Resources inherited with a namespace do not get the configMapGenerator suffix added to a config map name they refer to

[szabba]

What happened?

I have

• a base Kustomization,
• an overlay, and
• a component
  • adding a generated config map and
  • mounting a file the config map it in deployments matching a label selector (this is done with a patch).

The base Kustomization (perhaps unusually) declares a namespace. The overlay and the component do not. Both the base and overlay contain deployments.

When I run kustomize build overlays/environment, both deployments get the patch applied. But the deployment from the base refers to configmap, without the hash suffix the configMapGenerator creates.

What did you expect to happen?

Either:

• that all deployments would refer to the generated config map - including the hash suffix,
• or to easily find documentation explaining why it's not supposed to work that way.

How can we reproduce it (as minimally and precisely as possible)?

https://github.com/szabba/kustomize-namespace-affecting-which-components-get-configmapgenerator-fixup

Expected output

apiVersion: v1
data:
  file.txt: Some text.
kind: ConfigMap
metadata:
  name: configmap-h9t7kcfk8f
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: base-deployment
    mount: "yes"
  name: base-deployment
  namespace: ns
spec:
  selector:
    matchLabels:
      app: base-deployment
  template:
    metadata:
      labels:
        app: base-deployment
    spec:
      containers:
      - image: nginx:latest
        name: base-deployment
        ports:
        - containerPort: 8080
        volumeMounts:
        - mountPath: /file.txt
          name: configmap
          subPath: file.txt
      volumes:
      - configMap:
          name: configmap-h9t7kcfk8f
        name: configmap
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: overlay-deployment
    mount: "yes"
  name: overlay-deployment
spec:
  selector:
    matchLabels:
      app: overlay-deployment
  template:
    metadata:
      labels:
        app: overlay-deployment
    spec:
      containers:
      - image: nginx:latest
        name: overlay-deployment
        ports:
        - containerPort: 8080
        volumeMounts:
        - mountPath: /file.txt
          name: configmap
          subPath: file.txt
      volumes:
      - configMap:
          name: configmap-h9t7kcfk8f
        name: configmap

Actual output

apiVersion: v1
data:
  file.txt: Some text.
kind: ConfigMap
metadata:
  name: configmap-h9t7kcfk8f
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: base-deployment
    mount: "yes"
  name: base-deployment
  namespace: ns
spec:
  selector:
    matchLabels:
      app: base-deployment
  template:
    metadata:
      labels:
        app: base-deployment
    spec:
      containers:
      - image: nginx:latest
        name: base-deployment
        ports:
        - containerPort: 8080
        volumeMounts:
        - mountPath: /file.txt
          name: configmap
          subPath: file.txt
      volumes:
      - configMap:
          name: configmap
        name: configmap
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: overlay-deployment
    mount: "yes"
  name: overlay-deployment
spec:
  selector:
    matchLabels:
      app: overlay-deployment
  template:
    metadata:
      labels:
        app: overlay-deployment
    spec:
      containers:
      - image: nginx:latest
        name: overlay-deployment
        ports:
        - containerPort: 8080
        volumeMounts:
        - mountPath: /file.txt
          name: configmap
          subPath: file.txt
      volumes:
      - configMap:
          name: configmap-h9t7kcfk8f
        name: configmap

Kustomize version

v5.6.0

Operating system

Windows

[k8s-ci-robot]

This issue is currently awaiting triage.

SIG CLI takes a lead on issue triage for this repo, but any Kubernetes member can accept issues by applying the triage/accepted label.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[szabba]

FYI this is a minimized reproduction of something that came up at work. Adding namespace in the overlay got us the intended behavior of the config map hash suffix being added. (Ie, we didn't have a hard requirement of not adding the namespace or keeping them different.)

It was still surprising to us that it was necessary - and the fix felt very non-obvious.

[sda399]

your patch is applied to all resources (deployments), within the 'default' and the 'ns' namespace
you created a configmap in 'default' namespace, and the reference of this configmap is in sync within the deployment in the same namespace ('default') the deployment in the 'ns' namespace remains untouched.

when you add 'namespace: ns' to the overlay you generate your configmap in the 'ns' namespace. all references of this configmap is in sync, and have the same prefix, within the 'ns' namespace.

#! /bin/sh

base=base
[ ! -d $base ] || rm -r $base
mkdir -p \
	$base/base \
	$base/component \
	$base/overlays/environment

cat <<EOF > $base/base/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: ns
resources:
- deployment.yaml
EOF

cat <<EOF > $base/base/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: base-deployment
  labels:
    app: base-deployment
    mount: yes
spec:
  selector:
    matchLabels:
      app: base-deployment
  template:
    metadata:
      labels:
        app: base-deployment
    spec:
      containers:
        - name: base-deployment
          image: nginx:latest
          ports:
            - containerPort: 8080
          volumeMounts: []
      volumes: []
EOF

cat <<EOF > $base/component/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1alpha1
kind: Component

namespace: ns
configMapGenerator:
- name: configmap
  files:
    - file.txt

patches:
- target:
    kind: Deployment
#    labelSelector: mount=yes
  patch: >-
    - path: "/spec/template/spec/volumes/-"
      op: add
      value:
        name: configmap
        configMap:
          name: configmap

    - path: "/spec/template/spec/containers/0/volumeMounts/-"
      op: add
      value:
        name: configmap
        mountPath: /file.txt
        subPath: file.txt
EOF


cat <<EOF > $base/component/file.txt
Some text.
EOF

cat <<EOF > $base/overlays/environment/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
- ../../base
- ./deployment.yaml

components:
- ../../component
EOF
cat <<EOF > $base/overlays/environment/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: overlay-deployment
  labels:
    app: overlay-deployment
    mount: yes
spec:
  selector:
    matchLabels:
      app: overlay-deployment
  template:
    metadata:
      labels:
        app: overlay-deployment
    spec:
      containers:
        - name: overlay-deployment
          image: nginx:latest
          ports:
            - containerPort: 8080
          volumeMounts: []
      volumes: []
EOF


cat <<EOF > expected.yaml
apiVersion: v1
data:
  file.txt: |
    Some text.
kind: ConfigMap
metadata:
  name: configmap-kdb6cfd9cd
  namespace: ns
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: base-deployment
    mount: "yes"
  name: base-deployment
  namespace: ns
spec:
  selector:
    matchLabels:
      app: base-deployment
  template:
    metadata:
      labels:
        app: base-deployment
    spec:
      containers:
      - image: nginx:latest
        name: base-deployment
        ports:
        - containerPort: 8080
        volumeMounts:
        - mountPath: /file.txt
          name: configmap
          subPath: file.txt
      volumes:
      - configMap:
          name: configmap-kdb6cfd9cd
        name: configmap
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: overlay-deployment
    mount: "yes"
  name: overlay-deployment
  namespace: ns
spec:
  selector:
    matchLabels:
      app: overlay-deployment
  template:
    metadata:
      labels:
        app: overlay-deployment
    spec:
      containers:
      - image: nginx:latest
        name: overlay-deployment
        ports:
        - containerPort: 8080
        volumeMounts:
        - mountPath: /file.txt
          name: configmap
          subPath: file.txt
      volumes:
      - configMap:
          name: configmap-kdb6cfd9cd
        name: configmap
EOF
#---
kustomize build --stack-trace $base/overlays/environment > result.yaml
printf "%-64s%s\n" expected.yaml result.yaml
printf "%130s\n" " " | tr ' ' '-'
diff -W130 -y expected.yaml result.yaml

[szabba]

when you add 'namespace: ns' to the overlay you generate your configmap in the 'ns' namespace. all references of this configmap is in sync, and have the same prefix, within the 'ns' namespace.

I'll try to rephrase / expand. Let me know if I understand correctly:

Kustomize is doing this expectedly and intentionally because a ConfigMap has to be in the same namespace as another resource referring to it. So the use of the unsuffixed name of a generated ConfigMap in a resource that doesn't belong to the same namespace as the ConfigMap is assumed to refer to some other ConfigMap. This makes it so that a Kustomization can contain two generated ConfigMaps in the same Kustomization with the same unsuffixed name and different namespaces and resources in each namespace refer to the right one.

Assuming I understand that right, a followup question: did I miss this in the documentation, or does documentation for this not exist?