carvel-dev / kapp-controller

Continuous delivery and package management for Kubernetes.
https://carvel.dev/kapp-controller
Apache License 2.0
262 stars 101 forks source link

Packaging API: Need an effective way to customize the helmTemplate name and namespace options #409

Closed voor closed 2 years ago

voor commented 2 years ago

Describe the problem/challenge you have We use AppCR currently and install packages from a privileged namespace (one that has more permissive roles) into another namespace(s) as a typical practice.

In particular, it's very common for us to have the following in our App CR:

spec:
  fetch:
  - imgpkgBundle:
      image: registry.example.com/imgpkg/charts/external-dns:5.4.8
  template:
  - helmTemplate:
      name: external-dns # THIS
      namespace: external-dns # THIS
      path: chart/
      valuesFrom:
        - secretRef:
            name: external-dns-values
  - ytt:
      ignoreUnknownComments: true
      inline:
        pathsFrom:
        - secretRef:
            name: external-dns-values
      paths:
      - '-'
      #! This was a really great idea to just use the same values file from helm and ytt.
      - chart/values.yaml
      - config/
  - kbld:
      paths:
      - '-'
      - .imgpkg/images.yml
  deploy:
  - kapp:
      rawOptions:
      - --wait-timeout=5m
      - --diff-changes=true

Of note is the helm template including steps explicitly for name and namespace.

We are currently able to translate this to a Package that looks like this:

  template:
    spec:
      fetch:
        - imgpkgBundle:
            image: #@ data.values.bundle.image
      template:
      - helmTemplate:
          name: external-dns # THIS
          namespace: external-dns # THIS
          path: chart/
      - ytt:
          ignoreUnknownComments: true
          paths:
          - '-'
          #! This was a really great idea to just use the same values file from helm and ytt.
          - chart/values.yaml
          - config/
      - kbld:
          paths:
          - '-'
          - .imgpkg/images.yml
      deploy:
      - kapp:
          rawOptions:
          - --wait-timeout=5m
          - --diff-changes=true

And fit the values in properly with a PackageInstall that looks like this:

apiVersion: packaging.carvel.dev/v1alpha1
kind: PackageInstall
metadata:
  name: external-dns
  namespace: tap-install
  annotations:
    ext.packaging.carvel.dev/ytt-paths-from-secret-name.0: external-dns-something
spec:
  serviceAccountName: "tap-install-sa"
  packageRef:
    refName: external-dns.mycompany.com
    versionSelection:
      constraints: ">=0.0.0"
      prereleases:
        identifiers: [beta]
  values:
  - secretRef:
      name: external-dns-something

Note the inclusion of both the values and annotation of external-dns-something -- we're fine with this, it works, it's not great, but we have a way forward that's a workaround.

We do not have a workaround for the parts marked # THIS -- the name and namespace that is passed into helm template. There is currently nothing in the Packaging API that would allow us to override this.

For singletons, like metrics-server, or Harbor, or something that generally has "one of" we are not blocked, because the Package we make can hard-code this. However, for things that we like to deploy a lot of (databases, messaging, caching, etc.) we are stuck.

Describe the solution you'd like Something that can let us change those values, even if it's temporarily:

kind: PackageInstall
metadata:
  name: external-dns
  namespace: tap-install
  annotations:
    ext.packaging.carvel.dev/helmTemplate-name: bob
    ext.packaging.carvel.dev/helmTemplate-namespace: alice

While you come up with a better UX and long-term fix.

Anything else you would like to add: We are happy with something short-term that unblocks us and eager to see a longer term plan around this level of customization.


Vote on this request

This is an invitation to the community to vote on issues, to help us prioritize our backlog. Use the "smiley face" up to the right of this comment to vote.

👍 "I would like to see this addressed as soon as possible" 👎 "There are other more important things to focus on right now"

We are also happy to receive and review Pull Requests if you want to help working on this issue.

cppforlife commented 2 years ago

Something that can let us change those values, even if it's temporarily:

i'm game for short term solution descirbed above => adding 2 annotations (i tweaked names a little bit):

ext.packaging.carvel.dev/helm-template-name: bob
ext.packaging.carvel.dev/helm-template-namespace: alice