Not creating new namespace with impersonation ServiceAccount even though it has proper role.

[hongkunyoo]

Hello, I really enjoy using helm-controller because of its great concept.

However, I'm not sure whether I'm wrong or there is a bug, I have experienced unexpected behavior.

If I do not use impersonation (without serviceAccount property in HelmRelease) creating new namespace with createNamespace: true and targetNamespace works fine.

However, If I use impersonation(using specific ServiceAccount), helm-controller does not create new namespace for me.
Of course I've check that the ServiceAccount I'm impersonating has a proper ClusterRole.

Is this behavior on purpose or did I do something wrong? otherwise is it a bug?

This is my settings:

Kubernetes

kubectl version 
Client Version: version.Info{Major:"1", Minor:"16", GitVersion:"v1.16.7", GitCommit:"be3d344ed06bff7a4fc60656200a93c74f31f9a4", GitTreeState:"clean", BuildDate:"2020-02-11T19:34:02Z", GoVersion:"go1.13.6", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"16", GitVersion:"v1.16.7", GitCommit:"be3d344ed06bff7a4fc60656200a93c74f31f9a4", GitTreeState:"clean", BuildDate:"2020-02-11T19:24:46Z", GoVersion:"go1.13.6", Compiler:"gc", Platform:"linux/amd64"}

flux-system: v0.13.4

Manifest:

• HelmRepository:

apiVersion: source.toolkit.fluxcd.io/v1beta1
kind: HelmRepository
metadata:
  name: bitnami
  namespace: flux-system
spec:
  interval: 30m0s
  timeout: 1m0s
  url: https://charts.bitnami.com/bitnami

• HelmRelease:

apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: hr-test
  namespace: default
spec:
  chart:
    spec:
      chart: nginx
      interval: 1m0s
      sourceRef:
        kind: HelmRepository
        name: bitnami
        namespace: flux-system
      version: 9.5.8
  interval: 5m0s
  targetNamespace: new-ns
  serviceAccountName: default    # <-- HERE: if I add this property, it does not create new Namespace.
  install:
    createNamespace: true
    disableWait: true
  values:
    podLabels:
      plz: work

• ClusterRole, RoleBinding

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ns-create-role
rules:
- apiGroups:
  - ""
  resources:
  - namespaces
  verbs:
  - '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: ns-create-rb
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ns-create-role
subjects:
- kind: ServiceAccount
  name: default
  namespace: default

[hiddeco]

Can you please try this with a non-default service account? In addition, it would help to know the version of the helm-controller you are making use of.

[hongkunyoo]

@hiddeco Thank you for quick reply.

I tried with non-default service account and it also did not work.

This is the full manifest that I used to test it.
It seems v0.10.1
https://gist.github.com/hongkunyoo/8695742b3d43617403e2496ce86b959d#file-flux-manifest-yaml-L1530

[hiddeco]

Any chance you made the changes to the HelmRelease after a successful and/or failed install? Making this an upgrade action?

Helm only takes the createNamespace into account during the install action, and otherwise expects it to exist: https://github.com/helm/helm/blob/accf82ba1c5fe32a0004f6ec7fd021b77fddf51f/pkg/action/install.go#L305-L329

[hongkunyoo]

Hmm, I think it is not this case.
I've checked that I created brand new HelmRelease to K8s.