helm: apply namespace default transformation

When I specify namespace on a chart via pulumi it seems this only populates the Release.Namespace template variable, whereas when running helm install --namespace <namespace> tiller seems to actively add an metadata.namespace entry before applying the templates to the cluster. Many charts unfortunately don’t have the Release.Namespace variable but instead rely on the aforementioned tiller transformation.

Pulumi should apply the same transformation as default, if the namespace attribute has been set on the component. This providers better UX, is closer to helm install and avoids a lot of surprises for new pulumi users.

The default may be as simple as

    manifest => {
      manifest.metadata.namespace = this.args.namespace;
    }

Corresponding slack conversation: https://pulumi-community.slack.com/archives/C84L4E3N1/p1537573095000100

[lblackstone]

As a workaround for now, you should be able to use a transformation to update the namespace.

function addNamespace(o: any) {
    if (o !== undefined) {
        if (o.metadata !== undefined) {
            o.metadata.namespace = "my-new-namespace";
        } else {
            o.metadata = {namespace: "my-new-namespace"}
        }
    }
}

const nginxController = new k8s.helm.v2.Chart(
  "nginx-ingress",
  {
      repo: "stable",
      version: "0.31.0",
      chart: "nginx-ingress",
      transformations: [addNamespace]
  });

[brandonkal]

To expand on @pjoe’s answer. This is what I needed to get things working:

import { ResourceTransformation } from '@pulumi/pulumi'

/** addNamespace transformation sets namespace to desired string.
 * Useful for helm charts `transformations: [addNamespace('ns')]` */
export const addNamespace = (namespace: string): ResourceTransformation => (
  args
) => {
  if (!args) return args
  if (
    [
      'Binding',
      'ConfigMap',
      'Endpoints',
      'Event',
      'LimitRange',
      'PersistentVolumeClaim',
      'Pod',
      'PodTemplate',
      'ReplicationController',
      'ResourceQuota',
      'Secret',
      'ServiceAccount',
      'Service',
      'Challenge',
      'Order',
      'ControllerRevision',
      'DaemonSet',
      'Deployment',
      'ReplicaSet',
      'StatefulSet',
      'LocalSubjectAccessReview',
      'HorizontalPodAutoscaler',
      'CronJob',
      'Job',
      'SealedSecret',
      'CertificateRequest',
      'Certificate',
      'Issuer',
      'Order',
      'Lease',
      'AuthCode',
      'AuthRequest',
      'Connector',
      'OAuth2Client',
      'OfflineSessions',
      'Password',
      'RefreshToken',
      'SigningKey',
      'Event',
      'Ingress',
      'PodMetrics',
      'Ingress',
      'NetworkPolicy',
      'PodDisruptionBudget',
      'RoleBinding',
      'Role',
    ].includes(args.props.kind)
  ) {
    if (!args.props.metadata) {
      args.props.metadata = { namespace }
    } else {
      if (!args.props.metadata.namespace)
        args.props.metadata.namespace = namespace
    }
  }
  return args
}

You can find all namespaced resources with: kubectl api-resources --namespaced=true -o name