wip

shirtabachii · shirtabachii · commit 99e35761c1c6 · 2025-08-25T14:51:24.000+03:00
diff --git a/charts/gitops-runtime/templates/_components/cap-app-proxy/_all_resources.yaml b/charts/gitops-runtime/templates/_components/cap-app-proxy/_all_resources.yaml
@@ -12,4 +12,4 @@
   {{ include "cap-app-proxy.resources.sa" .}}
 ---
   {{ include "argo-cd.namespaced-rbac.all" . }}
-{{- end }}
+{{- end }}
diff --git a/charts/gitops-runtime/templates/_components/cap-app-proxy/_config.yaml b/charts/gitops-runtime/templates/_components/cap-app-proxy/_config.yaml
@@ -4,14 +4,14 @@ argoCdUsername: {{ .Values.config.argoCdUsername }}
 argoWorkflowsInsecure: {{ .Values.config.argoWorkflowsInsecure | quote }}
 argoWorkflowsUrl: {{ default "" .Values.config.argoWorkflowsUrl }}
 cors: {{ .Values.global.codefresh.url }}
-  {{- with .Values.config.clusterChunkSize }} 
+  {{- with .Values.config.clusterChunkSize }}
 clusterChunkSize: {{ . | quote }}
   {{- end }}
 env: {{ .Values.config.env | quote}}
 isConfigurationRuntime: {{ .Values.global.runtime.isConfigurationRuntime | quote }}
 isExternalArgoCD: {{ .Values.global.runtime.isExternalArgoCD | quote }}
 runtimeName: {{ required "global.runtime.name is required" .Values.global.runtime.name | quote}}
-runtimeSingleNamespace: {{ .Values.singleNamespace | quote }}
+runtimeSingleNamespace: {{ .Values.global.runtime.singleNamespace | quote }}
 skipGitPermissionValidation: {{ .Values.config.skipGitPermissionValidation | quote }}
 logLevel: {{ .Values.config.logLevel | quote }}
   {{- $enrichmentValues := get .Values "image-enrichment" }}
diff --git a/charts/gitops-runtime/templates/_components/cap-app-proxy/argo-cd/_all.yaml b/charts/gitops-runtime/templates/_components/cap-app-proxy/argo-cd/_all.yaml
@@ -1,7 +1,9 @@
-{{- if (get .Values "app-proxy").singleNamespace }}
+{{- define "argo-cd.namespaced-rbac.all" }}
+{{- if (index .Values "global" "runtime").singleNamespace }}
 {{- include "argo-cd.namespaced-rbac.serviceaccount" . }}
 ---
 {{- include "argo-cd.namespaced-rbac.role" . }}
 ---
 {{- include "argo-cd.namespaced-rbac.rolebinding" . }}
-{{- end }} 
+{{- end }}
+{{- end }}
diff --git a/charts/gitops-runtime/templates/_components/gitops-operator/_env.yaml b/charts/gitops-runtime/templates/_components/gitops-operator/_env.yaml
@@ -15,7 +15,7 @@ COMMIT_STATUS_POLLING_INTERVAL: {{ .Values.config.commitStatusPollingInterval }}
 WORKFLOW_MONITOR_POLLING_INTERVAL: {{ .Values.config.workflowMonitorPollingInterval }}
 MAX_CONCURRENT_RELEASES: {{ .Values.config.maxConcurrentReleases }}
 PROMOTION_WRAPPER_TEMPLATE: {{ .Values.config.promotionWrapperTemplate | quote }}
-RUNTIME_SINGLE_NAMESPACE: {{ (get .Values "app-proxy").singleNamespace }}
+RUNTIME_SINGLE_NAMESPACE: {{ .Values.global.runtime.singleNamespace }}
 {{- end }}
 
 {{- define "gitops-operator.resources.environment-variables.defaults" -}}
@@ -37,7 +37,7 @@ NAMESPACE:
   valueFrom:
     fieldRef:
       fieldPath: metadata.namespace
-RUNTIME_VERSION: 
+RUNTIME_VERSION:
   valueFrom:
     configMapKeyRef:
       name: codefresh-cm
diff --git a/charts/gitops-runtime/templates/_components/gitops-operator/crds/_all.yaml b/charts/gitops-runtime/templates/_components/gitops-operator/crds/_all.yaml
@@ -14,7 +14,7 @@
 ---
   {{- include "gitops-operator.crds.product" $context }}
 ---
-  {{- if not (get .Values "app-proxy").singleNamespace }}
+  {{- if not (get .Values.global "runtime").singleNamespace }}
   {{- include "gitops-operator.crds.restricted-gitsource" $context }}
   {{- end }}
 ---
diff --git a/charts/gitops-runtime/templates/_components/gitops-operator/promotion-template/_rbac.yaml b/charts/gitops-runtime/templates/_components/gitops-operator/promotion-template/_rbac.yaml
@@ -1,7 +1,7 @@
 
 {{- define "gitops-operator.resources.promotion-template-rbac" }}
 apiVersion: rbac.authorization.k8s.io/v1
-kind: {{ .Values.singleNamespace | ternary "Role" "ClusterRole" }}
+kind: {{ .Values.global.runtime.singleNamespace | ternary "Role" "ClusterRole" }}
 metadata:
   labels:
     {{- include "gitops-operator.selectorLabels" . | nindent 4 }}
@@ -45,14 +45,14 @@ rules:
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: {{ .Values.singleNamespace | ternary "RoleBinding" "ClusterRoleBinding" }}
+kind: {{ .Values.global.runtime.singleNamespace | ternary "RoleBinding" "ClusterRoleBinding" }}
 metadata:
   labels:
     {{- include "gitops-operator.selectorLabels" . | nindent 4 }}
   name: promotion-template
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: {{ .Values.singleNamespace | ternary "Role" "ClusterRole" }}
+  kind: {{ .Values.global.runtime.singleNamespace | ternary "Role" "ClusterRole" }}
   name: promotion-template
 subjects:
 - kind: ServiceAccount
diff --git a/charts/gitops-runtime/templates/_components/gitops-operator/rbac/_all.yaml b/charts/gitops-runtime/templates/_components/gitops-operator/rbac/_all.yaml
@@ -13,7 +13,7 @@
 ---
   {{- include "gitops-operator.resources.leader-election-rbac" $context  }}
 ---
-  {{- if not (get .Values "app-proxy").singleNamespace }}
+  {{- if not (get .Values.global "runtime").singleNamespace }}
   {{- include "gitops-operator.resources.restricted-git-source-rbac" $context }}
   {{- end }}
 ---
diff --git a/charts/gitops-runtime/templates/_components/gitops-operator/rbac/_auth_proxy_rbac.yaml b/charts/gitops-runtime/templates/_components/gitops-operator/rbac/_auth_proxy_rbac.yaml
@@ -1,7 +1,7 @@
 
 {{- define "gitops-operator.resources.auth-proxy-rbac" }}
 apiVersion: rbac.authorization.k8s.io/v1
-kind: {{ .Values.singleNamespace | ternary "Role" "ClusterRole" }}
+kind: {{ .Values.global.runtime.singleNamespace | ternary "Role" "ClusterRole" }}
 metadata:
   labels:
     {{- include "gitops-operator.selectorLabels" . | nindent 4 }}
@@ -22,14 +22,14 @@ rules:
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: {{ .Values.singleNamespace | ternary "RoleBinding" "ClusterRoleBinding" }}
+kind: {{ .Values.global.runtime.singleNamespace | ternary "RoleBinding" "ClusterRoleBinding" }}
 metadata:
   labels:
     {{- include "gitops-operator.selectorLabels" . | nindent 4 }}
   name: codefresh-gitops-operator-proxy
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: {{ .Values.singleNamespace | ternary "Role" "ClusterRole" }}
+  kind: {{ .Values.global.runtime.singleNamespace | ternary "Role" "ClusterRole" }}
   name: codefresh-gitops-operator-proxy
 subjects:
 - kind: ServiceAccount
diff --git a/charts/gitops-runtime/templates/_components/gitops-operator/rbac/_rbac_operator.yaml b/charts/gitops-runtime/templates/_components/gitops-operator/rbac/_rbac_operator.yaml
@@ -1,7 +1,7 @@
 
 {{- define "gitops-operator.resources.rbac-operator" }}
 apiVersion: rbac.authorization.k8s.io/v1
-kind: {{ .Values.singleNamespace | ternary "Role" "ClusterRole" }}
+kind: {{ .Values.global.runtime.singleNamespace | ternary "Role" "ClusterRole" }}
 metadata:
   labels:
     {{- include "gitops-operator.selectorLabels" . | nindent 4 }}
@@ -26,7 +26,7 @@ rules:
   - patch
   - update
   - watch
-{{- if not .Values.singleNamespace }}
+{{- if not .Values.global.runtime.singleNamespace }}
 - apiGroups:
   - codefresh.io
   resources:
@@ -72,7 +72,7 @@ rules:
   - list
   - watch
 ---
-{{- if .Values.singleNamespace }}
+{{- if .Values.global.runtime.singleNamespace }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
@@ -194,30 +194,30 @@ rules:
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: {{ .Values.singleNamespace | ternary "RoleBinding" "ClusterRoleBinding" }}
+kind: {{ .Values.global.runtime.singleNamespace | ternary "RoleBinding" "ClusterRoleBinding" }}
 metadata:
   labels:
     {{- include "gitops-operator.selectorLabels" . | nindent 4 }}
   name: codefresh-gitops-operator
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: {{ .Values.singleNamespace | ternary "Role" "ClusterRole" }}
+  kind: {{ .Values.global.runtime.singleNamespace | ternary "Role" "ClusterRole" }}
   name: codefresh-gitops-operator
 subjects:
 - kind: ServiceAccount
   name: {{ include "gitops-operator.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: {{ .Values.singleNamespace | ternary "RoleBinding" "ClusterRoleBinding" }}
+kind: {{ .Values.global.runtime.singleNamespace | ternary "RoleBinding" "ClusterRoleBinding" }}
 metadata:
   labels:
     {{- include "gitops-operator.selectorLabels" . | nindent 4 }}
   name: codefresh-gitops-operator-workflows
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: {{ .Values.singleNamespace | ternary "Role" "ClusterRole" }}
-  name: {{ .Values.singleNamespace | ternary "argo-role" "argo-edit" }}
+  kind: {{ .Values.global.runtime.singleNamespace | ternary "Role" "ClusterRole" }}
+  name: {{ .Values.global.runtime.singleNamespace | ternary "argo-role" "argo-edit" }}
 subjects:
 - kind: ServiceAccount
   name: {{ include "gitops-operator.serviceAccountName" . }}
diff --git a/charts/gitops-runtime/templates/_components/gitops-operator/rbac/_restricted_git_source.rbac.yaml b/charts/gitops-runtime/templates/_components/gitops-operator/rbac/_restricted_git_source.rbac.yaml
@@ -1,6 +1,6 @@
 
 {{- define "gitops-operator.resources.restricted-git-source-rbac" }}
-  {{- if not .Values.singleNamespace }}
+  {{- if not .Values.global.runtime.singleNamespace }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
diff --git a/charts/gitops-runtime/templates/app-proxy/workflows-crb.yaml b/charts/gitops-runtime/templates/app-proxy/workflows-crb.yaml
@@ -4,12 +4,12 @@
 {{- $_ := set $appProxyContext "Values" (deepCopy (get .Values "app-proxy")) }}
 {{- $_ := set $appProxyContext.Values "global" (deepCopy (get .Values "global")) }}
 apiVersion: rbac.authorization.k8s.io/v1
-kind: {{ $appProxyContext.Values.singleNamespace | ternary "RoleBinding" "ClusterRoleBinding" }}
+kind: {{ $appProxyContext.Values.global.runtime.singleNamespace | ternary "RoleBinding" "ClusterRoleBinding" }}
 metadata:
   name: cap-app-proxy-argo-workflows
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: {{ $appProxyContext.Values.singleNamespace | ternary "Role" "ClusterRole" }}
+  kind: {{ $appProxyContext.Values.global.runtime.singleNamespace | ternary "Role" "ClusterRole" }}
   name: {{ include "codefresh-gitops-runtime.argo-workflows.server.name" . }}
 subjects:
   - kind: ServiceAccount
diff --git a/charts/gitops-runtime/templates/codefresh-cm.yaml b/charts/gitops-runtime/templates/codefresh-cm.yaml
@@ -14,6 +14,6 @@ data:
   ingressClassName: {{ .Values.global.runtime.ingress.className | default "" | quote }}
   ingressController: {{ .Values.global.runtime.ingress.className | default "" | quote }}
   ingressHost: {{ include "codefresh-gitops-runtime.ingress-url" . }}
-  isConfigurationRuntime: {{ .Values.global.runtime.isConfigurationRuntime | quote }} 
-  singleNamespace: {{ (get .Values "app-proxy").singleNamespace | quote }}
-  version: {{ .Chart.AppVersion }}
+  isConfigurationRuntime: {{ .Values.global.runtime.isConfigurationRuntime | quote }}
+  singleNamespace: {{ .Values.global.runtime.singleNamespace | quote }}
+  version: {{ .Chart.AppVersion }}
diff --git a/charts/gitops-runtime/values.yaml b/charts/gitops-runtime/values.yaml
@@ -49,6 +49,8 @@ global:
     cluster: https://kubernetes.default.svc
     # -- Defines whether this is a Codefresh hosted runtime. Should not be changed.
     codefreshHosted: false
+    # -- Runtime single namespace mode. When true, runtime operates in single namespace scope.
+    singleNamespace: true
     # -- Ingress settings
     ingress:
       # -- if set to true, the pre-install hook will validate the existance of appropriate values, but *will not* attempt to make a web request to the ingress host
@@ -519,8 +521,6 @@ tunnel-client:
 #-----------------------------------------------------------------------------------------------------------------------
 app-proxy:
   replicaCount: 1
-  # -- Runtime single namespace mode. When true, runtime operates in single namespace scope.
-  singleNamespace: false
   # -- Image enrichment process configuration
   image-enrichment:
     # -- Enable or disable enrichment process. Please note that for enrichemnt, argo-workflows has to be enabled as well.
@@ -713,8 +713,6 @@ gitops-operator:
     annotations: {}
     # -- Additional labels for gitops operator CRDs
     additionalLabels: {}
-  # -- Restrict the gitops operator to a single namespace (by the namespace of Helm release)
-  singleNamespace: false
   # -- GitOps operator configuration
   config:
     # -- Task polling interval
