Add recommendation for namespaceLayout (#127)

Co-authored-by: Marco Franssen <[email protected]>

charts/spire/charts/spire-server/templates/_helpers.tpl

@@ -29,6 +29,42 @@ Allow the release namespace to be overridden for multi-namespace deployments in
 {{- define "spire-server.namespace" -}}
   {{- if .Values.namespaceOverride -}}
     {{- .Values.namespaceOverride -}}
+  {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
+    {{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }}
+      {{- .Values.global.spire.namespaces.server.name }}
+    {{- else }}
+      {{- printf "spire-server" }}
+    {{- end }}
+  {{- else -}}
+    {{- .Release.Namespace -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "spire-server.agent-namespace" -}}
+  {{- if .Values.namespaceOverride -}}
+    {{- .Values.namespaceOverride -}}
+  {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
+    {{- if ne (len (dig "spire" "namespaces" "system" "name" "" .Values.global)) 0 }}
+      {{- .Values.global.spire.namespaces.system.name }}
+    {{- else }}
+      {{- printf "spire-system" }}
+    {{- end }}
+  {{- else -}}
+    {{- .Release.Namespace -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "spire-server.bundle-namespace" -}}
+  {{- if .Values.notifier.k8sbundle.namespace }}
+    {{- .Values.notifier.k8sbundle.namespace }}
+  {{- else if .Values.namespaceOverride -}}
+    {{- .Values.namespaceOverride -}}
+  {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
+    {{- if ne (len (dig "spire" "namespaces" "system" "name" "" .Values.global)) 0 }}
+      {{- .Values.global.spire.namespaces.system.name }}
+    {{- else }}
+      {{- printf "spire-system" }}
+    {{- end }}
   {{- else -}}
     {{- .Release.Namespace -}}
   {{- end -}}
@@ -101,7 +137,7 @@ Create the name of the service account to use
 {{- if ne (len .Values.nodeAttestor.k8sPsat.serviceAccountAllowList) 0 }}
 {{- .Values.nodeAttestor.k8sPsat.serviceAccountAllowList | toJson }}
 {{- else }}
-[{{ printf "%s:%s-agent" .Release.Namespace .Release.Name | quote }}]
+[{{ printf "%s:%s-agent" (include "spire-server.agent-namespace" .) .Release.Name | quote }}]
 {{- end }}
 {{- end }}
 

charts/spire/charts/spire-server/templates/bundle-configmap.yaml

@@ -1,9 +1,9 @@
-{{- $namespace := include "spire-server.namespace" . }}
+{{- $namespace := include "spire-server.bundle-namespace" . }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "spire-lib.bundle-configmap" . }}
-  namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}
+  namespace: {{ $namespace }}
   {{- with .Values.configMap.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

charts/spire/charts/spire-server/templates/configmap.yaml

@@ -131,7 +131,7 @@ plugins:
   Notifier:
     k8sbundle:
       plugin_data:
-        namespace: {{ .Values.notifier.k8sbundle.namespace | default (include "spire-server.namespace" .) | quote }}
+        namespace: {{ include "spire-server.bundle-namespace" . | quote }}
         config_map: {{ include "spire-lib.bundle-configmap" . | quote }}
 
   {{- with .Values.upstreamAuthority.disk }}

charts/spire/charts/spire-server/templates/roles.yaml

@@ -1,10 +1,11 @@
 {{- $namespace := include "spire-server.namespace" . }}
+{{- $bundleNamespace := include "spire-server.bundle-namespace" . }}
 # Role to be able to push certificate bundles to a configmap
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ include "spire-lib.bundle-configmap" . }}
-  namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}
+  namespace: {{ $bundleNamespace }}
 rules:
   - apiGroups: [""]
     resources: [configmaps]
@@ -52,7 +53,7 @@ kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ include "spire-lib.bundle-configmap" . }}
-  namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}
+  namespace: {{ $bundleNamespace }}
 subjects:
   - kind: ServiceAccount
     name: {{ include "spire-server.serviceAccountName" . }}