mirror of
https://github.com/outbackdingo/cozystack.git
synced 2026-02-05 08:17:59 +00:00
34 lines
1.0 KiB
YAML
34 lines
1.0 KiB
YAML
{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
|
|
{{- $bundleName := index $cozyConfig.data "bundle-name" }}
|
|
{{- $bundle := tpl (.Files.Get (printf "bundles/%s.yaml" $bundleName)) . | fromYaml }}
|
|
{{- $namespaces := dict }}
|
|
|
|
{{/* collect namespaces from releases */}}
|
|
{{- range $x := $bundle.releases }}
|
|
{{- if not (hasKey $namespaces $x.namespace) }}
|
|
{{- $_ := set $namespaces $x.namespace false }}
|
|
{{- end }}
|
|
{{/* if at least one release requires a privileged namespace, then it should be privileged */}}
|
|
{{- if or $x.privileged (index $namespaces $x.namespace) }}
|
|
{{- $_ := set $namespaces $x.namespace true }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/* Add extra namespaces */}}
|
|
{{- $_ := set $namespaces "cozy-public" false }}
|
|
{{- $_ := set $namespaces "cozy-fluxcd" false }}
|
|
|
|
{{- range $namespace, $privileged := $namespaces }}
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
annotations:
|
|
"helm.sh/resource-policy": keep
|
|
{{- if $privileged }}
|
|
labels:
|
|
pod-security.kubernetes.io/enforce: privileged
|
|
{{- end }}
|
|
name: {{ $namespace }}
|
|
{{- end }}
|