{{ .Namespace }} can't be rendered in values.yaml.gotmpl

[RaymondKYLiu]

Hi,
I try to add {{ .Namespace }} in the .gotmpl file, but it can't be rendered.
Below are my helmfile.yaml and values.yaml.gotmpl

# helmfile.yaml
releases:
  - name: demo
    namespace: demo
    chart: incubator/raw
    version: 0.2.3
    labels:
      app: demo
    values:
      - values.yaml.gotmpl

# values.yaml.gotmpl
resources:
  - apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: cloudwatch-agent
      namespace: {{ .Namespace }}

  - kind: ClusterRole
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      name: cloudwatch-agent-role
    rules:
      - apiGroups: [""]
        resources: ["pods", "nodes", "endpoints"]
        verbs: ["list", "watch"]
      - apiGroups: ["apps"]
        resources: ["replicasets"]
        verbs: ["list", "watch"]
      - apiGroups: ["batch"]
        resources: ["jobs"]
        verbs: ["list", "watch"]
      - apiGroups: [""]
        resources: ["nodes/proxy"]
        verbs: ["get"]
      - apiGroups: [""]
        resources: ["nodes/stats", "configmaps", "events"]
        verbs: ["create"]
      - apiGroups: [""]
        resources: ["configmaps"]
        resourceNames: ["cwagent-clusterleader"]
        verbs: ["get","update"]

  - kind: ClusterRoleBinding
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
      name: cloudwatch-agent-role-binding
    subjects:
      - kind: ServiceAccount
        name: cloudwatch-agent
        namespace: {{ .Namespace }}
    roleRef:
      kind: ClusterRole
      name: cloudwatch-agent-role
      apiGroup: rbac.authorization.k8s.io

Type helmfile template, it shows the {{ .Namespace }} was rendered to null

---
# Source: raw/templates/resources.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app: raw
    chart: raw-0.2.3
    heritage: Helm
    release: demo
  name: cloudwatch-agent
  namespace: null
---
# Source: raw/templates/resources.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: raw
    chart: raw-0.2.3
    heritage: Helm
    release: demo
  name: cloudwatch-agent-role
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - nodes
  - endpoints
  verbs:
  - list
  - watch
- apiGroups:
  - apps
  resources:
  - replicasets
  verbs:
  - list
  - watch
- apiGroups:
  - batch
  resources:
  - jobs
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - nodes/proxy
  verbs:
  - get
- apiGroups:
  - ""
  resources:
  - nodes/stats
  - configmaps
  - events
  verbs:
  - create
- apiGroups:
  - ""
  resourceNames:
  - cwagent-clusterleader
  resources:
  - configmaps
  verbs:
  - get
  - update
---
# Source: raw/templates/resources.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app: raw
    chart: raw-0.2.3
    heritage: Helm
    release: demo
  name: cloudwatch-agent-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cloudwatch-agent-role
subjects:
- kind: ServiceAccount
  name: cloudwatch-agent
  namespace: null

But it's interesting if I type helm -n demo template, the {{ .Namespace }} can be rendered to 'demo' string.

---
# Source: raw/templates/resources.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app: raw
    chart: raw-0.2.3
    heritage: Helm
    release: demo
  name: cloudwatch-agent
  namespace: demo
---
# Source: raw/templates/resources.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: raw
    chart: raw-0.2.3
    heritage: Helm
    release: demo
  name: cloudwatch-agent-role
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - nodes
  - endpoints
  verbs:
  - list
  - watch
- apiGroups:
  - apps
  resources:
  - replicasets
  verbs:
  - list
  - watch
- apiGroups:
  - batch
  resources:
  - jobs
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - nodes/proxy
  verbs:
  - get
- apiGroups:
  - ""
  resources:
  - nodes/stats
  - configmaps
  - events
  verbs:
  - create
- apiGroups:
  - ""
  resourceNames:
  - cwagent-clusterleader
  resources:
  - configmaps
  verbs:
  - get
  - update
---
# Source: raw/templates/resources.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app: raw
    chart: raw-0.2.3
    heritage: Helm
    release: demo
  name: cloudwatch-agent-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cloudwatch-agent-role
subjects:
- kind: ServiceAccount
  name: cloudwatch-agent
  namespace: demo

[dududko]

I run into the same problem. The first look into the source code shows that the field in the struct which is used for storing this option has type string but not the string pointer. Because of this the default value for the {{ .Namespace }} is empty string. You can check it with this template {{ eq .Namespace "" }}.

I did not know if this is a bug or a feature so I found a workaround by using .Values instead {{ .Values.Namespace }}, which you can set with flag --state-values-set.

[mumoshu]

@dududko Thanks for reporting!

Ah, this might be very confusing. Sorry about that. Well, the important point here is that .Namespace basically points to what was specified via helmfile --namespace NS sync, not the namespace the "current" release is in.

A possible way to achieve what you want would be:

releases:
  - name: demo
    namespace: demo
    chart: incubator/raw
    version: 0.2.3
    labels:
      app: demo
    valuesTemplate:
    - |
      resources:
      - apiVersion: v1
        kind: ServiceAccount
        metadata:
          name: cloudwatch-agent
          namespace: {{`{{ .Release.Namespace }}`}}

As @RaymondKYLiu has kindly shared, using state values would work too.

Maybe a more intuitive way would be to allow accessing {{.Release.Namespace}} from within values.yaml.gotmpl? It isn't possible today but might be a good feature request.

[lukasmrtvy]

@mumoshu Does #1466 work for ^ use case? Its really usefull for CRs for setting namespace from release..

environments:
  default:
    values:
      - domain: test.example.com
      - issuer: letsencrypt-production

repositories:
- name: incubator
  url: https://kubernetes-charts-incubator.storage.googleapis.com

releases:
- name: test
  namespace: default
  createNamespace: true
  chart: incubator/raw
  version: 0.2.3
  values:
    - resources:
      - apiVersion: cert-manager.io/v1
        kind: Certificate
        metadata:
          name: {{ .Values.domain}}
          namespace: {{ .Release.Namespace }}
        spec:
          secretName: {{ .Values.domain}}-tls
          issuerRef:
            name: {{ .Values.issuer }}
          dnsNames:
          - {{ .Values.domain}}

[mumoshu]

@lukasmrtvy It works only in values.yaml.gotmpl in your case, as {{ .Release.Name }} must be rendered before parsing the whole helmfile.yaml, but to detect which Release it is rendering it needs to parse the YAML(chicken-and-egg problem).