Add resource namespace when using flux-local build hr

[mlallaouret]

Hello,

First, congrats for the tool, it is very powerful and very useful !

I am trying to use flux-local build hr to generate all the resources that will be deployed to a cluster to be able to process then after in another CI check step.
The issue I encountered is that once the resources are built, the namespace from the helmrelease is not injected in the built resources.
Did I miss something or do you think it would make sense to add this feature to flux-local

Thanks in advance

[allenporter]

Hi, thanks for reaching out and nice words. This tool uses flux build and helm template underneath to process all the resources, and so I would have expected any transformations to happen by those tools. Where does this happen in your production system?

I'm wondering if this is defined in a spec somewhere that explains what the rule are, or if there are flags missing to either of these tools to make that happen. Should helm template be adding this?

[mlallaouret]

I am trying to use flux-local in my CI process to validate PR before merging. For now I managed to use the diff feature for kustomization and helmreleases. It works perfectly.

I wanted also to use the kyverno feature. But for now, flux-local does not support the kyverno policy exceptions (https://kyverno.io/docs/writing-policies/exceptions/). And these policy exceptions can be configured limited to some namespaces. I wanted to use flux-local build hr -A to generate all the resources of a cluster and use the kyverno cli to validate them. That's where I encountered the issue with the namespace not being injected.

From what I already searched, it's "normal" that helm does not do it. Here is a comment in an issue that summarize it: helm/helm#3553 (maybe it's a bit old)
Here is an article which use kubectl apply --dry-run=client -f to inject the namespace when executing the helm template command: https://ambar-thecloudgarage.medium.com/a-tricky-one-to-solve-helm-template-output-with-namespaces-fe6460afb220. The issue is that kubectl needs to contact the k8s server even in --dry-run=client mode.

Maybe with kustomize there is an easier way to inject it after the helm template command ?

[allenporter]

OK so they seem to be saying:

This would be a flaw of the system not accepting the same inputs as Kubernetes. I'd ask you to go back to that project and ask them to implement this functionality. helm template is displaying the correct output that helm install and kubectl apply expect. This is not a design flaw from Helm's perspective.

Implying that systems downstream should expect missing namespaces. I don't personally have an opinion on this, but I lean towards not wanting to add additional layers on top at the moment so don't plan to make any changes.

FWIW I'm planning to drop kyverno support and plan to no longer maintain it.

[mlallaouret]

Ok thank you for your answers and the information on kyverno support.

For kyverno part, I think I will use flux-local build ks and do a loop on the helmreleases to generate the helm templates and add the namespace. It should do the trick.