How to add label to existed namespace by helm

Question

I have a project to create a mutating webhook in the kube-system namespace, which needs to exclude webhook server deployment namespaces.

But the kube-system namespace has been created. How do I attach the required labels to it using Helm?

Answer 1

Helmfile offers hooks which are pretty neat for that:

releases:
- name: istio-ingress
  namespace: istio-ingress
  chart: istio/gateway
  wait: true
  hooks:
    - events:
        - presync
      showlogs: true
      command: sh
      args:
        - -c
        - "kubectl create namespace istio-ingress --dry-run=client -o yaml | kubectl apply -f -"
    - events:
        - presync
      showlogs: true
      command: sh
      args:
        - -c
        - "kubectl label --dry-run=client -o yaml --overwrite namespace istio-ingress istio-injection=enabled | kubectl apply -f -"

Answer 2

Since helm doesn't support managing namespaces directly (see: Helm 3 doesn't create namespace #5753), the "correct" way to do this is with a chart hook:

1. Create a service account for the namespace-labeling job:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include "chart.serviceAccountName" . }}
  labels:
    {{- include "chart.labels" . | nindent 4 }}
  annotations:
    {{- toYaml .Values.serviceAccount.annotations | nindent 4 }}

2. Create a role with the appropriate permissions:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: label-ns
rules:
- apiGroups: [""]
  resources: ["namespaces"]
  resourceNames: [{{ .Release.Namespace }}]
  verbs: ["get", "patch"]

3. Bind the service account to the role:

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ .Release.Namespace }}:label-ns
subjects:
  - kind: ServiceAccount
    name: {{ include "chart.serviceAccountName" . }}
    namespace: {{ .Release.Namespace }}
roleRef:
  kind: Role
  name: label-ns
  apiGroup: rbac.authorization.k8s.io

4. Create your namespace-labeling job, making sure to use the appropriate serviceAccountName:

apiVersion: batch/v1
kind: Job
metadata:
  name: label-ns
  labels:
    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
    app.kubernetes.io/instance: {{ .Release.Name | quote }}
    app.kubernetes.io/version: {{ .Chart.AppVersion }}
    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
  annotations:
    "helm.sh/hook": post-install
    "helm.sh/hook-delete-policy": hook-succeeded
spec:
  template:
    metadata:
      labels:
        app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
        app.kubernetes.io/instance: {{ .Release.Name | quote }}
        helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    spec:
      restartPolicy: Never
      serviceAccountName: {{ include "chart.serviceAccountName" . }}
      containers:
      - name: label-ns
        image: "bitnami/kubectl:latest"
        command:
          - kubectl
          - label
          - ns
          - {{ .Release.Namespace }}
          - foo=bar

Answer 3

Since the kube-system namespace is a core part of Kubernetes (every cluster has it preinstalled and some core components run there) Helm can't manage it.

Some possible things you could do instead:

• Make the per-namespace labels opt-in, not opt-out; only apply the webhook in namespaces where the label is present, rather than in every namespace except flagged ones. (Istio's sidecar injector works this way.)
• Exclude kube-system as a special case in the code.
• Manually run kubectl label namespace outside of Helm.
• Make your larger-scale deployment pipeline run the kubectl command (for example, if you have a Jenkins build that installs the webhook, also make it set the label).