defaultNamespace field not considered by Fleet

[mattups]

Problem

As issue title says, seems that Fleet is not considering the defaultNamespace field apparently.

Heres my fleet.yaml file:

defaultNamespace: falco
helm:
  repo: https://falcosecurity.github.io/charts
  chart: falco
  releaseName: falco
  version: 1.17.4
  valuesFiles:
    - values.yaml
  valuesFrom:
  - secretKeyRef:
      name: falco-secret
      namespace: falco
      key: values.yaml

But when deploying is launched via Fleet, this error comes up:

error while running post render on files: invalid cluster scoped object [name=falco kind=ClusterRole apiVersion=rbac.authorization.k8s.io/v1] found, consider using "defaultNamespace", not "namespace" in fleet.yaml

Any tips on this?

Info

Rancher v2.5.11
Fleet rancher/fleet:v0.3.5

[MKlimuszka]

We need to see if this is reproducible in 2.6.x

[mattups]

@MKlimuszka what about 2.5.x?

[mattups]

Hi, upgrading to 2.5.13 didn't fix the issue. Also, it seems generalized, as now I'm trying to install cert-manager and I have the same problem:

error while running post render on files: invalid cluster scoped object [name=certificaterequests.cert-manager.io kind=CustomResourceDefinition apiVersion=apiextensions.k8s.io/v1] found, consider using "defaultNamespace", not "namespace" in fleet.yaml

fleet.yaml file:

defaultNamespace: cert-manager
helm:
  repo: https://charts.jetstack.io
  chart: cert-manager
  releaseName: cert-manager
  version: 1.8.0
  values:
    extraArgs: {--dns01-recursive-nameservers-only,--dns01-recursive-nameservers=8.8.8.8:53,8.8.4.4:53}
    global.leaderElection.namespace: cert-manager
    installCRDs: true

[snovak7]

Same problem in
Rancher v2.6.5
Fleet rancher/fleet:v0.3.9

[gray314]

Have the same issue...
Rancher v2.6.5
Fleet rancher/fleet:v0.3.9

The workaround for me is to remove the value from the 'namespace' field in fleet.yaml and keep value of namespace only in 'defaultNamespace' field

[rotemsh15]

Bump
Experiencing this on Rancher 2.6.7
I believe the docs for fleet.yaml mention something about cluster wide resources (CRDs as an example)

# The default namespace to be applied to resources. This field is not used to
# enforce or lock down the deployment to a specific namespace, but instead
# provide the default value of the namespace field if one is not specified
# in the manifests.
# Default: default
defaultNamespace: default
# All resources will be assigned to this namespace and if any cluster scoped
# resource exists the deployment will fail.
# Default: ""
namespace: default

However, there's no mention on what to do for the bundle to deploy CRDs

[manno]

defaultNamespace should not trigger that "invalid cluster scoped object" error message.
Are you using namespace: in fleet.yaml or targetNamespace: in the gitrepo resource?

[vwbusguy]

I see the same thing in Rancher 2.7.7. It definitely happens with only specifying defaultNamespace and not namespace as well.

defaultNamespace: cert-manager
helm:
  repo: https://charts.jetstack.io
  releaseName: cert-manager
  chart: cert-manager
  values:
    namespace: cert-manager
    installCRDs: true

Have also tried a number of combinations of setting defaultNamespace and/or namespace. It seems fleet really doesn't know what to make of the CRDs in every case.

EDIT: I got it to work by removing the targetNamespace in the gitrepo object.

[0xavi0]

Just a follow up on this one as I think there is some confusion.

An error similar to

error while running post render on files: invalid cluster scoped object [name=certificaterequests.cert-manager.io kind=CustomResourceDefinition apiVersion=apiextensions.k8s.io/v1] found, consider using "defaultNamespace", not "namespace" in fleet.yaml

happens when:

• GitRepo resource has the targetNamespace (note is not defaultNamespace in the fleet.yaml)
• fleet.yaml has the namespace value.

In both cases fleet does not allow to create any resource out of the specified namespace and cluster wide resources (like CRDs) are not allowed.

We're working on changing the wording of the error to hopefully be more concise in this case.