Do not add namespace to cluster-scoped CRD objects

[mgoodness]

CRDs can be namespace- or cluster-scoped by setting spec.scope to Namespaced or Cluster. If a CRD is cluster-scoped, kustomize should not add metadata.namespace to objects of that kind.

Note that while there's no harm in adding metadata.namespace to a cluster-scoped CRD object (Kubernetes ignores it), it does show up as a "diff" in GitOps-style CD systems like Argo.

[jessesuen]

This is an interesting problem. Kustomize does not currently talk to a Kubernetes cluster and has no facility to determine whether or not it is appropriate to add namespace to a custom resource object. I'm not sure how kustomize can decide this unless it sees the custom resource definition as part of the deployed manifests.

If kustomize is unable to determine whether or not to omit namespace during manifest generation, then diffing tools like Argo CD will probably need add some special case logic for metadata.namespace to basically ignore mismatches on empty string vs. non-empty strings.

[mgoodness]

Good point - it hadn't occurred to me that kustomize can't look into a CRD's spec to determine its scope. Hopefully transformer configurations can be extended to support not adding a namespace to cluster-scoped resources.

E.g.

namespace:
- path: metadata/namespace
  create: false
  kind: ClusterIssuer

[primeroz]

Any update on this ?

We are having the same problem with a cluster scoped CRD

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[jbrette]

@mgoodness @primeroz @jessesuen

Please have a look at:

• KEP: Kustomize FieldSpec skip
• PR: Skip kustomize transformers for paths
• The PR seems to address the issue as demonstrated here

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[redbaron]

can someone reopen this issue? it is still relevant

[psalaberria002]

We just hit this issue. Any reason why it is not opened?

[gkarthiks]

Hi, any updates on this scenario? I am facing this with the custer-scoped CR with Kustomize and ArgoCD, being kustomize adding the namespaces to it, the ArgoCD is not ignoring the namespace on that but throwing an error.

[k8s-ci-robot]

@sigwinch28: You can't reopen an issue/PR unless you authored it or you are a collaborator.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.