✨ add support for namespace overrides (#718)

* Adds support for namespace overrides in subchart use

Co-authored-by: David Lundy <[email protected]>

traefik/Changelog.md

@@ -1,8 +1,37 @@
 # Change Log
 
+## 20.2.0 
+
+**Release date:** 2021-02-27
+
+![AppVersion: v2.9.4](https://img.shields.io/static/v1?label=AppVersion&message=v2.9.4&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+
+* Adds support for namespace overrides in subchart use 
+* Document recent changes in the README (#717) 
+
+### Default value changes
+
+```diff
+diff --git a/traefik/values.yaml b/traefik/values.yaml
+index 97a1b71..a1ef792 100644
+--- a/traefik/values.yaml
++++ b/traefik/values.yaml
+@@ -725,5 +725,7 @@ podSecurityContext:
+ # Extra objects to deploy (value evaluated as a template)
+ #
+ # In some cases, it can avoid the need for additional, extended or adhoc deployments.
+-# See #595 for more details and traefik/tests/extra.yaml for example.
++# See #595 for more details and traefik/tests/values/extra.yaml for example.
+ extraObjects: []
++
++# namespaceOverride: traefik
+```
+
 ## 20.1.1 
 
-**Release date:** 2022-11-09
+**Release date:** 2022-11-10
 
 ![AppVersion: v2.9.4](https://img.shields.io/static/v1?label=AppVersion&message=v2.9.4&color=success&logo=)
 ![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)

traefik/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: traefik
 description: A Traefik based Kubernetes ingress controller
 type: application
-version: 20.1.1
+version: 20.2.0
 appVersion: v2.9.4
 keywords:
   - traefik
@@ -24,5 +24,4 @@ maintainers:
     email: [email protected]
 icon: https://raw.githubusercontent.com/traefik/traefik/v2.3/docs/content/assets/img/traefik.logo.png
 annotations:
-  artifacthub.io/changes: |
-    - fix: use consistent appVersion with Traefik Proxy
+  artifacthub.io/changes: "- Adds support for namespace overrides in subchart use\n- Document recent changes in the README (#717)\n"

traefik/templates/_helpers.tpl

@@ -53,6 +53,19 @@ helm.sh/chart: {{ template "traefik.chart" . }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end }}
 
+{{/*
+Construct the namespace for all namespaced resources
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+Preserve the default behavior of the Release namespace if no override is provided
+*/}}
+{{- define "traefik.namespace" -}}
+{{- if .Values.namespaceOverride -}}
+{{- .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- .Release.Namespace -}}
+{{- end -}}
+{{- end -}}
+
 {{/*
 The name of the service account to use
 */}}

traefik/templates/daemonset.yaml

@@ -20,6 +20,7 @@ apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   name: {{ template "traefik.fullname" . }}
+  namespace: {{ template "traefik.namespace" . }}
   labels:
   {{- include "traefik.labels" . | nindent 4 }}
   {{- with .Values.deployment.labels }}

traefik/templates/dashboard-hook-ingressroute.yaml

@@ -3,6 +3,7 @@ apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
 metadata:
   name: {{ template "traefik.fullname" . }}-dashboard
+  namespace: {{ template "traefik.namespace" . }}
   annotations:
     helm.sh/hook: "post-install,post-upgrade"
     meta.helm.sh/release-name: {{ .Release.Name }}

traefik/templates/deployment.yaml

@@ -17,6 +17,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ template "traefik.fullname" . }}
+  namespace: {{ template "traefik.namespace" . }}
   labels:
   {{- include "traefik.labels" . | nindent 4 }}
   {{- with .Values.deployment.labels }}

traefik/templates/gateway.yaml

@@ -5,7 +5,7 @@ apiVersion: gateway.networking.k8s.io/v1alpha2
 kind: Gateway
 metadata:
   name: traefik-gateway
-  namespace: {{ default .Release.Namespace .Values.experimental.kubernetesGateway.namespace }}
+  namespace: {{ default (include "traefik.namespace" .) .Values.experimental.kubernetesGateway.namespace }}
 spec:
   gatewayClassName: traefik
   listeners:

traefik/templates/hpa.yaml

@@ -16,6 +16,7 @@ apiVersion: autoscaling/v2beta1
 kind: HorizontalPodAutoscaler
 metadata:
   name: {{ template "traefik.fullname" . }}
+  namespace: {{ template "traefik.namespace" . }}
   labels:
     {{- include "traefik.labels" . | nindent 4 }}
 spec:

traefik/templates/ingressclass.yaml

@@ -16,6 +16,7 @@ metadata:
   labels:
     {{- include "traefik.labels" . | nindent 4 }}
   name: {{ template "traefik.fullname" . }}
+  namespace: {{ template "traefik.namespace" . }}
 spec:
   controller: traefik.io/ingress-controller
 {{- end -}}

traefik/templates/poddisruptionbudget.yaml

@@ -7,6 +7,7 @@ apiVersion: policy/v1beta1
 kind: PodDisruptionBudget
 metadata:
   name: {{ template "traefik.fullname" . }}
+  namespace: {{ template "traefik.namespace" . }}
   labels:
     {{- include "traefik.labels" . | nindent 4 }}
 spec:

traefik/templates/pvc.yaml

@@ -3,6 +3,7 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: {{ template "traefik.fullname" . }}
+  namespace: {{ template "traefik.namespace" . }}
   annotations:
   {{- with .Values.persistence.annotations  }}
   {{ toYaml . | nindent 4 }}

traefik/templates/rbac/role.yaml

@@ -3,6 +3,7 @@ kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ template "traefik.fullname" . }}
+  namespace: {{ template "traefik.namespace" . }}
   labels:
     {{- include "traefik.labels" . | nindent 4 }}
 rules:

traefik/templates/rbac/rolebinding.yaml

@@ -3,6 +3,7 @@ kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ template "traefik.fullname" . }}
+  namespace: {{ template "traefik.namespace" . }}
   labels:
     {{- include "traefik.labels" . | nindent 4 }}
 roleRef:

traefik/templates/service-hub.yaml

@@ -4,6 +4,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: traefik-hub
+  namespace: {{ template "traefik.namespace" . }}
   {{- template "traefik.service-metadata" . }}
 spec:
   type: ClusterIP

traefik/templates/service-internal.yaml

@@ -22,6 +22,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ $fullname}}-internal
+  namespace: {{ template "traefik.namespace" . }}
   {{- template "traefik.service-internal-metadata" . }}
   annotations:
   {{- with .Values.service.internal.annotations }}
@@ -42,6 +43,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ $fullname }}-internal-udp
+  namespace: {{ template "traefik.namespace" . }}
   {{- template "traefik.service-internal-metadata" . }}
   annotations:
   {{- with .Values.service.internal.annotations }}

traefik/templates/service.yaml

@@ -31,6 +31,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ template "traefik.fullname" . }}
+  namespace: {{ template "traefik.namespace" . }}
   {{- template "traefik.service-metadata" . }}
   annotations:
   {{- with (merge .Values.service.annotationsTCP .Values.service.annotations) }}
@@ -51,6 +52,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ template "traefik.fullname" . }}-udp
+  namespace: {{ template "traefik.namespace" . }}
   {{- template "traefik.service-metadata" . }}
   annotations:
   {{- with (merge .Values.service.annotationsUDP .Values.service.annotations) }}

traefik/templates/tlsoption.yaml

@@ -3,6 +3,7 @@ apiVersion: traefik.containo.us/v1alpha1
 kind: TLSOption
 metadata:
   name: {{ $name }}
+  namespace: {{ template "traefik.namespace" $ }}
   labels:
     {{- include "traefik.labels" $ | nindent 4 }}
 spec:

traefik/templates/tlsstore.yaml

@@ -3,6 +3,7 @@ apiVersion: traefik.containo.us/v1alpha1
 kind: TLSStore
 metadata:
   name: {{ $name }}
+  namespace: {{ template "traefik.namespace" $ }}
   labels:
     {{- include "traefik.labels" $ | nindent 4 }}
 spec:

traefik/tests/daemonset-config_test.yaml

@@ -125,3 +125,20 @@ tests:
       - equal:
           path: spec.updateStrategy.type
           value: OnDelete
+  - it: should use helm managed namespace as default behavior
+    set:
+      deployment:
+        kind: DaemonSet
+    asserts:
+      - equal:
+          path: metadata.namespace
+          value: NAMESPACE
+  - it: should accept overridden namespace
+    set:
+      namespaceOverride: "traefik-ns-override"
+      deployment:
+        kind: DaemonSet
+    asserts:
+      - equal:
+          path: metadata.namespace
+          value: "traefik-ns-override"

traefik/tests/deployment-config_test.yaml

@@ -138,3 +138,15 @@ tests:
       - equal:
           path: spec.strategy.type
           value: OnDelete
+  - it: should use helm managed namespace as default behavior
+    asserts:
+      - equal:
+          path: metadata.namespace
+          value: NAMESPACE
+  - it: should accept overridden namespace
+    set:
+      namespaceOverride: "traefik-ns-override"
+    asserts:
+      - equal:
+          path: metadata.namespace
+          value: "traefik-ns-override"

traefik/tests/gateway-config_test.yaml

@@ -58,3 +58,22 @@ tests:
       - equal:
           path: metadata.namespace
           value: "default"
+  - it: should install Gateway in default namespace
+    set:
+      experimental:
+        kubernetesGateway:
+          enabled: true
+    asserts:
+      - equal:
+          path: metadata.namespace
+          value: "NAMESPACE"
+  - it: should install Gateway in namespaceOverride
+    set:
+      experimental:
+        kubernetesGateway:
+          enabled: true
+      namespaceOverride: "traefik-ns-override"
+    asserts:
+      - equal:
+          path: metadata.namespace
+          value: "traefik-ns-override"

traefik/tests/hub-integration-config_test.yaml

@@ -57,6 +57,26 @@ tests:
             name: "traefikhub-tunl"
             targetPort: traefikhub-tunl
             protocol: TCP
+  - it: should set internal hub service default namespace
+    template: service-hub.yaml
+    set:
+      hub:
+        enabled: true
+    asserts:
+      - equal:
+          path: metadata.namespace
+          value: "NAMESPACE"
+  - it: should set internal hub service default namespace override
+    template: service-hub.yaml
+    set:
+      namespaceOverride: "traefik-ns-override"
+      hub:
+        enabled: true
+    asserts:
+      - equal:
+          path: metadata.namespace
+          value: "traefik-ns-override"
+
   - it: should use specified ports for Hub when enabled
     template: service-hub.yaml
     set:

traefik/tests/poddisruptionbudget-config_test.yaml

@@ -50,3 +50,20 @@ tests:
           value: 33%
       - isEmpty:
           path: spec.minAvailable
+  - it: should use helm managed namespace as default behavior
+    set:
+      podDisruptionBudget:
+        enabled: true
+    asserts:
+      - equal:
+          path: metadata.namespace
+          value: NAMESPACE
+  - it: should accept overridden namespace
+    set:
+      namespaceOverride: "traefik-ns-override"
+      podDisruptionBudget:
+        enabled: true
+    asserts:
+      - equal:
+          path: metadata.namespace
+          value: "traefik-ns-override"

traefik/tests/rbac-config_test.yaml

@@ -164,3 +164,22 @@ tests:
       - equal:
           path: metadata.labels.[rbac.authorization.k8s.io/aggregate-to-edit]
           value: "true"
+  - it: should use helm managed namespace as default behavior
+    set:
+      rbac:
+        namespaced: true
+    asserts:
+      - equal:
+          path: metadata.namespace
+          value: NAMESPACE
+        template: rbac/role.yaml
+  - it: should accept overridden namespace
+    set:
+      namespaceOverride: "traefik-ns-override"
+      rbac:
+        namespaced: true
+    asserts:
+      - equal:
+          path: metadata.namespace
+          value: "traefik-ns-override"
+        template: rbac/role.yaml

traefik/tests/service-config_test.yaml

@@ -236,3 +236,47 @@ tests:
     asserts:
       - failedTemplate:
           errorMessage: "You cannot enable http3 without enabling tls"
+          path: items[1].spec.ports[0].protocol
+          value: UDP
+  - it: should use helm managed namespace as default behavior UDP
+    set:
+      ports:
+        udp:
+          port: 3000
+          protocol: UDP
+    asserts:
+      - equal:
+          path: metadata.namespace
+          value: NAMESPACE
+  - it: should use helm managed namespace as default behavior TCP
+    set:
+      ports:
+        tcp:
+          port: 3000
+          protocol: TCP
+    asserts:
+      - equal:
+          path: metadata.namespace
+          value: NAMESPACE
+  - it: should accept overridden namespace UDP
+    set:
+      namespaceOverride: "traefik-ns-override"
+      ports:
+        udp:
+          port: 3000
+          protocol: UDP
+    asserts:
+      - equal:
+          path: metadata.namespace
+          value: "traefik-ns-override"
+  - it: should accept overridden namespace TCP
+    set:
+      namespaceOverride: "traefik-ns-override"
+      ports:
+        tcp:
+          port: 3000
+          protocol: TCP
+    asserts:
+      - equal:
+          path: metadata.namespace
+          value: "traefik-ns-override"