.Namespace }}
+    name: {{ include "spire-agent.serviceAccountName" . }}
+    namespace: {{ include "spire-agent.namespace" . }}
 roleRef:
  kind: ClusterRole
  name: {{ include "spire-agent.fullname" . }}
@@ -3,7 +3,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: {{ include "spire-agent.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-agent.namespace" . }}
  labels:
    {{- include "spire-agent.labels" . | nindent 4 }}
  {{- with .Values.serviceAccount.annotations }}
@@ -13,6 +13,7 @@ image:

 imagePullSecrets: []
 nameOverride: ""
+namespaceOverride: ""
 fullnameOverride: ""

 serviceAccount:
@@ -60,6 +61,7 @@ bundleConfigMap: spire-bundle
 server:
  address: ""
  port: 8081
+  namespaceOverride: ""

 healthChecks:
  # -- override the host port used for health checking
@@ -66,6 +66,7 @@ A Helm chart to install the SPIRE server.
 | jwtIssuer | string | `"oidc-discovery.example.org"` |  |
 | logLevel | string | `"info"` |  |
 | nameOverride | string | `""` |  |
+| namespaceOverride | string | `""` |  |
 | nodeAttestor.k8sPsat.enabled | bool | `true` |  |
 | nodeAttestor.k8sPsat.serviceAccountAllowList | list | `[]` |  |
 | nodeSelector | object | `{}` |  |
@@ -23,6 +23,17 @@ If release name contains chart name it will be used as a full name.
 {{- end }}
 {{- end }}

+{{/*
+Allow the release namespace to be overridden for multi-namespace deployments in combined charts
+*/}}
+{{- define "spire-server.namespace" -}}
+  {{- if .Values.namespaceOverride -}}
+    {{- .Values.namespaceOverride -}}
+  {{- else -}}
+    {{- .Release.Namespace -}}
+  {{- end -}}
+{{- end -}}
+
 {{/*
 Create chart name and version as used by the chart label.
 */}}
@@ -1,5 +1,6 @@
+{{- $namespace := include "spire-server.namespace" . }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: {{ .Values.bundleConfigMap }}
-  namespace: {{ .Values.notifier.k8sbundle.namespace | default .Release.Namespace }}
+  namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}
@@ -1,9 +1,10 @@
-{{ $root := . }}
+{{- $root := . }}
+{{- $namespace := include "spire-server.namespace" . }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: {{ include "spire-server.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
 data:
  server.conf: |
    server {
@@ -60,7 +61,7 @@ data:

      Notifier "k8sbundle" {
        plugin_data {
-          namespace = {{ .Values.notifier.k8sbundle.namespace | default .Release.Namespace | quote }}
+          namespace = {{ .Values.notifier.k8sbundle.namespace | default $namespace | quote }}
          config_map = {{ .Values.bundleConfigMap | quote }}
        }
      }
@@ -5,6 +5,7 @@ apiVersion: spire.spiffe.io/v1alpha1
 kind: ClusterSPIFFEID
 metadata:
  name: {{ include "spire-controller-manager.fullname" $root }}-service-account-based
+  namespace: {{ include "spire-server.namespace" $root }}
 spec:
  spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }}
  {{- with .identities.podSelector }}
@@ -3,14 +3,14 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
  name: {{ include "spire-controller-manager.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
 data:
  controller-manager-config.yaml: |
    apiVersion: spire.spiffe.io/v1alpha1
    kind: ControllerManagerConfig
    metadata:
      name: {{ include "spire-controller-manager.fullname" . }}
-      namespace: {{ .Release.Namespace }}
+      namespace: {{ include "spire-server.namespace" . }}
      labels:
        {{- include "spire-server.labels" . | nindent 8 }}
    metrics:
@@ -20,7 +20,7 @@ data:
    leaderElection:
      leaderElect: true
      resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io
-      resourceNamespace: {{ .Release.Namespace }}
+      resourceNamespace: {{ include "spire-server.namespace" . }}
    validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook
    clusterName: {{ .Values.clusterName }}
    trustDomain: {{ .Values.trustDomain }}
@@ -3,7 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  name: {{ include "spire-controller-manager.fullname" . }}-leader-election
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
 rules:
  - apiGroups: [""]
    resources: ["configmaps"]
@@ -19,7 +19,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: {{ include "spire-controller-manager.fullname" . }}-leader-election
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
@@ -27,7 +27,7 @@ roleRef:
 subjects:
 - kind: ServiceAccount
  name: {{ include "spire-server.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -76,5 +76,5 @@ roleRef:
 subjects:
 - kind: ServiceAccount
  name: {{ include "spire-server.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
 {{- end }}
@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
  name: {{ include "spire-controller-manager.fullname" . }}-webhook
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
  labels:
    {{- include "spire-server.labels" . | nindent 4 }}
  {{- with .Values.controllerManager.service.annotations }}
@@ -8,7 +8,7 @@ webhooks:
    clientConfig:
      service:
        name: {{ include "spire-controller-manager.fullname" . }}-webhook
-        namespace: {{ .Release.Namespace }}
+        namespace: {{ include "spire-server.namespace" . }}
        path: /validate-spire-spiffe-io-v1alpha1-clusterfederatedtrustdomain
    failurePolicy: Fail
    name: vclusterfederatedtrustdomain.kb.io
@@ -22,7 +22,7 @@ webhooks:
    clientConfig:
      service:
        name: {{ include "spire-controller-manager.fullname" . }}-webhook
-        namespace: {{ .Release.Namespace }}
+        namespace: {{ include "spire-server.namespace" . }}
        path: /validate-spire-spiffe-io-v1alpha1-clusterspiffeid
    failurePolicy: Fail
    name: vclusterspiffeid.kb.io
@@ -3,6 +3,7 @@ apiVersion: autoscaling/v2beta1
 kind: HorizontalPodAutoscaler
 metadata:
  name: {{ include "spire-server.fullname" . }}
+  namespace: {{ include "spire-server.namespace" . }}
  labels:
    {{- include "spire-server.labels" . | nindent 4 }}
 spec:
@@ -1,9 +1,10 @@
+{{- $namespace := include "spire-server.namespace" . }}
 # Role to be able to push certificate bundles to a configmap
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
  name: {{ include "spire-server.fullname" . }}-bundle
-  namespace: {{ .Values.notifier.k8sbundle.namespace | default .Release.Namespace }}
+  namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}
 rules:
  - apiGroups: [""]
    resources: [configmaps]
@@ -18,7 +19,7 @@ kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
  name: {{ include "spire-server.fullname" . }}-cm
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ $namespace }}
 rules:
  - apiGroups: ["cert-manager.io"]
    resources:
@@ -35,11 +36,11 @@ kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
  name: {{ include "spire-server.fullname" . }}-cm
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ $namespace }}
 subjects:
  - kind: ServiceAccount
    name: {{ include "spire-server.serviceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
+    namespace: {{ $namespace }}
 roleRef:
  kind: Role
  name: {{ include "spire-server.fullname" . }}-cm
@@ -50,11 +51,11 @@ kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
  name: {{ include "spire-server.fullname" . }}-bundle
-  namespace: {{ .Values.notifier.k8sbundle.namespace | default .Release.Namespace }}
+  namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}
 subjects:
  - kind: ServiceAccount
    name: {{ include "spire-server.serviceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
+    namespace: {{ $namespace }}
 roleRef:
  kind: Role
  name: {{ include "spire-server.fullname" . }}-bundle
@@ -89,7 +90,7 @@ metadata:
 subjects:
  - kind: ServiceAccount
    name: {{ include "spire-server.serviceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
+    namespace: {{ $namespace }}
 roleRef:
  kind: ClusterRole
  name: {{ .Release.Namespace}}-{{ include "spire-server.fullname" . }}
@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
  name: {{ include "spire-server.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
  {{- with .Values.service.annotations }}
  annotations:
    {{- toYaml . | nindent 8 }}
@@ -3,6 +3,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: {{ include "spire-server.serviceAccountName" . }}
+  namespace: {{ include "spire-server.namespace" . }}
  labels:
    {{- include "spire-server.labels" . | nindent 4 }}
  {{- with .Values.serviceAccount.annotations }}
@@ -5,6 +5,7 @@ apiVersion: apps/v1
 kind: StatefulSet
 metadata:
  name: {{ include "spire-server.fullname" . }}
+  namespace: {{ include "spire-server.namespace" . }}
  labels:
    {{- include "spire-server.labels" . | nindent 4 }}
 spec:
@@ -2,6 +2,7 @@ apiVersion: v1
 kind: Pod
 metadata:
  name: "{{ include "spire-server.fullname" . }}-test-connection"
+  namespace: {{ include "spire-server.namespace" . }}
  labels:
    {{- include "spire-server.labels" . | nindent 4 }}
  annotations:
@@ -5,7 +5,7 @@ apiVersion: v1
 kind: Secret
 metadata:
  name: {{ include "spire-server.upstream-ca-secret" $root }}
-  namespace: {{ $root.Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
  labels:
    {{- include "spire-server.labels" $root | nindent 4 }}
 data:
@@ -16,6 +16,7 @@ image:

 imagePullSecrets: []
 nameOverride: ""
+namespaceOverride: ""
 fullnameOverride: ""

 serviceAccount: