feat: Add explicit namespace support (#115)

xdrus · web-flow · commit 90f85fdb2d4b · 2026-06-02T14:37:04.000-04:00
diff --git a/README.md b/README.md
@@ -57,6 +57,7 @@ Here's a summary of the available configuration options:
 | imagePullSecrets                              | array   | `[]`                                                         | Specifies docker registry secret names as an array                                                       |
 | nameOverride                                  | string  | `""`                                                         | Partially overrides the fullname template with a string (includes release name)                          |
 | fullnameOverride                              | string  | `""`                                                         | Fully overrides the fullname template with a string                                                      |
+| namespaceOverride                             | string  | `""`                                                         | Sets `metadata.namespace` on namespaced resources; defaults to the release namespace. Refer to `values.yaml` for when to use it |
 | commonLabels                                  | object  | `{}`                                                         | Specifies labels to be applied to all created resources                                                  |
 | serviceAccount.create                         | bool    | `true`                                                       | Specifies whether a service account should be created                                                    |
 | serviceAccount.annotations                    | object  | `{}`                                                         | Annotations to add to the service account                                                                |
diff --git a/templates/NOTES.txt b/templates/NOTES.txt
@@ -1,3 +1,4 @@
+{{- $namespace := include "ld-relay.namespace" . -}}
 1. Get the application URL by running these commands:
 {{- if .Values.ingress.enabled }}
 {{- range $host := .Values.ingress.hosts }}
@@ -6,17 +7,17 @@
   {{- end }}
 {{- end }}
 {{- else if contains "NodePort" .Values.service.type }}
-  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "ld-relay.fullname" . }})
-  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  export NODE_PORT=$(kubectl get --namespace {{ $namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "ld-relay.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ $namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
   echo http://$NODE_IP:$NODE_PORT
 {{- else if contains "LoadBalancer" .Values.service.type }}
      NOTE: It may take a few minutes for the LoadBalancer IP to be available.
-           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "ld-relay.fullname" . }}'
-  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "ld-relay.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+           You can watch the status of by running 'kubectl get --namespace {{ $namespace }} svc -w {{ include "ld-relay.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ $namespace }} {{ include "ld-relay.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
   echo http://$SERVICE_IP:{{ .Values.service.port }}
 {{- else if contains "ClusterIP" .Values.service.type }}
-  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "ld-relay.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
-  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  export POD_NAME=$(kubectl get pods --namespace {{ $namespace }} -l "app.kubernetes.io/name={{ include "ld-relay.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ $namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
   echo "Visit http://127.0.0.1:8080 to use your application"
-  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+  kubectl --namespace {{ $namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
 {{- end }}
diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl
@@ -30,6 +30,14 @@ Create chart name and version as used by the chart label.
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
+{{/*
+Namespace rendered into the metadata of the chart's namespaced resources.
+Defaults to the release namespace; override with .Values.namespaceOverride.
+*/}}
+{{- define "ld-relay.namespace" -}}
+{{- default .Release.Namespace .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
 {{/*
 Common labels
 */}}
diff --git a/templates/config.yaml b/templates/config.yaml
@@ -2,6 +2,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: "{{ include "ld-relay.fullname" . }}-config"
+  namespace: {{ include "ld-relay.namespace" . }}
   labels:
     {{- include "ld-relay.labels" . | nindent 4 }}
 data:
diff --git a/templates/deployment.yaml b/templates/deployment.yaml
@@ -2,6 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "ld-relay.fullname" . }}
+  namespace: {{ include "ld-relay.namespace" . }}
   labels:
     {{- include "ld-relay.labels" . | nindent 4 }}
 spec:
diff --git a/templates/hpa.yaml b/templates/hpa.yaml
@@ -9,6 +9,7 @@ apiVersion: autoscaling/v1
 kind: HorizontalPodAutoscaler
 metadata:
   name: {{ include "ld-relay.fullname" . }}
+  namespace: {{ include "ld-relay.namespace" . }}
   labels:
     {{- include "ld-relay.labels" . | nindent 4 }}
 spec:
diff --git a/templates/ingress.yaml b/templates/ingress.yaml
@@ -15,6 +15,7 @@ apiVersion: extensions/v1beta1
 kind: Ingress
 metadata:
   name: {{ $fullName }}
+  namespace: {{ include "ld-relay.namespace" . }}
   labels:
     {{- include "ld-relay.labels" . | nindent 4 }}
   {{- with .Values.ingress.annotations }}
diff --git a/templates/poddisruptionbudget.yaml b/templates/poddisruptionbudget.yaml
@@ -11,6 +11,7 @@ apiVersion: policy/v1beta1
 kind: PodDisruptionBudget
 metadata:
   name: {{ include "ld-relay.fullname" . }}
+  namespace: {{ include "ld-relay.namespace" . }}
   labels:
     {{- include "ld-relay.labels" . | nindent 4 }}
 spec:
diff --git a/templates/service.yaml b/templates/service.yaml
@@ -2,6 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "ld-relay.fullname" . }}
+  namespace: {{ include "ld-relay.namespace" . }}
   labels:
     {{- include "ld-relay.labels" . | nindent 4 }}
   {{- with .Values.service.annotations }}
diff --git a/templates/serviceaccount.yaml b/templates/serviceaccount.yaml
@@ -3,6 +3,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "ld-relay.serviceAccountName" . }}
+  namespace: {{ include "ld-relay.namespace" . }}
   labels:
     {{- include "ld-relay.labels" . | nindent 4 }}
   {{- with .Values.serviceAccount.annotations }}
diff --git a/test/config_test.go b/test/config_test.go
@@ -6,6 +6,10 @@ import (
 	corev1 "k8s.io/api/core/v1"
 )
 
+func (s *TemplateTest) TestConfigNamespace() {
+	s.assertTemplateNamespaces("ConfigMap", "templates/config.yaml", nil)
+}
+
 func (s *TemplateTest) TestConfigNameRespectsFullnameOverride() {
 	options := &helm.Options{
 		SetValues: map[string]string{
diff --git a/test/deployment_test.go b/test/deployment_test.go
@@ -7,6 +7,10 @@ import (
 	corev1 "k8s.io/api/core/v1"
 )
 
+func (s *TemplateTest) TestDeploymentNamespace() {
+	s.assertTemplateNamespaces("Deployment", "templates/deployment.yaml", nil)
+}
+
 func (s *TemplateTest) TestDeploymentConfigMapRefRespectsFullnameOverride() {
 	options := &helm.Options{
 		SetValues: map[string]string{
@@ -351,11 +355,11 @@ func (s *TemplateTest) TestStartupProbeIsDisabledByDefault() {
 func (s *TemplateTest) TestCanSetStartupProbe() {
 	options := &helm.Options{
 		SetValues: map[string]string{
-			"relay.startupProbe.httpGet.path":            "/status",
-			"relay.startupProbe.httpGet.port":            "api",
-			"relay.startupProbe.initialDelaySeconds":     "5",
-			"relay.startupProbe.periodSeconds":           "10",
-			"relay.startupProbe.failureThreshold":        "30",
+			"relay.startupProbe.httpGet.path":        "/status",
+			"relay.startupProbe.httpGet.port":        "api",
+			"relay.startupProbe.initialDelaySeconds": "5",
+			"relay.startupProbe.periodSeconds":       "10",
+			"relay.startupProbe.failureThreshold":    "30",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.Namespace),
 	}
diff --git a/test/golden/config.yaml b/test/golden/config.yaml
@@ -4,6 +4,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: "ld-relay-test-config"
+  namespace: ld-relay-test-ns
   labels:
     app.kubernetes.io/name: ld-relay
     app.kubernetes.io/instance: ld-relay-test
diff --git a/test/golden/deployment.yaml b/test/golden/deployment.yaml
@@ -4,6 +4,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: ld-relay-test
+  namespace: ld-relay-test-ns
   labels:
     app.kubernetes.io/name: ld-relay
     app.kubernetes.io/instance: ld-relay-test
@@ -54,4 +55,4 @@ spec:
               path: /status
               port: api
           resources:
-            {}
+            {}
diff --git a/test/golden/ingress.yaml b/test/golden/ingress.yaml
@@ -4,6 +4,7 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: ld-relay-test
+  namespace: ld-relay-test-ns
   labels:
     app.kubernetes.io/name: ld-relay
     app.kubernetes.io/instance: ld-relay-test
@@ -27,4 +28,4 @@ spec:
               service:
                 name: ld-relay-test
                 port:
-                  number: 8031
+                  number: 8031
diff --git a/test/golden/service.yaml b/test/golden/service.yaml
@@ -4,6 +4,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: ld-relay-test
+  namespace: ld-relay-test-ns
   labels:
     app.kubernetes.io/name: ld-relay
     app.kubernetes.io/instance: ld-relay-test
diff --git a/test/golden/serviceaccount.yaml b/test/golden/serviceaccount.yaml
@@ -4,6 +4,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: ld-relay-test
+  namespace: ld-relay-test-ns
   labels:
     app.kubernetes.io/name: ld-relay
     app.kubernetes.io/instance: ld-relay-test
diff --git a/test/goldenfiles_test.go b/test/goldenfiles_test.go
@@ -2,14 +2,14 @@ package test
 
 import (
 	"path/filepath"
-	"strings"
 	"testing"
 
-	"github.com/gruntwork-io/terratest/modules/random"
 	"github.com/stretchr/testify/require"
 	"github.com/stretchr/testify/suite"
 )
 
+const goldenNamespace = "ld-relay-test-ns"
+
 func TestGoldenDefaultsTemplate(t *testing.T) {
 	t.Parallel()
 
@@ -21,7 +21,7 @@ func TestGoldenDefaultsTemplate(t *testing.T) {
 		suite.Run(t, &TemplateGoldenTest{
 			ChartPath:      chartPath,
 			Release:        "ld-relay-test",
-			Namespace:      "ld-relay-" + strings.ToLower(random.UniqueId()),
+			Namespace:      goldenNamespace,
 			GoldenFileName: name,
 			Templates:      []string{"templates/" + name + ".yaml"},
 		})
@@ -37,7 +37,7 @@ func TestGoldenIngressWithBaseConfiguration(t *testing.T) {
 	suite.Run(t, &TemplateGoldenTest{
 		ChartPath:      chartPath,
 		Release:        "ld-relay-test",
-		Namespace:      "ld-relay-" + strings.ToLower(random.UniqueId()),
+		Namespace:      goldenNamespace,
 		GoldenFileName: "ingress",
 		Templates:      []string{"templates/ingress.yaml"},
 		SetValues: map[string]string{
diff --git a/test/hpa_test.go b/test/hpa_test.go
@@ -6,6 +6,12 @@ import (
 	autoscalingv2 "k8s.io/api/autoscaling/v2"
 )
 
+func (s *TemplateTest) TestHPANamespace() {
+	s.assertTemplateNamespaces("HorizontalPodAutoscaler", "templates/hpa.yaml", map[string]string{
+		"autoscaling.enabled": "true",
+	})
+}
+
 func (s *TemplateTest) TestHPACanSetCommonLabels() {
 	options := &helm.Options{
 		SetValues: map[string]string{
diff --git a/test/ingress_test.go b/test/ingress_test.go
@@ -6,6 +6,16 @@ import (
 	networkingv1 "k8s.io/api/networking/v1"
 )
 
+func (s *TemplateTest) TestIngressNamespace() {
+	s.assertTemplateNamespaces("Ingress", "templates/ingress.yaml", map[string]string{
+		"ingress.enabled":                    "true",
+		"ingress.hosts[0].host":              "ld-relay.local",
+		"ingress.hosts[0].paths[0].path":     "/",
+		"ingress.hosts[0].paths[0].pathType": "Prefix",
+		"ingress.hosts[0].paths[0].port":     "8030",
+	})
+}
+
 func (s *TemplateTest) TestIngressCanSetCommonLabels() {
 	options := &helm.Options{
 		SetValues: map[string]string{
diff --git a/test/namespace_test.go b/test/namespace_test.go
@@ -0,0 +1,77 @@
+package test
+
+import (
+	"maps"
+
+	"github.com/gruntwork-io/terratest/modules/helm"
+	"github.com/gruntwork-io/terratest/modules/k8s"
+)
+
+const (
+	testHelmNamespace   = "test-helm-namespace"
+	testValuesNamespace = "test-values-namespace"
+)
+
+type renderedResource struct {
+	Kind     string `json:"kind"`
+	Metadata struct {
+		Namespace string `json:"namespace"`
+	} `json:"metadata"`
+}
+
+func (s *TemplateTest) assertTemplateNamespaces(kind string, template string, setValues map[string]string) {
+	testCases := []struct {
+		Name              string
+		HelmNamespace     string
+		ValueNamespace    string
+		ExpectedNamespace string
+	}{
+		{
+			Name:              "DefaultNamespace",
+			ExpectedNamespace: "default",
+		},
+		{
+			Name:              "HelmNamespace",
+			HelmNamespace:     testHelmNamespace,
+			ExpectedNamespace: testHelmNamespace,
+		},
+		{
+			Name:              "NamespaceOverride",
+			HelmNamespace:     testHelmNamespace,
+			ValueNamespace:    testValuesNamespace,
+			ExpectedNamespace: testValuesNamespace,
+		},
+	}
+
+	for _, testCase := range testCases {
+		testCase := testCase
+
+		s.Run(testCase.Name, func() {
+			options := &helm.Options{
+				SetValues: namespaceTestSetValues(setValues, testCase.ValueNamespace),
+			}
+
+			if testCase.HelmNamespace != "" {
+				options.KubectlOptions = k8s.NewKubectlOptions("", "", testCase.HelmNamespace)
+			}
+
+			output := helm.RenderTemplate(s.T(), options, s.ChartPath, s.Release, []string{template})
+
+			var rendered renderedResource
+			helm.UnmarshalK8SYaml(s.T(), output, &rendered)
+
+			s.Require().Equal(kind, rendered.Kind)
+			s.Require().Equal(testCase.ExpectedNamespace, rendered.Metadata.Namespace)
+		})
+	}
+}
+
+func namespaceTestSetValues(setValues map[string]string, valueNamespace string) map[string]string {
+	allValues := map[string]string{}
+
+	maps.Copy(allValues, setValues)
+
+	allValues["namespaceOverride"] = valueNamespace
+
+	return allValues
+}
diff --git a/test/poddisruptionbudget_test.go b/test/poddisruptionbudget_test.go
@@ -6,6 +6,12 @@ import (
 	policyv1 "k8s.io/api/policy/v1"
 )
 
+func (s *TemplateTest) TestPDBNamespace() {
+	s.assertTemplateNamespaces("PodDisruptionBudget", "templates/poddisruptionbudget.yaml", map[string]string{
+		"pod.disruptionBudget.enabled": "true",
+	})
+}
+
 func (s *TemplateTest) TestCanEnablePDB() {
 	options := &helm.Options{
 		SetValues: map[string]string{
diff --git a/test/service_test.go b/test/service_test.go
@@ -6,6 +6,10 @@ import (
 	corev1 "k8s.io/api/core/v1"
 )
 
+func (s *TemplateTest) TestServiceNamespace() {
+	s.assertTemplateNamespaces("Service", "templates/service.yaml", nil)
+}
+
 func (s *TemplateTest) TestServiceSupportsMultiplePorts() {
 	options := &helm.Options{
 		SetValues: map[string]string{
diff --git a/test/serviceaccount_test.go b/test/serviceaccount_test.go
@@ -6,6 +6,10 @@ import (
 	corev1 "k8s.io/api/core/v1"
 )
 
+func (s *TemplateTest) TestServiceAccountNamespace() {
+	s.assertTemplateNamespaces("ServiceAccount", "templates/serviceaccount.yaml", nil)
+}
+
 func (s *TemplateTest) TestServiceAccountCanSetCommonLabels() {
 	options := &helm.Options{
 		SetValues: map[string]string{
diff --git a/values.yaml b/values.yaml
@@ -15,6 +15,17 @@ imagePullSecrets: []
 nameOverride: ""
 fullnameOverride: ""
 
+# Sets metadata.namespace on the chart's namespaced resources. This is mainly
+# useful for GitOps / `helm template` workflows (e.g. Argo CD, Flux, Kustomize)
+# where the namespace must be explicit in the rendered YAML.
+# Leave this empty if you install with `helm install/upgrade --namespace`: Helm
+# already deploys into the release namespace, so setting it has no effect.
+# Do not set this to a namespace that differs from your install namespace --
+# `helm install/upgrade` will fail with a namespace mismatch error, and
+# `helm template | kubectl apply` would deploy the resources into this
+# namespace instead. When empty, the chart uses the Helm release namespace.
+namespaceOverride: ""
+
 # Labels to add to all resources
 commonLabels: {}
 
