Add explicit namespace fields for ArgoCD/FluxCD compatibility

jupyterhub/README.md

@@ -11,6 +11,20 @@
 
 The JupyterHub Helm chart is accompanied with an installation guide at [z2jh.jupyter.org](https://z2jh.jupyter.org). Together they enable you to deploy [JupyterHub](https://jupyterhub.readthedocs.io) in a Kubernetes cluster that can make Jupyter environments available to several thousands of simultaneous users.
 
+## Configuration
+
+For detailed configuration options, see the [official documentation](https://z2jh.jupyter.org).
+
+### Namespace Override
+
+The chart supports deploying resources to a custom namespace via `namespaceOverride`:
+
+```yaml
+namespaceOverride: my-custom-namespace
+```
+
+This is particularly useful for ArgoCD deployments or when using this chart as a subchart. See the [configuration reference](https://z2jh.jupyter.org/en/stable/resources/reference.html) for more details.
+
 ## History
 
 Much of the initial groundwork for this documentation is information learned from the successful use of JupyterHub and Kubernetes at UC Berkeley in their [Data 8](http://data8.org/) program.

jupyterhub/templates/_helpers.tpl

@@ -491,3 +491,13 @@ limits:
 {{- define "jupyterhub.chart-version-to-git-ref" -}}
 {{- regexReplaceAll ".*[.-]n\\d+[.]h(.*)" . "${1}" }}
 {{- end }}
+
+
+{{- /*
+  jupyterhub.namespace:
+    Returns the namespace for chart resources. Uses .Values.namespaceOverride
+    if set, otherwise defaults to .Release.Namespace.
+*/}}
+{{- define "jupyterhub.namespace" -}}
+{{- default .Release.Namespace .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}

jupyterhub/templates/httproute.yaml

@@ -3,6 +3,7 @@ kind: HTTPRoute
 apiVersion: gateway.networking.k8s.io/v1
 metadata:
   name: {{ include "jupyterhub.httpRoute.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
   {{- with .Values.httpRoute.annotations }}

jupyterhub/templates/hub/_helpers-passwords.tpl

@@ -37,7 +37,7 @@
     {{- else if .Values.proxy.secretToken }}
         {{- .Values.proxy.secretToken }}
     {{- else }}
-        {{- $k8s_state := lookup "v1" "Secret" .Release.Namespace (include "jupyterhub.hub.fullname" .) | default (dict "data" (dict)) }}
+        {{- $k8s_state := lookup "v1" "Secret" (include "jupyterhub.namespace" .) (include "jupyterhub.hub.fullname" .) | default (dict "data" (dict)) }}
         {{- if hasKey $k8s_state.data "hub.config.ConfigurableHTTPProxy.auth_token" }}
             {{- index $k8s_state.data "hub.config.ConfigurableHTTPProxy.auth_token" | b64dec }}
         {{- else }}
@@ -52,7 +52,7 @@
     {{- else if .Values.hub.cookieSecret }}
         {{- .Values.hub.cookieSecret }}
     {{- else }}
-        {{- $k8s_state := lookup "v1" "Secret" .Release.Namespace (include "jupyterhub.hub.fullname" .) | default (dict "data" (dict)) }}
+        {{- $k8s_state := lookup "v1" "Secret" (include "jupyterhub.namespace" .) (include "jupyterhub.hub.fullname" .) | default (dict "data" (dict)) }}
         {{- if hasKey $k8s_state.data "hub.config.JupyterHub.cookie_secret" }}
             {{- index $k8s_state.data "hub.config.JupyterHub.cookie_secret" | b64dec }}
         {{- else }}
@@ -65,7 +65,7 @@
     {{- if (.Values.hub.config | dig "CryptKeeper" "keys" "") }}
         {{- .Values.hub.config.CryptKeeper.keys | join ";" }}
     {{- else }}
-        {{- $k8s_state := lookup "v1" "Secret" .Release.Namespace (include "jupyterhub.hub.fullname" .) | default (dict "data" (dict)) }}
+        {{- $k8s_state := lookup "v1" "Secret" (include "jupyterhub.namespace" .) (include "jupyterhub.hub.fullname" .) | default (dict "data" (dict)) }}
         {{- if hasKey $k8s_state.data "hub.config.CryptKeeper.keys" }}
             {{- index $k8s_state.data "hub.config.CryptKeeper.keys" | b64dec }}
         {{- else }}
@@ -81,7 +81,7 @@
     {{- if $explicitly_set_api_token }}
         {{- $explicitly_set_api_token }}
     {{- else }}
-        {{- $k8s_state := lookup "v1" "Secret" $_.Release.Namespace (include "jupyterhub.hub.fullname" $_) | default (dict "data" (dict)) }}
+        {{- $k8s_state := lookup "v1" "Secret" (include "jupyterhub.namespace" $_) (include "jupyterhub.hub.fullname" $_) | default (dict "data" (dict)) }}
         {{- $k8s_secret_key := print "hub.services." $service_key ".apiToken" }}
         {{- if hasKey $k8s_state.data $k8s_secret_key }}
             {{- index $k8s_state.data $k8s_secret_key | b64dec }}

jupyterhub/templates/hub/configmap.yaml

@@ -2,6 +2,7 @@ kind: ConfigMap
 apiVersion: v1
 metadata:
   name: {{ include "jupyterhub.hub.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
 data:

jupyterhub/templates/hub/deployment.yaml

@@ -2,6 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "jupyterhub.hub.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
 spec:

jupyterhub/templates/hub/netpol.yaml

@@ -3,6 +3,7 @@ apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: {{ include "jupyterhub.hub.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
 spec:

jupyterhub/templates/hub/pdb.yaml

@@ -3,6 +3,7 @@ apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: {{ include "jupyterhub.hub.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
 spec:

jupyterhub/templates/hub/pvc.yaml

@@ -3,6 +3,7 @@ kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
   name: {{ include "jupyterhub.hub-pvc.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
   {{- with .Values.hub.db.pvc.annotations }}

jupyterhub/templates/hub/rbac.yaml

@@ -3,6 +3,7 @@ kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ include "jupyterhub.hub.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
 rules:
@@ -17,12 +18,13 @@ kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ include "jupyterhub.hub.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
 subjects:
   - kind: ServiceAccount
     name: {{ include "jupyterhub.hub-serviceaccount.fullname" . }}
-    namespace: "{{ .Release.Namespace }}"
+    namespace: {{ include "jupyterhub.namespace" . }}
 roleRef:
   kind: Role
   name: {{ include "jupyterhub.hub.fullname" . }}

jupyterhub/templates/hub/secret.yaml

@@ -2,6 +2,7 @@ kind: Secret
 apiVersion: v1
 metadata:
   name: {{ include "jupyterhub.hub.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
 type: Opaque

jupyterhub/templates/hub/service.yaml

@@ -2,6 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "jupyterhub.hub.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
   annotations:

jupyterhub/templates/hub/serviceaccount.yaml

@@ -3,6 +3,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "jupyterhub.hub-serviceaccount.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   {{- with .Values.hub.serviceAccount.annotations }}
   annotations:
     {{- . | toYaml | nindent 4 }}

jupyterhub/templates/image-pull-secret.yaml

@@ -3,6 +3,7 @@ kind: Secret
 apiVersion: v1
 metadata:
   name: {{ include "jupyterhub.image-pull-secret.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
   annotations:

jupyterhub/templates/image-puller/_helpers-daemonset.tpl

@@ -12,6 +12,7 @@ metadata:
   {{- else }}
   name: {{ include "jupyterhub.continuous-image-puller.fullname" . }}
   {{- end }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
     {{- if .hook }}
@@ -286,7 +287,7 @@ spec:
     {{- if .Values.prePuller.hook.enabled }}
         {{- if .Values.prePuller.hook.pullOnlyOnChanges }}
             {{- $new_checksum := include "jupyterhub.imagePuller.daemonset.hook.checksum" . }}
-            {{- $k8s_state := lookup "v1" "ConfigMap" .Release.Namespace (include "jupyterhub.hub.fullname" .) | default (dict "data" (dict)) }}
+            {{- $k8s_state := lookup "v1" "ConfigMap" (include "jupyterhub.namespace" .) (include "jupyterhub.hub.fullname" .) | default (dict "data" (dict)) }}
             {{- $old_checksum := index $k8s_state.data "checksum_hook-image-puller" | default "" }}
             {{- if ne $new_checksum $old_checksum -}}
 # prePuller.hook.enabled={{ .Values.prePuller.hook.enabled }}

jupyterhub/templates/image-puller/job.yaml

@@ -10,6 +10,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   name: {{ include "jupyterhub.hook-image-awaiter.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
     hub.jupyter.org/deletable: "true"
@@ -62,7 +63,7 @@ spec:
             - -ca-path=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
             - -auth-token-path=/var/run/secrets/kubernetes.io/serviceaccount/token
             - -api-server-address=https://kubernetes.default.svc:$(KUBERNETES_SERVICE_PORT)
-            - -namespace={{ .Release.Namespace }}
+            - -namespace={{ include "jupyterhub.namespace" . }}
             - -daemonset={{ include "jupyterhub.hook-image-puller.fullname" . }}
             - -pod-scheduling-wait-duration={{ .Values.prePuller.hook.podSchedulingWaitDuration }}
           {{- with .Values.prePuller.hook.containerSecurityContext }}

jupyterhub/templates/image-puller/priorityclass.yaml

@@ -6,7 +6,7 @@ metadata:
   name: {{ include "jupyterhub.image-puller-priority.fullname" . }}
   annotations:
     meta.helm.sh/release-name: "{{ .Release.Name }}"
-    meta.helm.sh/release-namespace: "{{ .Release.Namespace }}"
+    meta.helm.sh/release-namespace: {{ include "jupyterhub.namespace" . | quote }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
 value: {{ .Values.scheduling.podPriority.imagePullerPriority }}

jupyterhub/templates/image-puller/rbac.yaml

@@ -7,6 +7,7 @@ kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ include "jupyterhub.hook-image-awaiter.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
     hub.jupyter.org/deletable: "true"
@@ -26,6 +27,7 @@ kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ include "jupyterhub.hook-image-awaiter.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
     hub.jupyter.org/deletable: "true"
@@ -36,7 +38,7 @@ metadata:
 subjects:
   - kind: ServiceAccount
     name: {{ include "jupyterhub.hook-image-awaiter-serviceaccount.fullname" . }}
-    namespace: "{{ .Release.Namespace }}"
+    namespace: {{ include "jupyterhub.namespace" . }}
 roleRef:
   kind: Role
   name: {{ include "jupyterhub.hook-image-awaiter.fullname" . }}

jupyterhub/templates/image-puller/serviceaccount-continuous.yaml

@@ -1,17 +1,18 @@
-{{- /*
-ServiceAccount for the continuous image-puller daemonset
-*/}}
-{{- if .Values.prePuller.continuous.serviceAccount.create -}}
-{{- if .Values.prePuller.continuous.enabled -}}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "jupyterhub.continuous-image-puller.fullname" . }}
-  labels:
-    {{- include "jupyterhub.labels" . | nindent 4 }}
-  annotations:
-    {{- with .Values.prePuller.continuous.serviceAccount.annotations }}
-    {{- . | toYaml | nindent 4 }}
-    {{- end }}
-{{- end }}
-{{- end }}
+{{- /*
+ServiceAccount for the continuous image-puller daemonset
+*/}}
+{{- if .Values.prePuller.continuous.serviceAccount.create -}}
+{{- if .Values.prePuller.continuous.enabled -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "jupyterhub.continuous-image-puller.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
+  labels:
+    {{- include "jupyterhub.labels" . | nindent 4 }}
+  annotations:
+    {{- with .Values.prePuller.continuous.serviceAccount.annotations }}
+    {{- . | toYaml | nindent 4 }}
+    {{- end }}
+{{- end }}
+{{- end }}

jupyterhub/templates/image-puller/serviceaccount-hook.yaml

@@ -7,6 +7,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "jupyterhub.hook-image-puller-serviceaccount.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
     hub.jupyter.org/deletable: "true"

jupyterhub/templates/image-puller/serviceaccount.yaml

@@ -7,6 +7,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "jupyterhub.hook-image-awaiter-serviceaccount.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
     hub.jupyter.org/deletable: "true"

jupyterhub/templates/ingress.yaml

@@ -3,6 +3,7 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: {{ include "jupyterhub.ingress.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
   {{- with .Values.ingress.annotations }}

jupyterhub/templates/proxy/autohttps/configmap.yaml

@@ -17,6 +17,7 @@ kind: ConfigMap
 apiVersion: v1
 metadata:
   name: {{ include "jupyterhub.autohttps.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
 data:

jupyterhub/templates/proxy/autohttps/deployment.yaml

@@ -5,6 +5,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "jupyterhub.autohttps.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
 spec:

jupyterhub/templates/proxy/autohttps/netpol.yaml

@@ -5,6 +5,7 @@ apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: {{ include "jupyterhub.autohttps.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
 spec:

jupyterhub/templates/proxy/autohttps/pdb.yaml

@@ -3,6 +3,7 @@ apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: proxy
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
 spec:

jupyterhub/templates/proxy/autohttps/rbac.yaml

@@ -6,6 +6,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: {{ include "jupyterhub.autohttps.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
   {{- with .Values.proxy.traefik.serviceAccount.annotations }}
@@ -21,11 +22,13 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: {{ include "jupyterhub.autohttps.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
 subjects:
 - kind: ServiceAccount
   name: {{ include "jupyterhub.autohttps-serviceaccount.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   apiGroup:
 roleRef:
   kind: Role

jupyterhub/templates/proxy/autohttps/service.yaml

@@ -5,6 +5,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "jupyterhub.proxy-http.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
     {{- with .Values.proxy.service.labels }}

jupyterhub/templates/proxy/autohttps/serviceaccount.yaml

@@ -6,6 +6,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "jupyterhub.autohttps-serviceaccount.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
 {{- end }}

jupyterhub/templates/proxy/deployment.yaml

@@ -4,6 +4,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "jupyterhub.proxy.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
 spec:

jupyterhub/templates/proxy/netpol.yaml

@@ -7,6 +7,7 @@ apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: {{ include "jupyterhub.proxy.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
 spec:

jupyterhub/templates/proxy/pdb.yaml

@@ -3,6 +3,7 @@ apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: {{ include "jupyterhub.proxy.fullname" . }}
+  namespace: {{ include "jupyterhub.namespace" . }}
   labels:
     {{- include "jupyterhub.labels" . | nindent 4 }}
 spec: