Namespace override

This patch makes it possible to install the subcharts in different namespaces as needed. Signed-off-by: Kevin Fox <[email protected]>
2023-03-13 15:03:16 -07:00
parent 661000a29a
commit 03db6bb5fe
40 changed files with 221 additions and 58 deletions
@@ -66,6 +66,7 @@ A Helm chart to install the SPIRE server.
 | jwtIssuer | string | `"oidc-discovery.example.org"` |  |
 | logLevel | string | `"info"` |  |
 | nameOverride | string | `""` |  |
+| namespaceOverride | string | `""` |  |
 | nodeAttestor.k8sPsat.enabled | bool | `true` |  |
 | nodeAttestor.k8sPsat.serviceAccountAllowList | list | `[]` |  |
 | nodeSelector | object | `{}` |  |
@@ -23,6 +23,17 @@ If release name contains chart name it will be used as a full name.
 {{- end }}
 {{- end }}

+{{/*
+Allow the release namespace to be overridden for multi-namespace deployments in combined charts
+*/}}
+{{- define "spire-server.namespace" -}}
+  {{- if .Values.namespaceOverride -}}
+    {{- .Values.namespaceOverride -}}
+  {{- else -}}
+    {{- .Release.Namespace -}}
+  {{- end -}}
+{{- end -}}
+
 {{/*
 Create chart name and version as used by the chart label.
 */}}
@@ -1,5 +1,6 @@
+{{- $namespace := include "spire-server.namespace" . }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: {{ .Values.bundleConfigMap }}
-  namespace: {{ .Values.notifier.k8sbundle.namespace | default .Release.Namespace }}
+  namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}
@@ -1,9 +1,10 @@
-{{ $root := . }}
+{{- $root := . }}
+{{- $namespace := include "spire-server.namespace" . }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: {{ include "spire-server.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
 data:
  server.conf: |
    server {
@@ -60,7 +61,7 @@ data:

      Notifier "k8sbundle" {
        plugin_data {
-          namespace = {{ .Values.notifier.k8sbundle.namespace | default .Release.Namespace | quote }}
+          namespace = {{ .Values.notifier.k8sbundle.namespace | default $namespace | quote }}
          config_map = {{ .Values.bundleConfigMap | quote }}
        }
      }
@@ -5,6 +5,7 @@ apiVersion: spire.spiffe.io/v1alpha1
 kind: ClusterSPIFFEID
 metadata:
  name: {{ include "spire-controller-manager.fullname" $root }}-service-account-based
+  namespace: {{ include "spire-server.namespace" $root }}
 spec:
  spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }}
  {{- with .identities.podSelector }}
@@ -3,14 +3,14 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
  name: {{ include "spire-controller-manager.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
 data:
  controller-manager-config.yaml: |
    apiVersion: spire.spiffe.io/v1alpha1
    kind: ControllerManagerConfig
    metadata:
      name: {{ include "spire-controller-manager.fullname" . }}
-      namespace: {{ .Release.Namespace }}
+      namespace: {{ include "spire-server.namespace" . }}
      labels:
        {{- include "spire-server.labels" . | nindent 8 }}
    metrics:
@@ -20,7 +20,7 @@ data:
    leaderElection:
      leaderElect: true
      resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io
-      resourceNamespace: {{ .Release.Namespace }}
+      resourceNamespace: {{ include "spire-server.namespace" . }}
    validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook
    clusterName: {{ .Values.clusterName }}
    trustDomain: {{ .Values.trustDomain }}
@@ -3,7 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  name: {{ include "spire-controller-manager.fullname" . }}-leader-election
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
 rules:
  - apiGroups: [""]
    resources: ["configmaps"]
@@ -19,7 +19,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: {{ include "spire-controller-manager.fullname" . }}-leader-election
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
@@ -27,7 +27,7 @@ roleRef:
 subjects:
 - kind: ServiceAccount
  name: {{ include "spire-server.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -76,5 +76,5 @@ roleRef:
 subjects:
 - kind: ServiceAccount
  name: {{ include "spire-server.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
 {{- end }}
@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
  name: {{ include "spire-controller-manager.fullname" . }}-webhook
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
  labels:
    {{- include "spire-server.labels" . | nindent 4 }}
  {{- with .Values.controllerManager.service.annotations }}
@@ -8,7 +8,7 @@ webhooks:
    clientConfig:
      service:
        name: {{ include "spire-controller-manager.fullname" . }}-webhook
-        namespace: {{ .Release.Namespace }}
+        namespace: {{ include "spire-server.namespace" . }}
        path: /validate-spire-spiffe-io-v1alpha1-clusterfederatedtrustdomain
    failurePolicy: Fail
    name: vclusterfederatedtrustdomain.kb.io
@@ -22,7 +22,7 @@ webhooks:
    clientConfig:
      service:
        name: {{ include "spire-controller-manager.fullname" . }}-webhook
-        namespace: {{ .Release.Namespace }}
+        namespace: {{ include "spire-server.namespace" . }}
        path: /validate-spire-spiffe-io-v1alpha1-clusterspiffeid
    failurePolicy: Fail
    name: vclusterspiffeid.kb.io
@@ -3,6 +3,7 @@ apiVersion: autoscaling/v2beta1
 kind: HorizontalPodAutoscaler
 metadata:
  name: {{ include "spire-server.fullname" . }}
+  namespace: {{ include "spire-server.namespace" . }}
  labels:
    {{- include "spire-server.labels" . | nindent 4 }}
 spec:
@@ -1,9 +1,10 @@
+{{- $namespace := include "spire-server.namespace" . }}
 # Role to be able to push certificate bundles to a configmap
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
  name: {{ include "spire-server.fullname" . }}-bundle
-  namespace: {{ .Values.notifier.k8sbundle.namespace | default .Release.Namespace }}
+  namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}
 rules:
  - apiGroups: [""]
    resources: [configmaps]
@@ -18,7 +19,7 @@ kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
  name: {{ include "spire-server.fullname" . }}-cm
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ $namespace }}
 rules:
  - apiGroups: ["cert-manager.io"]
    resources:
@@ -35,11 +36,11 @@ kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
  name: {{ include "spire-server.fullname" . }}-cm
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ $namespace }}
 subjects:
  - kind: ServiceAccount
    name: {{ include "spire-server.serviceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
+    namespace: {{ $namespace }}
 roleRef:
  kind: Role
  name: {{ include "spire-server.fullname" . }}-cm
@@ -50,11 +51,11 @@ kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
  name: {{ include "spire-server.fullname" . }}-bundle
-  namespace: {{ .Values.notifier.k8sbundle.namespace | default .Release.Namespace }}
+  namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}
 subjects:
  - kind: ServiceAccount
    name: {{ include "spire-server.serviceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
+    namespace: {{ $namespace }}
 roleRef:
  kind: Role
  name: {{ include "spire-server.fullname" . }}-bundle
@@ -89,7 +90,7 @@ metadata:
 subjects:
  - kind: ServiceAccount
    name: {{ include "spire-server.serviceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
+    namespace: {{ $namespace }}
 roleRef:
  kind: ClusterRole
  name: {{ .Release.Namespace}}-{{ include "spire-server.fullname" . }}
@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
  name: {{ include "spire-server.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
  {{- with .Values.service.annotations }}
  annotations:
    {{- toYaml . | nindent 8 }}
@@ -3,6 +3,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: {{ include "spire-server.serviceAccountName" . }}
+  namespace: {{ include "spire-server.namespace" . }}
  labels:
    {{- include "spire-server.labels" . | nindent 4 }}
  {{- with .Values.serviceAccount.annotations }}
@@ -5,6 +5,7 @@ apiVersion: apps/v1
 kind: StatefulSet
 metadata:
  name: {{ include "spire-server.fullname" . }}
+  namespace: {{ include "spire-server.namespace" . }}
  labels:
    {{- include "spire-server.labels" . | nindent 4 }}
 spec:
@@ -2,6 +2,7 @@ apiVersion: v1
 kind: Pod
 metadata:
  name: "{{ include "spire-server.fullname" . }}-test-connection"
+  namespace: {{ include "spire-server.namespace" . }}
  labels:
    {{- include "spire-server.labels" . | nindent 4 }}
  annotations:
@@ -5,7 +5,7 @@ apiVersion: v1
 kind: Secret
 metadata:
  name: {{ include "spire-server.upstream-ca-secret" $root }}
-  namespace: {{ $root.Release.Namespace }}
+  namespace: {{ include "spire-server.namespace" . }}
  labels:
    {{- include "spire-server.labels" $root | nindent 4 }}
 data:
@@ -16,6 +16,7 @@ image:

 imagePullSecrets: []
 nameOverride: ""
+namespaceOverride: ""
 fullnameOverride: ""

 serviceAccount: