-
Notifications
You must be signed in to change notification settings - Fork 2.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
confusion around namespace replacement #880
Comments
Currently, Kustomize skips adding namespace for some hard-coded types, https://github.com/kubernetes-sigs/kustomize/blob/master/pkg/gvk/gvk.go#L154. |
here it would not be a |
I have the same problem and I would like to use |
I've just hit the same problem when using a role binding, where the subject is in a different namespace than metadata.name. The subject namespace is being overwritten. |
another example. when using istio, i need to be able to have a certificate and ingressgateway in namespace istio-system, but have the rest of the material (including the config generator) in its own. so e.g. I have:
if i do not set a namespace in kustomization.yaml, I end up w/ the Secret from the secretGenerator in the root namespace, but the deployment that would ref it is not, so it doesn't work. it seems there is no way to make this work. |
Hello, Wouldn't it be possible to add an option to the namespace key in kustomization.yaml to specify if we want it to override or not ?
|
|
For interest, I created a transformer to do this for me:
|
Can you please describe how you put the transformer in the |
I need to get around to creating a github repo w/ my generator + transformers. edit: they are here |
Issues go stale after 90d of inactivity. If this issue is safe to close now please do so with Send feedback to sig-testing, kubernetes/test-infra and/or fejta. |
/remove-lifecycle stale |
…369) * Upgrades cert-manager to v0.10.0 Structures CertificateIssuers into 2 overlays: - letsencrypt - self-signed * Moves namespace resource to cert-manager manifests instead of crds Corrects entries for namespace param substitution * Namespaces now governed through params and not Kustomization namespace Webhook Role Binding Namespace added caBundle field set in Webhook configuration for validation to pass in kubectl apply * Replaces apiGroup extensions with networking.k8s.io for 1.16 K8s * Remove namespace parameter from kustomization metadata.namespace * Restores namespace attribute to cert-manager manifest * Separates cert-manager's webhook role binding due to kustomization namespace issue Refer: kubernetes-sigs/kustomize#880 * Removes trailing 's' from resource file names * Strips off --- from beginning of the files * Splits cert-manager kustomization into cert-manager, webhook and ca-injector * Applications for Cert-Manager, Webhook and CA-Injector Removes labels and applies them through Applications * Modifies tests for cert-manager/cert-manager application * Updated tests for cert-manager application overlays Corrected params * Addressing review comments * Consolidates under application cert-manager * Removing unnecessary yaml formatting * Adds missing selector in cert-manager service * Minor correction in unit test * Upgrades certmanager to v0.11.0 * Fixes validatingwebhookconfiguration for certmanager webhook * Makes corrections to certmanager-kube-system resources Tests updated * Fix removing cert-manager-leaderelection role Adds extensions back to ingresses in controller-challenges clusterrole Images in Kustomization set to v0.11.0 * Corrects cert-manager-controller-challenges clusterrole * Updates overlays with new APIVersion * New convention for application overlay Addresses review comments * Removes cert-manager-kube-system-resources overlay as it is not an application * Corrects cert-manager application name
Issues go stale after 90d of inactivity. If this issue is safe to close now please do so with Send feedback to sig-testing, kubernetes/test-infra and/or fejta. |
/remove-lifecycle stale |
Issues go stale after 90d of inactivity. If this issue is safe to close now please do so with Send feedback to sig-testing, kubernetes/test-infra and/or fejta. |
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules:
You can:
Please send feedback to sig-contributor-experience at kubernetes/community. /lifecycle stale |
/remove-lifecycle stale |
I just hit this issue with my ingress as well. Is there an ETA for a fix? |
FWIW, I've had this problem and the best workaround I could find was to patch over the overridden namespace: patchesJson6902:
- target:
group: ""
version: v1
kind: ConfigMap
name: my-config-name
patch: |-
- op: replace
path: /metadata/namespace
value: other-namespace Not great if you've got a ton of resources but works in a pinch for a couple |
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules:
You can:
Please send feedback to sig-contributor-experience at kubernetes/community. /lifecycle stale |
/remove-lifecycle stale |
I have the same issue, when I have Istio Gateway, VirtualService in one namespace and I have to have certificate in the Istio-ingress namespace. |
I found this issue while trying to figure out why Kustomize wasn't overriding the namespace for a
|
@stianlagstad unless I am mistaken, |
@Moulick you're right, I've found an alternative solution: https://github.com/james-callahan/cert-manager-kustomize/tree/main/webhook#usage |
As @benjamin-wright mentioned, the following works: patchesJson6902:
- target:
group: ""
version: v1
kind: ConfigMap
name: my-config-name
patch: |-
- op: replace
path: /metadata/namespace
value: other-namespace When adding this, I get the output:
Using patches:
- target:
group: ""
version: v1
kind: ConfigMap
name: my-config-name
patch: |-
- op: replace
path: /metadata/namespace
value: other-namespace Has anyone found a work around for this using |
using the
|
kustomize has an ability to replace all namespaces in one config, setting
namespace: XXX
Naively I thought this meant all unset namepaces, but it actually overwrites all.
This creates a challenge when you have something that uses >1 namespace (e.g. cert-manager, it installs 1 thing into kube-system, rest into cert-manager).
I think maybe we want either:
unset only
oldNS: X -> newNS: Y
Although technically possible to json/strat patch all objects, this is exceptionally tedious when there are many of them.
The text was updated successfully, but these errors were encountered: