Skip to content

Helmify uses .Release.Namespace for rolebindings despite setting -preserve-ns #179

@harrygodwin10

Description

@harrygodwin10

As found here: https://github.com/arttor/helmify/blob/main/pkg/processor/rbac/rolebinding.go#L60

This causes issues where a service account has a persisted namespace and a rolebinding uses .Release.Namespace

It creates something like:

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ include "chart.fullname" . }}-name
  labels:
    app: app
  {{- include "chart.labels" . | nindent 4 }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: '{{ include "chart.fullname" . }}-name'
subjects:
- kind: ServiceAccount
  name: '{{ include "chart.fullname" . }}-name'
  namespace: '{{ .Release.Namespace }}'

And my service account is:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include "chart.fullname" . }}-name
  namespace: persistednamespace
  labels:
    app: app
  {{- include "chart.labels" . | nindent 4 }}
  annotations:
    {{- toYaml .Values.deployment.serviceAccount.annotations | nindent 4 }}

Having run helmify -preserve-ns

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions