Patch-ception. We are confused. Please help!

[devantler]

Hi,

I am testing the new OCIRepository and the deployment of YAML manifest packaged in OCI.

I have the following setup:

1. A Flux Kustomization for my infrastructure

apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: infrastructure
  namespace: flux-system
spec:
  interval: 1m
  sourceRef:
    kind: OCIRepository
    name: flux-system
  path: path/to/folder/with/kustomize
  prune: true
  wait: true

2. A regular kustomization file

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - redis.yaml
  - ...

3. A Flux kustomization for a OCI Redis deployment

apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: redis
  namespace: flux-system
spec:
  interval: 1m
  targetNamespace: redis
  sourceRef:
    kind: OCIRepository
    name: oci-artifacts
    namespace: flux-system
  path: redis
  prune: true
  timeout: 1m
  patches:
    - target:
        kind: HelmRelease
        name: redis
        namespace: redis
      patch: |-
        apiVersion: helm.toolkit.fluxcd.io/v2
        kind: HelmRelease
        metadata:
          name: redis
          namespace: redis
        spec:
          values:
            commonLabels:
              foo: bar # I expect this to show!
    - target:
        kind: HelmRelease
        name: redis
        namespace: redis
      patch: |
        - op: add
          path: /metadata/labels
          value:
            fancy: pansy # I expect this to show!

The OCI Repository points to an OCI-compliant image packaged from a repo I can't share. This deployment includes the following:

• kustomization.yaml file (regular kustomize file)
• namespace.yaml (a regular namespace file)
• repository.yaml (a Flux HelmRepository file
• release.yaml (a HelmRelease file)

This deploys just fine, but the patches are not applied. I have no idea why, and I would expect it to work. Are there some limitations to how patches work when utilizing the new OCI support added in Flux v2.3.0.

@devantler @trarbr

[stefanprodan]

Remove namespace: redis from patches. The namespace transformer is applied after all patches, so if it's not hardcoded in the base YAMLs it will not work.

[devantler]

Thanks Stefan! 🥇

I would like to understand this a little better. Can you help me understand this:

How does the Flux Kustomization know that it has to apply the patch to the redis HelmRelease in the redis namespace when it is no longer explicit? Is this inferred from the targetNamespace? I am a bit confused by this, as I have used Kustomize patches a lot, and I believe I experienced that it was required to add the namespace to the target, when the patch was done towards a resource in a different namespace (like we see here - the Flux Kustomization lives in the flux-system namespace, but targets the redis namespace)

And for good measure towards anyone else experiencing this, here is the problem:

  patches:
    - target:
        kind: HelmRelease
        name: redis
        namespace: redis # Stefan suggests me to remove this. (See accepted answer)
      patch: |-
        apiVersion: helm.toolkit.fluxcd.io/v2
        kind: HelmRelease
        metadata:
          name: redis
          namespace: redis # Stefan suggests me to remove this. (See accepted answer)
        spec:
          values:
            commonLabels:
              foo: bar

And here is the solution:

  patches:
    - target:
        kind: HelmRelease
        name: redis
      patch: |-
        apiVersion: helm.toolkit.fluxcd.io/v2
        kind: HelmRelease
        metadata:
          name: redis
        spec:
          values:
            commonLabels:
              foo: bar