Resource name mismatch in the code vs charts

[gkarthiks]

Bug description

The CA secret name in the code has been hard-coded as capsule-ca (ref here), which is what is used to search for the secret that provides the CA for the controller manager.

But in the chart, the name of the secret is templated as name: {{ include "capsule.secretCaName" . }} (ref here). This is included from the _helpers.tpl as {{- printf "%s-ca" (include "capsule.fullname" .) -}} (ref here) which is an ovveride with the release name.

So if I release my chart with releaseName=multi-tenancy-manager then the secret name will be rendered as multi-tenancy-manager-capsule-ca`. This is not the secret name the controller is looking for in here.

How to reproduce

helm template multi-tenancy-manager clastix/capsule --include-crds

Logs

{"level":"error","ts":"2022-03-01T23:40:56.690Z","logger":"setup","msg":"unable to get Capsule CA secret","error":"secrets \"capsule-ca\" not found","stacktrace":"main.main\n\t/workspace/main.go:158\nruntime.main\n\t/usr/local/go/src/runtime/proc.go:225"}

Additional context

• Capsule version: v0.1.1 1bbaebb
• Helm Chart version: 0.1.6
• Kubernetes version: v1.21.5

I can submit a PR on the charts repo by hard-coding the ca secret name to capsule-ca. Please let me know your suggestion.

[gkarthiks]

hi team, any update on this or path for moving forward would be greatly appreciated.

[prometherion]

Hey @gkarthiks, thanks for opening the issue!

I think we got two options here:

1. hard-code the certificates Secret names to capsule-{tls,ca}
2. allow specifying a different name using a set of CLI flags
3. allow specifying a different name using the CapsuleConfiguration resource

To be honest, I like the approach of nr.3 since would be more Kubernetes-native, would be great having feedback from you!

[gkarthiks]

To be honest, I like the approach of nr.3 since would be more Kubernetes-native, would be great having feedback from you!

I like approach no 3 as well. The CapsuleConfiguration is supposed to have these configs.

[prometherion]

Oh, that's great! @davideimola is already working on it, could you confirm?

[davideimola]

Yes, I am working on it

[maxgio92]

Just as a side note, in this situation where the CA secret search fails, also the helm uninstall does not complete leaving the:

• MutatingWebhookConfiguration
• ValidatingWebhookConfiguration
• Job that waits for the CA Secret <capsule-release-name>-waiting-certs

[maxgio92]

I think that also MutatingWebhookConfiguration and ValidatingWebhookConfiguration names do not match