How to add label to existed namespace by helm

user_11264544 0
Viewed 1243

I have a project to create a mutating webhook in the kube-system namespace, which needs to exclude webhook server deployment namespaces.

But the kube-system namespace has been created. How do I attach the required labels to it using Helm?

kubernetes-helm
2 Answers

Helmfile offers hooks which are pretty neat for that:

releases:
- name: istio-ingress
  namespace: istio-ingress
  chart: istio/gateway
  wait: true
  hooks:
    - events:
        - presync
      showlogs: true
      command: sh
      args:
        - -c
        - "kubectl create namespace istio-ingress --dry-run=client -o yaml | kubectl apply -f -"
    - events:
        - presync
      showlogs: true
      command: sh
      args:
        - -c
        - "kubectl label --dry-run=client -o yaml --overwrite namespace istio-ingress istio-injection=enabled | kubectl apply -f -"
user_33412670

Since the kube-system namespace is a core part of Kubernetes (every cluster has it preinstalled and some core components run there) Helm can't manage it.

Some possible things you could do instead:

  • Make the per-namespace labels opt-in, not opt-out; only apply the webhook in namespaces where the label is present, rather than in every namespace except flagged ones. (Istio's sidecar injector works this way.)
  • Exclude kube-system as a special case in the code.
  • Manually run kubectl label namespace outside of Helm.
  • Make your larger-scale deployment pipeline run the kubectl command (for example, if you have a Jenkins build that installs the webhook, also make it set the label).
user_100081730
Related