added namespace field in the namespace scoped resource templates of helm chart #7256

longwuyuan · 2021-06-20T16:45:16Z

What this PR does / why we need it:

User reported that the command helm template does not render namespace field, for the namespace scoped resources, of this controller's helm chart. So this PR adds the namespace spec field oneliner, in the helm template yaml files, of namespaced resources, of the ingress-nginx controller helm chart.

#7226

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)

Which issue/s this PR fixes

fixes # #7226

How Has This Been Tested?

__$ git remote -v
origin [email protected]:longwuyuan/ingress-nginx.git (fetch)
origin [email protected]:longwuyuan/ingress-nginx.git (push)
__$ pwd
/.../ingress-nginx/charts
__$ ls
ingress-nginx
__$ helm template -n testns0 ingcontroller0 ./ingress-nginx

---
# Source: ingress-nginx/templates/controller-serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    helm.sh/chart: ingress-nginx-3.33.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingcontroller0
    app.kubernetes.io/version: "0.47.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
  name: ingcontroller0-ingress-nginx
  namespace: testns0
automountServiceAccountToken: true
---
# Source: ingress-nginx/templates/controller-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    helm.sh/chart: ingress-nginx-3.33.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingcontroller0
    app.kubernetes.io/version: "0.47.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
  name: ingcontroller0-ingress-nginx-controller
  namespace: testns0
data:
---
# Source: ingress-nginx/templates/clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    helm.sh/chart: ingress-nginx-3.33.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingcontroller0
    app.kubernetes.io/version: "0.47.0"
    app.kubernetes.io/managed-by: Helm
  name: ingcontroller0-ingress-nginx
rules:
  - apiGroups:
      - ""
    resources:
      - configmaps
      - endpoints
      - nodes
      - pods
      - secrets
    verbs:
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - nodes
    verbs:
      - get
  - apiGroups:
      - ""
    resources:
      - services
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
      - "networking.k8s.io" # k8s 1.14+
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
      - patch
  - apiGroups:
      - extensions
      - "networking.k8s.io" # k8s 1.14+
    resources:
      - ingresses/status
    verbs:
      - update
  - apiGroups:
      - "networking.k8s.io" # k8s 1.14+
    resources:
      - ingressclasses
    verbs:
      - get
      - list
      - watch
---
# Source: ingress-nginx/templates/clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    helm.sh/chart: ingress-nginx-3.33.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingcontroller0
    app.kubernetes.io/version: "0.47.0"
    app.kubernetes.io/managed-by: Helm
  name: ingcontroller0-ingress-nginx
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ingcontroller0-ingress-nginx
subjects:
  - kind: ServiceAccount
    name: ingcontroller0-ingress-nginx
    namespace: "testns0"
---
# Source: ingress-nginx/templates/controller-role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    helm.sh/chart: ingress-nginx-3.33.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingcontroller0
    app.kubernetes.io/version: "0.47.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
  name: ingcontroller0-ingress-nginx
  namespace: testns0
rules:
  - apiGroups:
      - ""
    resources:
      - namespaces
    verbs:
      - get
  - apiGroups:
      - ""
    resources:
      - configmaps
      - pods
      - secrets
      - endpoints
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - services
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
      - "networking.k8s.io" # k8s 1.14+
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
      - "networking.k8s.io" # k8s 1.14+
    resources:
      - ingresses/status
    verbs:
      - update
  - apiGroups:
      - "networking.k8s.io" # k8s 1.14+
    resources:
      - ingressclasses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - configmaps
    resourceNames:
      - ingress-controller-leader-nginx
    verbs:
      - get
      - update
  - apiGroups:
      - ""
    resources:
      - configmaps
    verbs:
      - create
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
      - patch
---
# Source: ingress-nginx/templates/controller-rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    helm.sh/chart: ingress-nginx-3.33.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingcontroller0
    app.kubernetes.io/version: "0.47.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
  name: ingcontroller0-ingress-nginx
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: ingcontroller0-ingress-nginx
  namespace: testns0
subjects:
  - kind: ServiceAccount
    name: ingcontroller0-ingress-nginx
    namespace: "testns0"
---
# Source: ingress-nginx/templates/controller-service-webhook.yaml
apiVersion: v1
kind: Service
metadata:
  labels:
    helm.sh/chart: ingress-nginx-3.33.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingcontroller0
    app.kubernetes.io/version: "0.47.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
  name: ingcontroller0-ingress-nginx-controller-admission
  namespace: testns0
spec:
  type: ClusterIP
  ports:
    - name: https-webhook
      port: 443
      targetPort: webhook
  selector:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingcontroller0
    app.kubernetes.io/component: controller
---
# Source: ingress-nginx/templates/controller-service.yaml
apiVersion: v1
kind: Service
metadata:
  annotations:
  labels:
    helm.sh/chart: ingress-nginx-3.33.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingcontroller0
    app.kubernetes.io/version: "0.47.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
  name: ingcontroller0-ingress-nginx-controller
  namespace: testns0
spec:
  type: LoadBalancer
  ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: http
    - name: https
      port: 443
      protocol: TCP
      targetPort: https
  selector:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingcontroller0
    app.kubernetes.io/component: controller
---
# Source: ingress-nginx/templates/controller-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    helm.sh/chart: ingress-nginx-3.33.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingcontroller0
    app.kubernetes.io/version: "0.47.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
  name: ingcontroller0-ingress-nginx-controller
  namespace: testns0
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: ingress-nginx
      app.kubernetes.io/instance: ingcontroller0
      app.kubernetes.io/component: controller
  replicas: 1
  revisionHistoryLimit: 10
  minReadySeconds: 0
  template:
    metadata:
      labels:
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/instance: ingcontroller0
        app.kubernetes.io/component: controller
    spec:
      dnsPolicy: ClusterFirst
      containers:
        - name: controller
          image: "k8s.gcr.io/ingress-nginx/controller:v0.47.0@sha256:a1e4efc107be0bb78f32eaec37bef17d7a0c81bec8066cdf2572508d21351d0b"
          imagePullPolicy: IfNotPresent
          lifecycle: 
            preStop:
              exec:
                command:
                - /wait-shutdown
          args:
            - /nginx-ingress-controller
            - --publish-service=$(POD_NAMESPACE)/ingcontroller0-ingress-nginx-controller
            - --election-id=ingress-controller-leader
            - --ingress-class=nginx
            - --configmap=$(POD_NAMESPACE)/ingcontroller0-ingress-nginx-controller
            - --validating-webhook=:8443
            - --validating-webhook-certificate=/usr/local/certificates/cert
            - --validating-webhook-key=/usr/local/certificates/key
          securityContext:
            capabilities:
                drop:
                - ALL
                add:
                - NET_BIND_SERVICE
            runAsUser: 101
            allowPrivilegeEscalation: true
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: LD_PRELOAD
              value: /usr/local/lib/libmimalloc.so
          livenessProbe: 
            failureThreshold: 5
            httpGet:
              path: /healthz
              port: 10254
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          readinessProbe: 
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: 10254
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          ports:
            - name: http
              containerPort: 80
              protocol: TCP
            - name: https
              containerPort: 443
              protocol: TCP
            - name: webhook
              containerPort: 8443
              protocol: TCP
          volumeMounts:
            - name: webhook-cert
              mountPath: /usr/local/certificates/
              readOnly: true
          resources: 
            requests:
              cpu: 100m
              memory: 90Mi
      nodeSelector: 
        kubernetes.io/os: linux
      serviceAccountName: ingcontroller0-ingress-nginx
      terminationGracePeriodSeconds: 300
      volumes:
        - name: webhook-cert
          secret:
            secretName: ingcontroller0-ingress-nginx-admission
---
# Source: ingress-nginx/templates/admission-webhooks/validating-webhook.yaml
# before changing this value, check the required kubernetes version
# https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#prerequisites
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  labels:
    helm.sh/chart: ingress-nginx-3.33.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingcontroller0
    app.kubernetes.io/version: "0.47.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: admission-webhook
  name: ingcontroller0-ingress-nginx-admission
webhooks:
  - name: validate.nginx.ingress.kubernetes.io
    matchPolicy: Equivalent
    rules:
      - apiGroups:
          - networking.k8s.io
        apiVersions:
          - v1beta1
        operations:
          - CREATE
          - UPDATE
        resources:
          - ingresses
    failurePolicy: Fail
    sideEffects: None
    admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        namespace: "testns0"
        name: ingcontroller0-ingress-nginx-controller-admission
        path: /networking/v1beta1/ingresses
---
# Source: ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ingcontroller0-ingress-nginx-admission
  namespace: testns0
  annotations:
    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
  labels:
    helm.sh/chart: ingress-nginx-3.33.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingcontroller0
    app.kubernetes.io/version: "0.47.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: admission-webhook
---
# Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ingcontroller0-ingress-nginx-admission
  annotations:
    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
  labels:
    helm.sh/chart: ingress-nginx-3.33.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingcontroller0
    app.kubernetes.io/version: "0.47.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: admission-webhook
rules:
  - apiGroups:
      - admissionregistration.k8s.io
    resources:
      - validatingwebhookconfigurations
    verbs:
      - get
      - update
---
# Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name:  ingcontroller0-ingress-nginx-admission
  annotations:
    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
  labels:
    helm.sh/chart: ingress-nginx-3.33.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingcontroller0
    app.kubernetes.io/version: "0.47.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: admission-webhook
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ingcontroller0-ingress-nginx-admission
subjects:
  - kind: ServiceAccount
    name: ingcontroller0-ingress-nginx-admission
    namespace: "testns0"
---
# Source: ingress-nginx/templates/admission-webhooks/job-patch/role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name:  ingcontroller0-ingress-nginx-admission
  namespace: testns0
  annotations:
    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
  labels:
    helm.sh/chart: ingress-nginx-3.33.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingcontroller0
    app.kubernetes.io/version: "0.47.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: admission-webhook
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - get
      - create
---
# Source: ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: ingcontroller0-ingress-nginx-admission
  namespace: testns0
  annotations:
    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
  labels:
    helm.sh/chart: ingress-nginx-3.33.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingcontroller0
    app.kubernetes.io/version: "0.47.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: admission-webhook
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: ingcontroller0-ingress-nginx-admission
subjects:
  - kind: ServiceAccount
    name: ingcontroller0-ingress-nginx-admission
    namespace: "testns0"
---
# Source: ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: ingcontroller0-ingress-nginx-admission-create
  namespace: testns0
  annotations:
    "helm.sh/hook": pre-install,pre-upgrade
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
  labels:
    helm.sh/chart: ingress-nginx-3.33.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingcontroller0
    app.kubernetes.io/version: "0.47.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: admission-webhook
spec:
  template:
    metadata:
      name: ingcontroller0-ingress-nginx-admission-create
      labels:
        helm.sh/chart: ingress-nginx-3.33.0
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/instance: ingcontroller0
        app.kubernetes.io/version: "0.47.0"
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/component: admission-webhook
    spec:
      containers:
        - name: create
          image: "docker.io/jettech/kube-webhook-certgen:v1.5.1"
          imagePullPolicy: IfNotPresent
          args:
            - create
            - --host=ingcontroller0-ingress-nginx-controller-admission,ingcontroller0-ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
            - --namespace=$(POD_NAMESPACE)
            - --secret-name=ingcontroller0-ingress-nginx-admission
          env:
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
      restartPolicy: OnFailure
      serviceAccountName: ingcontroller0-ingress-nginx-admission
      securityContext:
        runAsNonRoot: true
        runAsUser: 2000
---
# Source: ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: ingcontroller0-ingress-nginx-admission-patch
  namespace: testns0
  annotations:
    "helm.sh/hook": post-install,post-upgrade
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
  labels:
    helm.sh/chart: ingress-nginx-3.33.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingcontroller0
    app.kubernetes.io/version: "0.47.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: admission-webhook
spec:
  template:
    metadata:
      name: ingcontroller0-ingress-nginx-admission-patch
      labels:
        helm.sh/chart: ingress-nginx-3.33.0
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/instance: ingcontroller0
        app.kubernetes.io/version: "0.47.0"
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/component: admission-webhook
    spec:
      containers:
        - name: patch
          image: "docker.io/jettech/kube-webhook-certgen:v1.5.1"
          imagePullPolicy: IfNotPresent
          args:
            - patch
            - --webhook-name=ingcontroller0-ingress-nginx-admission
            - --namespace=$(POD_NAMESPACE)
            - --patch-mutating=false
            - --secret-name=ingcontroller0-ingress-nginx-admission
            - --patch-failure-policy=Fail
          env:
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
      restartPolicy: OnFailure
      serviceAccountName: ingcontroller0-ingress-nginx-admission
      securityContext:
        runAsNonRoot: true
        runAsUser: 2000

Checklist:

My change requires a change to the documentation.
I have updated the documentation accordingly.
I've read the CONTRIBUTION guide
I have added tests to cover my changes.
All new and existing tests passed.

…elm chart

k8s-ci-robot · 2021-06-20T16:45:24Z

Hi @longwuyuan. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

rikatz · 2021-06-20T21:08:15Z

/ok-to-test

rikatz · 2021-06-20T21:12:53Z

@longwuyuan Error: unable to build kubernetes objects from release manifest: error validating "": error validating data: ValidationError(RoleBinding.roleRef): unknown field "namespace" in io.k8s.api.rbac.v1.RoleRef

I'll leave the approval here, and once this can be merged/tests passed someone (@tao12345666333 @cpanato or @strongjz ) can issue a lgtm here :)

/approve

tao12345666333 · 2021-06-21T00:20:54Z

/area helm
/assign

longwuyuan · 2021-06-21T03:33:53Z

I will check the failed e2e test and update. Thanks, ; Long

…

On Mon, 21 Jun, 2021, 5:51 AM Jintao Zhang, ***@***.***> wrote: /area helm /assign — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#7256 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABGZVWTS3IFGY3R5ACI6VRDTT2AXFANCNFSM47AHKCRQ> .

longwuyuan · 2021-06-21T09:04:52Z

Error: unable to build kubernetes objects from release manifest: error validating "": error validating data: ValidationError(RoleBinding.roleRef): unknown field "namespace" in io.k8s.api.rbac.v1.RoleRef

I found this https://stackoverflow.com/questions/51961432/cant-to-add-namespace-field-to-roleref-in-rolebinding#51962012

@tao12345666333, Should I will try to remove the field from role and rolebindings files ?
Any advise/suggestions on the appropriate fix for that failed test would help.

longwuyuan · 2021-06-21T09:45:36Z

I am able to reproduce the CI test error on minikube so will try to see if removing fields from role & rolebindings resources;

__$ helm -n testns0 install ingcontroller0 ./ingress-nginx --values ingress-nginx/ci/daemonset-customconfig-values.yaml 
Error: unable to build kubernetes objects from release manifest: error validating "": error validating data: ValidationError(RoleBinding.roleRef): unknown field "namespace" in io.k8s.api.rbac.v1.RoleRef

tao12345666333 · 2021-06-21T09:54:43Z

charts/ingress-nginx/templates/controller-rolebinding.yaml

@@ -10,6 +10,7 @@ roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ include "ingress-nginx.fullname" . }}
+  namespace: {{ .Release.Namespace }}


please remove this one.

namespace should be under metadata here:

ingress-nginx/charts/ingress-nginx/templates/controller-rolebinding.yaml

Lines 4 to 8 in f9492ff

metadata:

labels:

{{- include "ingress-nginx.labels" . | nindent 4 }}

app.kubernetes.io/component: controller

name: {{ include "ingress-nginx.fullname" . }}

➜ ~ kubectl explain RoleBinding.roleRef KIND: RoleBinding VERSION: rbac.authorization.k8s.io/v1 RESOURCE: roleRef <Object> DESCRIPTION: RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error. RoleRef contains information that points to the role being used FIELDS: apiGroup <string> -required- APIGroup is the group for the resource being referenced kind <string> -required- Kind is the type of resource being referenced name <string> -required- Name is the name of resource being referenced

ok. Proves how stupid I am. Apologies for the noise. Fixing it now

tao12345666333 · 2021-06-21T09:58:09Z

You just wrote it in the wrong place.
Its location should be RoleBinding.metadata.namespace

longwuyuan · 2021-06-21T10:47:31Z

@tao12345666333, I moved the namespace field from roleRef to metdata but I did the edit right here on the github gui, so did it result in my commits not being squashed ?

tao12345666333 · 2021-06-21T10:59:31Z

Don't worry.

/label tide/merge-method-squash

rikatz · 2021-06-21T11:00:37Z

We can squash then on the merge via the bot, or you can squash with:

git log (and grab the HEAD commit id)
git rebase -i IDFROMABOVE
In this step, change your last commit from "pick" to "fixup"
git log again and check there's only one commit
git push -f origin

tao12345666333

I think we can merge it.

/lgtm
/hold

@rikatz If you think it’s okay, you can cancle hold

k8s-ci-robot · 2021-06-21T11:07:28Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: longwuyuan, rikatz, tao12345666333

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~charts/ingress-nginx/OWNERS~~ [rikatz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

longwuyuan · 2021-06-21T11:08:35Z

I squashed on my laptop. But push failed And suggested I do a pull. Then like the idiot that I am instead of force push, I did a pull, and landed back into the merge commit pothole. I barely recalled that bot magic for squashing was introduced recently, so saved my skin, this time. So now I have to learn more and avoid this in future. Thanks tons and gratitude for so much kindness. No limit to joy that I made my first PR , even though so unclean. Honor of a lifetime. Gratitude. Thanks, ; Long

…

On Mon, 21 Jun, 2021, 4:30 PM Ricardo Katz, ***@***.***> wrote: We can squash then on the merge via the bot, or you can squash with: - git log (and grab the HEAD commit id) - git rebase -i IDFROMABOVE In this step, change your last commit from "pick" to "fixup" - git log again and check there's only one commit - git push -f origin — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#7256 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABGZVWQCOFPDMVSINLCOSJTTT4LWLANCNFSM47AHKCRQ> .

rikatz · 2021-06-21T11:55:24Z

/hold cancel

Thanks for your effort on this @longwuyuan :)

rikatz · 2021-06-21T11:56:52Z

@tao12345666333 maybe we should release a new helm chart version with the latest corrections.

If so, I suggest you or @longwuyuan step 5 of https://github.com/kubernetes/ingress-nginx/blob/master/RELEASE.md (remember to also update the Changelog) and once this gets merged, a new helm chart is available ;)

tao12345666333 · 2021-06-21T12:23:26Z

OK，let me make a new release.

added namespace field in the namespace scoped resource templates of h…

f9492ff

…elm chart

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jun 20, 2021

k8s-ci-robot requested review from ChiefAlexander and cmluciano June 20, 2021 16:45

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jun 20, 2021

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jun 20, 2021

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 20, 2021

k8s-ci-robot assigned tao12345666333 Jun 21, 2021

k8s-ci-robot added the area/helm Issues or PRs related to helm charts label Jun 21, 2021

tao12345666333 mentioned this pull request Jun 21, 2021

Helm: Chart not using helm-flag '--namespace' #7226

Closed

tao12345666333 reviewed Jun 21, 2021

View reviewed changes

moved namespace field from roleRef to metadata

fb32059

k8s-ci-robot added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Jun 21, 2021

tao12345666333 reviewed Jun 21, 2021

View reviewed changes

k8s-ci-robot added do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. lgtm "Looks good to me", indicates that a PR is ready to be merged. labels Jun 21, 2021

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 21, 2021

k8s-ci-robot merged commit 2a190d2 into kubernetes:master Jun 21, 2021

tao12345666333 mentioned this pull request Jun 21, 2021

helm: release helm chart v3.34.0 #7258

Merged

5 tasks

hairmare mentioned this pull request Jun 25, 2021

fix(infra-apps): bump nginx-ingress to 0.34.* adfinis/helm-charts#288

Merged

6 tasks

coderabbitai bot mentioned this pull request Mar 5, 2024

Patch 1 egovernments/DIGIT-DevOps#2490

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

added namespace field in the namespace scoped resource templates of helm chart #7256

added namespace field in the namespace scoped resource templates of helm chart #7256

longwuyuan commented Jun 20, 2021

k8s-ci-robot commented Jun 20, 2021

rikatz commented Jun 20, 2021

rikatz commented Jun 20, 2021

tao12345666333 commented Jun 21, 2021

longwuyuan commented Jun 21, 2021 via email

longwuyuan commented Jun 21, 2021 •

edited

Loading

longwuyuan commented Jun 21, 2021

tao12345666333 Jun 21, 2021 •

edited

Loading

longwuyuan Jun 21, 2021

tao12345666333 commented Jun 21, 2021

longwuyuan commented Jun 21, 2021

tao12345666333 commented Jun 21, 2021

rikatz commented Jun 21, 2021

tao12345666333 left a comment

k8s-ci-robot commented Jun 21, 2021

longwuyuan commented Jun 21, 2021 via email

rikatz commented Jun 21, 2021

rikatz commented Jun 21, 2021

tao12345666333 commented Jun 21, 2021

	metadata:
	labels:
	{{- include "ingress-nginx.labels" . \| nindent 4 }}
	app.kubernetes.io/component: controller
	name: {{ include "ingress-nginx.fullname" . }}

added namespace field in the namespace scoped resource templates of helm chart #7256

added namespace field in the namespace scoped resource templates of helm chart #7256

Conversation

longwuyuan commented Jun 20, 2021

What this PR does / why we need it:

Types of changes

Which issue/s this PR fixes

How Has This Been Tested?

Checklist:

k8s-ci-robot commented Jun 20, 2021

rikatz commented Jun 20, 2021

rikatz commented Jun 20, 2021

tao12345666333 commented Jun 21, 2021

longwuyuan commented Jun 21, 2021 via email

longwuyuan commented Jun 21, 2021 • edited Loading

longwuyuan commented Jun 21, 2021

tao12345666333 Jun 21, 2021 • edited Loading

Choose a reason for hiding this comment

longwuyuan Jun 21, 2021

Choose a reason for hiding this comment

tao12345666333 commented Jun 21, 2021

longwuyuan commented Jun 21, 2021

tao12345666333 commented Jun 21, 2021

rikatz commented Jun 21, 2021

tao12345666333 left a comment

Choose a reason for hiding this comment

k8s-ci-robot commented Jun 21, 2021

longwuyuan commented Jun 21, 2021 via email

rikatz commented Jun 21, 2021

rikatz commented Jun 21, 2021

tao12345666333 commented Jun 21, 2021

longwuyuan commented Jun 21, 2021 •

edited

Loading

tao12345666333 Jun 21, 2021 •

edited

Loading