linkerd-viz chart -- RBAC failure due to build time metadata namespace injection (.Release.Namespace) about linkerd2

[wibed]

these are all the resources affected, it is exclusively the metadata.namespace that is affected

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: linkerd-{{.Release.Namespace}}-tap-auth-reader
  namespace: kube-system
  labels:
    namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: {{ .Values.linkerdNamespace }}
  name: viz-namespace-metadata-linkerd-config
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: web
  namespace: {{.Values.linkerdNamespace}}
  labels:
    namespace: {{.Values.linkerdNamespace}}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: web
  namespace: {{.Values.linkerdNamespace}}
  labels:
    namespace: {{.Values.linkerdNamespace}}
---

[deusxanima]

Hi @wibed , could you provide some additional info about what you're trying to do and how the install process is set up between kustomize and helm? Are you trying to install linkerd-viz in the kube-system namespace, or just create the role and rolebindings in this ns? Are any other helm values being modified via kustomize (and if so, do you see the same behavior for those values) or is this the only one you're modifying?

[wibed]

@deusxanima the rolebinding and the role have to be in the same namespace. the serviceaccount has to be in the namespace the resource asks for.

therefor if there is a resource in the kube-system namespace which has to be accessible from the namespace, lets say linkerd-viz, the serviceaccount is located in linkerd-viz.
role and rolebinding on the other hand should be located in kube-system.

in this particular case it is the configmap within kubesystem that matters to the pod within linkerd-viz.
the namespace of the rolebinding though is overriden by some mysterious process i dont understand.

on the part of reproduction is clearly stated with a kustomization.yaml above.
just copy paste the file, install kustomization cli, adjust the home path kustomize will store the downloaded chart in
and run the command from above.

ill add the repo part right away, missed that one.
...done it will install the latest version by default.

[mikutas]

Your kustomization literally overwrites your value.

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: linkerd-viz # See https://kubectl.docs.kubernetes.io/references/kustomize/kustomization/namespace/

helmGlobals:
  chartHome: ../../../../base/linkerdviz

helmCharts:
- name: linkerd-viz
  releaseName: cluster0
  namespace: linkerd-viz
  includeCRDs: true
  valuesInline:
  repo: https://helm.linkerd.io/stable

[wibed]

there might be a misunderstanding, your right i am wrong.
kubernetes-sigs/kustomize#4716

releaseNamespace is not supported and the monkepatch "namespace" just overrides anything.
this mixup is terribly frustrating. can be closed