feat(helm): add namespaceOverride support to gateway-helm chart

charts/gateway-helm/templates/NOTES.txt

@@ -8,7 +8,7 @@ Thank you for installing Envoy Gateway! 🎉
 
 Your release is named: {{ .Release.Name }}. 🎉
 
-Your release is in namespace: {{ .Release.Namespace }}. 🎉
+Your release is in namespace: {{ include "eg.namespace" . }}. 🎉
 
 To learn more about the release, try:
 

charts/gateway-helm/templates/_helpers.tpl

@@ -1,3 +1,10 @@
+{{/*
+Allow the release namespace to be overridden.
+*/}}
+{{- define "eg.namespace" -}}
+{{- default .Release.Namespace .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}}
+{{- end }}
+
 {{/*
 Expand the name of the chart.
 */}}

charts/gateway-helm/templates/certgen-rbac.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "eg.fullname" . }}-certgen
-  namespace: '{{ .Release.Namespace }}'
+  namespace: '{{ include "eg.namespace" . }}'
   labels:
   {{- include "eg.labels" . | nindent 4 }}
   {{- if .Values.certgen.rbac.labels }}
@@ -19,7 +19,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: {{ include "eg.fullname" . }}-certgen
-  namespace: '{{ .Release.Namespace }}'
+  namespace: '{{ include "eg.namespace" . }}'
   labels:
   {{- include "eg.labels" . | nindent 4 }}
   {{- if .Values.certgen.rbac.labels }}
@@ -45,7 +45,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: {{ include "eg.fullname" . }}-certgen
-  namespace: '{{ .Release.Namespace }}'
+  namespace: '{{ include "eg.namespace" . }}'
   labels:
   {{- include "eg.labels" . | nindent 4 }}
   {{- if .Values.certgen.rbac.labels }}
@@ -64,13 +64,13 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: '{{ include "eg.fullname" . }}-certgen'
-  namespace: '{{ .Release.Namespace }}'
+  namespace: '{{ include "eg.namespace" . }}'
 ---
 {{- if .Values.topologyInjector.enabled }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: '{{ include "eg.fullname" . }}-certgen:{{ .Release.Namespace }}'
+  name: '{{ include "eg.fullname" . }}-certgen:{{ include "eg.namespace" . }}'
   labels:
   {{- include "eg.labels" . | nindent 4 }}
   {{- if .Values.certgen.rbac.labels }}
@@ -96,15 +96,15 @@ rules:
     resources:
       - mutatingwebhookconfigurations
     resourceNames:
-      - 'envoy-gateway-topology-injector.{{ .Release.Namespace }}'
+      - 'envoy-gateway-topology-injector.{{ include "eg.namespace" . }}'
     verbs:
       - update
       - patch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: '{{ include "eg.fullname" . }}-certgen:{{ .Release.Namespace }}'
+  name: '{{ include "eg.fullname" . }}-certgen:{{ include "eg.namespace" . }}'
   labels:
   {{- include "eg.labels" . | nindent 4 }}
   {{- if .Values.certgen.rbac.labels }}
@@ -119,9 +119,9 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: '{{ include "eg.fullname" . }}-certgen:{{ .Release.Namespace }}'
+  name: '{{ include "eg.fullname" . }}-certgen:{{ include "eg.namespace" . }}'
 subjects:
   - kind: ServiceAccount
     name: '{{ include "eg.fullname" . }}-certgen'
-    namespace: '{{ .Release.Namespace }}'
+    namespace: '{{ include "eg.namespace" . }}'
 {{- end }}

charts/gateway-helm/templates/certgen.yaml

@@ -2,7 +2,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   name: {{ include "eg.fullname" . }}-certgen
-  namespace: '{{ .Release.Namespace }}'
+  namespace: '{{ include "eg.namespace" . }}'
   labels:
   {{- include "eg.labels" . | nindent 4 }}
   annotations:

charts/gateway-helm/templates/envoy-gateway-config.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: envoy-gateway-config
-  namespace: '{{ .Release.Namespace }}'
+  namespace: '{{ include "eg.namespace" . }}'
   labels:
   {{- include "eg.labels" . | nindent 4 }}
 data:

charts/gateway-helm/templates/envoy-gateway-deployment.yaml

@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: envoy-gateway
-  namespace: '{{ .Release.Namespace }}'
+  namespace: '{{ include "eg.namespace" . }}'
   {{- with .Values.deployment.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

charts/gateway-helm/templates/envoy-gateway-hpa.yaml

@@ -3,7 +3,7 @@ apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
 metadata:
   name: envoy-gateway
-  namespace: '{{ $.Release.Namespace }}'
+  namespace: '{{ include "eg.namespace" $ }}'
 spec:
   scaleTargetRef:
     apiVersion: apps/v1

charts/gateway-helm/templates/envoy-gateway-poddisruptionbudget.yaml

@@ -3,7 +3,7 @@ apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: envoy-gateway
-  namespace: '{{ .Release.Namespace }}'
+  namespace: '{{ include "eg.namespace" . }}'
 spec:
   {{- if and .Values.podDisruptionBudget.minAvailable }}
   minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
@@ -15,4 +15,4 @@ spec:
     matchLabels:
       control-plane: envoy-gateway
     {{- include "eg.selectorLabels" . | nindent 6 }}
-{{- end }}
+{{- end }}

charts/gateway-helm/templates/envoy-gateway-rbac.yaml

@@ -33,7 +33,7 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: 'envoy-gateway'
-  namespace: '{{ $.Release.Namespace }}'
+  namespace: '{{ include "eg.namespace" $ }}'
 {{ end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -55,7 +55,7 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: 'envoy-gateway'
-  namespace: '{{ .Release.Namespace }}'
+  namespace: '{{ include "eg.namespace" . }}'
 {{ else }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -78,5 +78,5 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: 'envoy-gateway'
-  namespace: '{{ .Release.Namespace }}'
+  namespace: '{{ include "eg.namespace" . }}'
 {{ end }}

charts/gateway-helm/templates/envoy-gateway-service.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: envoy-gateway
-  namespace: '{{ .Release.Namespace }}'
+  namespace: '{{ include "eg.namespace" . }}'
   {{- with .Values.service.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

charts/gateway-helm/templates/envoy-gateway-serviceaccount.yaml

@@ -2,6 +2,6 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: envoy-gateway
-  namespace: '{{ .Release.Namespace }}'
+  namespace: '{{ include "eg.namespace" . }}'
   labels:
   {{- include "eg.labels" . | nindent 4 }}

charts/gateway-helm/templates/envoy-proxy-topology-injector-webhook.yaml

@@ -17,7 +17,7 @@
 apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration
 metadata:
-  name: 'envoy-gateway-topology-injector.{{ .Release.Namespace }}'
+  name: 'envoy-gateway-topology-injector.{{ include "eg.namespace" . }}'
   annotations:
     "helm.sh/hook": pre-install, pre-upgrade
     "helm.sh/hook-weight": "-1"
@@ -34,7 +34,7 @@ webhooks:
     clientConfig:
       service:
         name: envoy-gateway
-        namespace: '{{ .Release.Namespace }}'
+        namespace: '{{ include "eg.namespace" . }}'
         path: "/inject-pod-topology"
         port: 9443
     failurePolicy: Ignore
@@ -49,7 +49,7 @@ webhooks:
         - key: kubernetes.io/metadata.name
           operator: In
           values:
-            - {{ .Release.Namespace }}
+            - {{ include "eg.namespace" . }}
     {{- else if gt (len $watchedNamespaces) 0 }}
     namespaceSelector:
       matchExpressions:
@@ -60,4 +60,4 @@ webhooks:
             - {{ . | quote }}
           {{- end }}
     {{- end }}
-{{- end }}
+{{- end }}

charts/gateway-helm/templates/infra-manager-rbac.yaml

@@ -29,15 +29,15 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: 'envoy-gateway'
-  namespace: '{{ $.Release.Namespace }}'
+  namespace: '{{ include "eg.namespace" $ }}'
 ---
 {{ end }}
 {{ end }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: {{ include "eg.fullname" . }}-infra-manager
-  namespace: '{{ .Release.Namespace }}'
+  namespace: '{{ include "eg.namespace" . }}'
   labels:
   {{- include "eg.labels" . | nindent 4 }}
 rules:
@@ -47,7 +47,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: {{ include "eg.fullname" . }}-infra-manager
-  namespace: '{{ .Release.Namespace }}'
+  namespace: '{{ include "eg.namespace" . }}'
   labels:
   {{- include "eg.labels" . | nindent 4 }}
 roleRef:
@@ -57,4 +57,4 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: 'envoy-gateway'
-  namespace: '{{ .Release.Namespace }}'
+  namespace: '{{ include "eg.namespace" . }}'

charts/gateway-helm/templates/leader-election-rbac.yaml

@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: {{ include "eg.fullname" . }}-leader-election-role
-  namespace: '{{ .Release.Namespace }}'
+  namespace: '{{ include "eg.namespace" . }}'
   labels:
   {{- include "eg.labels" . | nindent 4 }}
 rules:
@@ -42,7 +42,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: {{ include "eg.fullname" . }}-leader-election-rolebinding
-  namespace: '{{ .Release.Namespace }}'
+  namespace: '{{ include "eg.namespace" . }}'
   labels:
   {{- include "eg.labels" . | nindent 4 }}
 roleRef:
@@ -52,4 +52,4 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: 'envoy-gateway'
-  namespace: '{{ .Release.Namespace }}'
+  namespace: '{{ include "eg.namespace" . }}'

charts/gateway-helm/templates/namespace.yaml

@@ -2,5 +2,5 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: '{{ .Release.Namespace }}' 
+  name: '{{ include "eg.namespace" . }}' 
 {{ end }}

charts/gateway-helm/templates/namespaced-infra-manager-rbac.yaml

@@ -25,7 +25,7 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: 'envoy-gateway'
-  namespace: '{{ $.Release.Namespace }}'
+  namespace: '{{ include "eg.namespace" $ }}'
 {{ if $kube.watch.namespaces }}
 {{ if gt (len $kube.watch.namespaces) 0 }}
 {{ $watchedNamespaces = $kube.watch.namespaces }}
@@ -60,7 +60,7 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: 'envoy-gateway'
-  namespace: '{{ $.Release.Namespace }}'
+  namespace: '{{ include "eg.namespace" $ }}'
 ---
 {{- end }}
 {{- end }}

charts/gateway-helm/values.tmpl.yaml

@@ -114,6 +114,10 @@ config:
 
 createNamespace: false
 
+# -- Override the namespace for resources deployed by the chart.
+# Defaults to the release namespace.
+namespaceOverride: ""
+
 kubernetesClusterDomain: cluster.local
 
 # -- Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify `values.yaml` to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected.

release-notes/current.yaml

@@ -14,6 +14,8 @@ new features: |
   Added support for shadow mode in local rate limiting.
   Added `egctl config envoy-gateway` commands to retrieve Envoy Gateway admin config dumps.
   The DirectResponse body in HTTPFilter now supports Envoy command operators for dynamic content. See https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators for more details.
+  Added `namespaceOverride` support to gateway-helm chart
+
 
 bug fixes: |
   Rejected ClientTrafficPolicy if invalid TLS cipher suites are configured.