Configurable global ns for Helm in the plugin's config

chart/kubeapps/Chart.yaml

@@ -31,4 +31,4 @@ maintainers:
 name: kubeapps
 sources:
   - https://github.com/vmware-tanzu/kubeapps
-version: 10.3.4-dev0
+version: 10.4.0-dev0

chart/kubeapps/templates/_helpers.tpl

@@ -239,10 +239,15 @@ Returns a JSON list of cluster names only (without sensitive tokens etc.)
 {{- end -}}
 
 {{/*
-Returns the name of the globalRepos namespace
+Returns the name of the global packaging namespace for the Helm plugin.
+It uses the value passed in the plugin's config, but falls back to the "release namespace + suffix" formula.
 */}}
-{{- define "kubeapps.globalReposNamespace" -}}
-{{- printf "%s%s" .Release.Namespace .Values.apprepository.globalReposNamespaceSuffix -}}
+{{- define "kubeapps.helmGlobalPackagingNamespace" -}}
+  {{- if .Values.kubeappsapis.pluginConfig.helm.packages.v1alpha1.globalPackagingNamespace }}
+      {{- printf "%s" .Values.kubeappsapis.pluginConfig.helm.packages.v1alpha1.globalPackagingNamespace -}}
+  {{- else -}}
+      {{- printf "%s%s" .Release.Namespace .Values.apprepository.globalReposNamespaceSuffix -}}
+  {{- end -}}
 {{- end -}}
 
 {{/*

chart/kubeapps/templates/apprepository/apprepositories-secret.yaml

@@ -5,7 +5,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: {{ printf "apprepo-%s-secrets" .name }}
-  namespace: {{ default (include "kubeapps.globalReposNamespace" $) .namespace | quote }}
+  namespace: {{ default (include "kubeapps.helmGlobalPackagingNamespace" $) .namespace | quote }}
   labels: {{- include "common.labels.standard" $ | nindent 4 }}
     {{- if $.Values.commonLabels }}
     {{- include "common.tplvalues.render" ( dict "value" $.Values.commonLabels "context" $ ) | nindent 4 }}
@@ -30,11 +30,11 @@ data:
   {{- end }}
 ---
 {{/* credentials are required in the release namespace for syncer jobs */}}
-{{- if or .namespace $.Values.apprepository.globalReposNamespaceSuffix }}
+{{- if or .namespace $.Values.apprepository.globalReposNamespaceSuffix $.Values.kubeappsapis.pluginConfig.helm.packages.v1alpha1.globalPackagingNamespace}}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ printf "%s-apprepo-%s" (default (include "kubeapps.globalReposNamespace" $) .namespace) .name }}
+  name: {{ printf "%s-apprepo-%s" (default (include "kubeapps.helmGlobalPackagingNamespace" $) .namespace) .name }}
   namespace: {{ $.Release.Namespace | quote }}
   labels: {{- include "common.labels.standard" $ | nindent 4 }}
     {{- if $.Values.commonLabels }}

chart/kubeapps/templates/apprepository/apprepositories.yaml

@@ -4,7 +4,7 @@ apiVersion: kubeapps.com/v1alpha1
 kind: AppRepository
 metadata:
   name: {{ .name }}
-  namespace: {{ default (include "kubeapps.globalReposNamespace" $) .namespace | quote }}
+  namespace: {{ default (include "kubeapps.helmGlobalPackagingNamespace" $) .namespace | quote }}
   labels: {{- include "common.labels.standard" $ | nindent 4 }}
     {{- if $.Values.commonLabels }}
     {{- include "common.tplvalues.render" ( dict "value" $.Values.commonLabels "context" $ ) | nindent 4 }}

chart/kubeapps/templates/apprepository/deployment.yaml

@@ -96,7 +96,7 @@ spec:
             {{- end }}
             - --repo-sync-cmd=/asset-syncer
             - --namespace={{ .Release.Namespace }}
-            - --global-repos-namespace={{ include "kubeapps.globalReposNamespace" . }}
+            - --global-repos-namespace={{ include "kubeapps.helmGlobalPackagingNamespace" . }}
             - --database-secret-name={{ include "kubeapps.postgresql.secretName" . }}
             - --database-secret-key=postgres-password
             - --database-url={{ printf "%s:%d" (include "kubeapps.postgresql.host" .) (int (include "kubeapps.postgresql.port" .)) }}

chart/kubeapps/templates/apprepository/rbac.yaml

@@ -222,7 +222,7 @@ apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
 kind: RoleBinding
 metadata:
   name: {{ printf "kubeapps:%s:global-repos-read" .Release.Namespace | quote }}
-  namespace: {{ include "kubeapps.globalReposNamespace" . | quote }}
+  namespace: {{ include "kubeapps.helmGlobalPackagingNamespace" . | quote }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole

chart/kubeapps/templates/dashboard/configmap.yaml

@@ -69,7 +69,7 @@ data:
     {
       "kubeappsCluster": {{ include "kubeapps.kubeappsCluster" . | quote }},
       "kubeappsNamespace": {{ .Release.Namespace | quote }},
-      "globalReposNamespace": {{ include "kubeapps.globalReposNamespace" . | quote }},
+      "helmGlobalNamespace": {{ include "kubeapps.helmGlobalPackagingNamespace" . | quote }},
       "carvelGlobalNamespace": {{ .Values.kubeappsapis.pluginConfig.kappController.packages.v1alpha1.globalPackagingNamespace | quote }},
       "appVersion": {{ printf "v%s" .Chart.AppVersion | quote }},
       "authProxyEnabled": {{ .Values.authProxy.enabled }},

chart/kubeapps/templates/kubeappsapis/deployment.yaml

@@ -108,7 +108,7 @@ spec:
             - --pinniped-proxy-ca-cert=/etc/pinniped-proxy-tls/ca.crt
             {{- end }}
             {{- end }}
-            - --global-repos-namespace={{ include "kubeapps.globalReposNamespace" . }}
+            - --global-repos-namespace={{ include "kubeapps.helmGlobalPackagingNamespace" . }}
             {{- if .Values.kubeappsapis.qps }}
             - --kube-api-qps={{ .Values.kubeappsapis.qps }}
             {{- end }}

chart/kubeapps/templates/shared/helm-global-repos-namespace.yaml

@@ -0,0 +1,6 @@
+{{- if or .Values.apprepository.globalReposNamespaceSuffix .Values.kubeappsapis.pluginConfig.helm.packages.v1alpha1.globalPackagingNamespace }}
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ include "kubeapps.helmGlobalPackagingNamespace" . | quote }}
+{{- end }}

chart/kubeapps/values.yaml

@@ -870,7 +870,7 @@ apprepository:
     ##   - myRegistryKeySecretName
     ##
     pullSecrets: []
-  ## @param apprepository.globalReposNamespaceSuffix Suffix for the namespace of global repos. Defaults to empty for backwards compatibility.
+  ## @param apprepository.globalReposNamespaceSuffix Suffix for the namespace of global repos in the Helm plugin. Defaults to empty for backwards compatibility. Ignored if kubeappsapis.pluginConfig.helm.packages.v1alpha1.globalPackagingNamespace is set.
   ##
   globalReposNamespaceSuffix: ""
   ## @param apprepository.initialRepos [array] Initial chart repositories to configure
@@ -1492,6 +1492,13 @@ kubeappsapis:
             patch: 3
           ## @param kubeappsapis.pluginConfig.core.packages.v1alpha1.timeoutSeconds Value to wait for Kubernetes commands to complete
           timeoutSeconds: 300
+    helm:
+      packages:
+        v1alpha1:
+          ## @param kubeappsapis.pluginConfig.helm.packages.v1alpha1.globalPackagingNamespace Custom global packaging namespace. Using this value will override the current "kubeapps release namespace + suffix" pattern and will create a new namespace if not exists.
+          globalPackagingNamespace: ""
+          ## @param kubeappsapis.pluginConfig.helm.packages.v1alpha1.userManagedSecrets Default policy for handling repository secrets, either managed by the user or by kubeapps-apis
+          userManagedSecrets: false
     kappController:
       packages:
         v1alpha1:

cmd/apprepository-controller/cmd/root.go

@@ -78,7 +78,7 @@ func setFlags(c *cobra.Command) {
 	c.Flags().StringSliceVar(&serveOpts.RepoSyncImagePullSecrets, "repo-sync-image-pullsecrets", nil, "optional reference to secrets in the same namespace to use for pulling the image used by this pod")
 	c.Flags().StringVar(&serveOpts.RepoSyncCommand, "repo-sync-cmd", "/chart-repo", "command used to sync/delete repos for repo-sync-image")
 	c.Flags().StringVar(&serveOpts.KubeappsNamespace, "namespace", "kubeapps", "Namespace to discover AppRepository resources")
-	c.Flags().StringVar(&serveOpts.GlobalReposNamespace, "global-repos-namespace", "kubeapps", "Namespace for global repos")
+	c.Flags().StringVar(&serveOpts.GlobalPackagingNamespace, "global-repos-namespace", "kubeapps", "Namespace for global repos")
 	c.Flags().BoolVar(&serveOpts.ReposPerNamespace, "repos-per-namespace", true, "Defaults to watch for repos in all namespaces. Switch to false to watch only the configured namespace.")
 	c.Flags().StringVar(&serveOpts.DBURL, "database-url", "localhost", "Database URL")
 	c.Flags().StringVar(&serveOpts.DBUser, "database-user", "root", "Database user")

cmd/apprepository-controller/cmd/root_test.go

@@ -31,7 +31,7 @@ func TestParseFlagsCorrect(t *testing.T) {
 				RepoSyncImagePullSecrets: nil,
 				RepoSyncCommand:          "/chart-repo",
 				KubeappsNamespace:        "kubeapps",
-				GlobalReposNamespace:     "kubeapps",
+				GlobalPackagingNamespace: "kubeapps",
 				ReposPerNamespace:        true,
 				DBURL:                    "localhost",
 				DBUser:                   "root",
@@ -62,7 +62,7 @@ func TestParseFlagsCorrect(t *testing.T) {
 				ImagePullSecretsRefs:     []v1.LocalObjectReference{{Name: "s1"}, {Name: " s2"}, {Name: " s3"}},
 				RepoSyncCommand:          "/chart-repo",
 				KubeappsNamespace:        "kubeapps",
-				GlobalReposNamespace:     "kubeapps",
+				GlobalPackagingNamespace: "kubeapps",
 				ReposPerNamespace:        true,
 				DBURL:                    "localhost",
 				DBUser:                   "root",
@@ -110,7 +110,7 @@ func TestParseFlagsCorrect(t *testing.T) {
 				ImagePullSecretsRefs:     []v1.LocalObjectReference{{Name: "s1"}, {Name: "s2"}, {Name: "s3"}},
 				RepoSyncCommand:          "foo04",
 				KubeappsNamespace:        "foo05",
-				GlobalReposNamespace:     "kubeapps-repos-global",
+				GlobalPackagingNamespace: "kubeapps-repos-global",
 				ReposPerNamespace:        false,
 				DBURL:                    "foo06",
 				DBUser:                   "foo07",

cmd/apprepository-controller/server/controller.go

@@ -653,7 +653,7 @@ func apprepoSyncJobArgs(apprepo *apprepov1alpha1.AppRepository, config Config) [
 		args = append(args, "--user-agent-comment="+config.UserAgentComment)
 	}
 
-	args = append(args, "--global-repos-namespace="+config.GlobalReposNamespace)
+	args = append(args, "--global-repos-namespace="+config.GlobalPackagingNamespace)
 	args = append(args, "--namespace="+apprepo.GetNamespace(), apprepo.GetName(), apprepo.Spec.URL, apprepo.Spec.Type)
 
 	if len(apprepo.Spec.OCIRepositories) > 0 {

cmd/apprepository-controller/server/controller_test.go

@@ -1891,7 +1891,7 @@ func makeDefaultConfig() Config {
 		RepoSyncImagePullSecrets: []string{},
 		RepoSyncCommand:          "/chart-repo",
 		KubeappsNamespace:        "kubeapps",
-		GlobalReposNamespace:     "kubeapps-global",
+		GlobalPackagingNamespace: "kubeapps-global",
 		ReposPerNamespace:        true,
 		DBURL:                    "postgresql.kubeapps",
 		DBUser:                   "admin",

cmd/apprepository-controller/server/server.go

@@ -23,7 +23,7 @@ type Config struct {
 	ImagePullSecretsRefs     []corev1.LocalObjectReference
 	RepoSyncCommand          string
 	KubeappsNamespace        string
-	GlobalReposNamespace     string
+	GlobalPackagingNamespace string
 	DBURL                    string
 	DBUser                   string
 	DBName                   string

cmd/asset-syncer/cmd/root.go

@@ -129,7 +129,7 @@ func setRootFlags(c *cobra.Command) {
 	c.PersistentFlags().BoolVar(&serveOpts.TlsInsecureSkipVerify, "tls-insecure-skip-verify", false, "Skip TLS verification")
 	c.PersistentFlags().StringVar(&serveOpts.FilterRules, "filter-rules", "", "JSON blob with the rules to filter assets")
 	c.PersistentFlags().BoolVar(&serveOpts.PassCredentials, "pass-credentials", false, "pass credentials to all domains")
-	c.PersistentFlags().StringVar(&serveOpts.GlobalReposNamespace, "global-repos-namespace", "kubeapps", "Namespace for global repos")
+	c.PersistentFlags().StringVar(&serveOpts.GlobalPackagingNamespace, "global-repos-namespace", "kubeapps", "Namespace for global repos")
 }
 
 func setSyncFlags(c *cobra.Command) {

cmd/asset-syncer/cmd/root_test.go

@@ -34,18 +34,18 @@ func TestParseFlagsCorrect(t *testing.T) {
 				"--pass-credentials", "true",
 			},
 			server.Config{
-				DatabaseURL:           "foo01",
-				DatabaseName:          "foo02",
-				DatabaseUser:          "foo03",
-				Debug:                 true,
-				Namespace:             "foo04",
-				GlobalReposNamespace:  "kubeapps-global",
-				OciRepositories:       []string{},
-				TlsInsecureSkipVerify: true,
-				FilterRules:           "foo06",
-				PassCredentials:       true,
-				UserAgent:             "asset-syncer/devel (foo05)",
-				UserAgentComment:      "foo05",
+				DatabaseURL:              "foo01",
+				DatabaseName:             "foo02",
+				DatabaseUser:             "foo03",
+				Debug:                    true,
+				Namespace:                "foo04",
+				GlobalPackagingNamespace: "kubeapps-global",
+				OciRepositories:          []string{},
+				TlsInsecureSkipVerify:    true,
+				FilterRules:              "foo06",
+				PassCredentials:          true,
+				UserAgent:                "asset-syncer/devel (foo05)",
+				UserAgentComment:         "foo05",
 			},
 			true,
 		},
@@ -66,18 +66,18 @@ func TestParseFlagsCorrect(t *testing.T) {
 				"--oci-repositories", "foo07",
 			},
 			server.Config{
-				DatabaseURL:           "foo01",
-				DatabaseName:          "foo02",
-				DatabaseUser:          "foo03",
-				Debug:                 true,
-				Namespace:             "foo04",
-				GlobalReposNamespace:  "kubeapps-global",
-				OciRepositories:       []string{"foo07"},
-				TlsInsecureSkipVerify: true,
-				FilterRules:           "foo06",
-				PassCredentials:       true,
-				UserAgent:             "asset-syncer/devel (foo05)",
-				UserAgentComment:      "foo05",
+				DatabaseURL:              "foo01",
+				DatabaseName:             "foo02",
+				DatabaseUser:             "foo03",
+				Debug:                    true,
+				Namespace:                "foo04",
+				GlobalPackagingNamespace: "kubeapps-global",
+				OciRepositories:          []string{"foo07"},
+				TlsInsecureSkipVerify:    true,
+				FilterRules:              "foo06",
+				PassCredentials:          true,
+				UserAgent:                "asset-syncer/devel (foo05)",
+				UserAgentComment:         "foo05",
 			},
 			true,
 		},
@@ -97,18 +97,18 @@ func TestParseFlagsCorrect(t *testing.T) {
 				"--pass-credentials", "true",
 			},
 			server.Config{
-				DatabaseURL:           "foo01",
-				DatabaseName:          "foo02",
-				DatabaseUser:          "foo03",
-				Debug:                 true,
-				Namespace:             "foo04",
-				GlobalReposNamespace:  "kubeapps-global",
-				OciRepositories:       []string{},
-				TlsInsecureSkipVerify: true,
-				FilterRules:           "foo06",
-				PassCredentials:       true,
-				UserAgent:             "asset-syncer/devel (foo05)",
-				UserAgentComment:      "foo05",
+				DatabaseURL:              "foo01",
+				DatabaseName:             "foo02",
+				DatabaseUser:             "foo03",
+				Debug:                    true,
+				Namespace:                "foo04",
+				GlobalPackagingNamespace: "kubeapps-global",
+				OciRepositories:          []string{},
+				TlsInsecureSkipVerify:    true,
+				FilterRules:              "foo06",
+				PassCredentials:          true,
+				UserAgent:                "asset-syncer/devel (foo05)",
+				UserAgentComment:         "foo05",
 			},
 			true,
 		},

cmd/asset-syncer/server/delete.go

@@ -17,7 +17,7 @@ func Delete(serveOpts Config, args []string) error {
 	}
 
 	dbConfig := dbutils.Config{URL: serveOpts.DatabaseURL, Database: serveOpts.DatabaseName, Username: serveOpts.DatabaseUser, Password: serveOpts.DatabasePassword}
-	manager, err := newManager(dbConfig, serveOpts.GlobalReposNamespace)
+	manager, err := newManager(dbConfig, serveOpts.GlobalPackagingNamespace)
 	if err != nil {
 		return fmt.Errorf("Error file creating a mananger: %v", err)
 	}

cmd/asset-syncer/server/invalidate-cache.go

@@ -16,7 +16,7 @@ func InvalidateCache(serveOpts Config, args []string) error {
 	}
 
 	dbConfig := dbutils.Config{URL: serveOpts.DatabaseURL, Database: serveOpts.DatabaseName, Username: serveOpts.DatabaseUser, Password: serveOpts.DatabasePassword}
-	manager, err := newManager(dbConfig, serveOpts.GlobalReposNamespace)
+	manager, err := newManager(dbConfig, serveOpts.GlobalPackagingNamespace)
 	if err != nil {
 		return fmt.Errorf("Error: %v", err)
 	}

cmd/asset-syncer/server/postgresql_utils.go

@@ -22,8 +22,8 @@ type postgresAssetManager struct {
 	*dbutils.PostgresAssetManager
 }
 
-func newPGManager(config dbutils.Config, globalReposNamespace string) (assetManager, error) {
-	m, err := dbutils.NewPGManager(config, globalReposNamespace)
+func newPGManager(config dbutils.Config, globalPackagingNamespace string) (assetManager, error) {
+	m, err := dbutils.NewPGManager(config, globalPackagingNamespace)
 	if err != nil {
 		return nil, err
 	}

cmd/asset-syncer/server/sync.go

@@ -22,8 +22,8 @@ func Sync(serveOpts Config, version string, args []string) error {
 	}
 
 	dbConfig := dbutils.Config{URL: serveOpts.DatabaseURL, Database: serveOpts.DatabaseName, Username: serveOpts.DatabaseUser, Password: serveOpts.DatabasePassword}
-	globalReposNamespace := serveOpts.GlobalReposNamespace
-	manager, err := newManager(dbConfig, globalReposNamespace)
+	globalPackagingNamespace := serveOpts.GlobalPackagingNamespace
+	manager, err := newManager(dbConfig, globalPackagingNamespace)
 	if err != nil {
 		return fmt.Errorf("Error: %v", err)
 	}

cmd/asset-syncer/server/utils.go

@@ -44,22 +44,22 @@ const (
 )
 
 type Config struct {
-	DatabaseURL           string
-	DatabaseName          string
-	DatabaseUser          string
-	DatabasePassword      string
-	Debug                 bool
-	Namespace             string
-	OciRepositories       []string
-	TlsInsecureSkipVerify bool
-	FilterRules           string
-	PassCredentials       bool
-	UserAgent             string
-	UserAgentComment      string
-	GlobalReposNamespace  string
-	KubeappsNamespace     string
-	AuthorizationHeader   string
-	DockerConfigJson      string
+	DatabaseURL              string
+	DatabaseName             string
+	DatabaseUser             string
+	DatabasePassword         string
+	Debug                    bool
+	Namespace                string
+	OciRepositories          []string
+	TlsInsecureSkipVerify    bool
+	FilterRules              string
+	PassCredentials          bool
+	UserAgent                string
+	UserAgentComment         string
+	GlobalPackagingNamespace string
+	KubeappsNamespace        string
+	AuthorizationHeader      string
+	DockerConfigJson         string
 }
 
 type importChartFilesJob struct {
@@ -107,8 +107,8 @@ type assetManager interface {
 	insertFiles(chartID string, files models.ChartFiles) error
 }
 
-func newManager(config dbutils.Config, globalReposNamespace string) (assetManager, error) {
-	return newPGManager(config, globalReposNamespace)
+func newManager(config dbutils.Config, globalPackagingNamespace string) (assetManager, error) {
+	return newPGManager(config, globalPackagingNamespace)
 }
 
 func getSha256(src []byte) (string, error) {

cmd/kubeapps-apis/cmd/root.go

@@ -70,7 +70,7 @@ func setFlags(c *cobra.Command) {
 	c.Flags().StringVar(&serveOpts.PluginConfigPath, "plugin-config-path", "", "Configuration for plugins")
 	c.Flags().StringVar(&serveOpts.PinnipedProxyURL, "pinniped-proxy-url", "http://kubeapps-internal-pinniped-proxy.kubeapps:3333", "internal url to be used for requests to clusters configured for credential proxying via pinniped")
 	c.Flags().StringVar(&serveOpts.PinnipedProxyCACert, "pinniped-proxy-ca-cert", "", "Path to certificate authority to use with requests to pinniped-proxy service")
-	c.Flags().StringVar(&serveOpts.GlobalReposNamespace, "global-repos-namespace", "kubeapps", "Namespace of global repositories")
+	c.Flags().StringVar(&serveOpts.GlobalHelmReposNamespace, "global-repos-namespace", "kubeapps", "Namespace of global repositories for the helm plugin")
 	c.Flags().BoolVar(&serveOpts.UnsafeLocalDevKubeconfig, "unsafe-local-dev-kubeconfig", false, "if true, it will use the local kubeconfig at the KUBECONFIG env var instead of using the inCluster configuration.")
 	c.Flags().Float32Var(&serveOpts.QPS, "kube-api-qps", 10.0, "set Kubernetes API client QPS limit")
 	c.Flags().IntVar(&serveOpts.Burst, "kube-api-burst", 15, "set Kubernetes API client Burst limit")