keda: auto-derive multitenant tenant names from release name

keda/templates/_kedify-helpers.tpl

@@ -0,0 +1,46 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/*
+Kedify-specific template helpers. Kept in a separate file from the upstream
+_helpers.tpl so rebases against kedacore/charts do not conflict here.
+*/}}
+
+{{/*
+Effective KEDA operator name: the configured operator.name, suffixed with the Helm
+release name in multitenant "tenant" mode so multiple tenants sharing a namespace get
+unique, non-colliding resource names. Unchanged in default / non-multitenant mode.
+*/}}
+{{- define "keda.operator.name" -}}
+{{- if eq (default "" (.Values.kedify.multitenant).mode) "tenant" -}}
+{{- printf "%s-%s" .Values.operator.name .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- .Values.operator.name -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Effective KEDA operator ServiceAccount name: the configured serviceAccount.operator.name
+(falling back to serviceAccount.name), suffixed with the Helm release name in multitenant
+"tenant" mode the same way as the operator name so the ServiceAccount stays unique per tenant.
+*/}}
+{{- define "keda.operator.serviceAccountName" -}}
+{{- $base := (.Values.serviceAccount.operator).name | default .Values.serviceAccount.name -}}
+{{- if eq (default "" (.Values.kedify.multitenant).mode) "tenant" -}}
+{{- printf "%s-%s" $base .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $base -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Effective name of the Secret holding the operator's TLS certificates: the configured
+certificates.secretName, suffixed with the Helm release name in multitenant "tenant" mode
+so tenants sharing a namespace do not overwrite each other's certificates.
+*/}}
+{{- define "keda.certificates.secretName" -}}
+{{- if eq (default "" (.Values.kedify.multitenant).mode) "tenant" -}}
+{{- printf "%s-%s" .Values.certificates.secretName .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- .Values.certificates.secretName -}}
+{{- end -}}
+{{- end -}}

keda/templates/cert-manager/keda-issuer.yaml

@@ -6,7 +6,7 @@ metadata:
   annotations:
     {{- toYaml . | nindent 4 }}
   {{- end }}
-  name: {{ .Values.operator.name }}-issuer
+  name: {{ (include "keda.operator.name" .) }}-issuer
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "keda.labels" . | indent 4 }}

keda/templates/cert-manager/keda-tls-certificate.yaml

@@ -2,23 +2,23 @@
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: {{ .Values.operator.name }}-tls-certificates
+  name: {{ (include "keda.operator.name" .) }}-tls-certificates
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "keda.labels" . | indent 4 }}
 spec:
-  commonName: {{ .Values.operator.name }}
+  commonName: {{ (include "keda.operator.name" .) }}
   dnsNames:
-  - {{ .Values.operator.name }}.{{ .Release.Namespace }}
-  - {{ .Values.operator.name }}.{{ .Release.Namespace }}.svc
-  - {{ .Values.operator.name }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}
-  - {{ .Values.operator.name }}-metrics-apiserver.{{ .Release.Namespace }}
-  - {{ .Values.operator.name }}-metrics-apiserver.{{ .Release.Namespace }}.svc
-  - {{ .Values.operator.name }}-metrics-apiserver.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}
+  - {{ (include "keda.operator.name" .) }}.{{ .Release.Namespace }}
+  - {{ (include "keda.operator.name" .) }}.{{ .Release.Namespace }}.svc
+  - {{ (include "keda.operator.name" .) }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}
+  - {{ (include "keda.operator.name" .) }}-metrics-apiserver.{{ .Release.Namespace }}
+  - {{ (include "keda.operator.name" .) }}-metrics-apiserver.{{ .Release.Namespace }}.svc
+  - {{ (include "keda.operator.name" .) }}-metrics-apiserver.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}
   - {{ .Values.webhooks.name }}.{{ .Release.Namespace }}
   - {{ .Values.webhooks.name }}.{{ .Release.Namespace }}.svc
   - {{ .Values.webhooks.name }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}
-  secretName: {{ .Values.certificates.secretName }}
+  secretName: {{ (include "keda.certificates.secretName" .) }}
   secretTemplate:
     {{- toYaml .Values.certificates.certManager.secretTemplate | nindent 4 }}
   usages:
@@ -31,7 +31,7 @@ spec:
   renewBefore: {{ .Values.certificates.certManager.renewBefore }}
   issuerRef:
     {{- if .Values.certificates.certManager.issuer.generate }}
-    name: {{ .Values.operator.name }}-issuer
+    name: {{ (include "keda.operator.name" .) }}-issuer
     kind: Issuer
     group: cert-manager.io
     {{- else }}

keda/templates/cert-manager/self-ca.yaml

@@ -2,13 +2,13 @@
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: {{ .Values.operator.name }}-ca
+  name: {{ (include "keda.operator.name" .) }}-ca
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "keda.labels" . | indent 4 }}
 spec:
   isCA: true
-  commonName: {{ .Values.operator.name }}
+  commonName: {{ (include "keda.operator.name" .) }}
   secretName: {{ .Values.certificates.certManager.caSecretName }}
   secretTemplate:
     {{- toYaml .Values.certificates.certManager.secretTemplate | nindent 4 }}
@@ -18,7 +18,7 @@ spec:
   duration: 43800h0m0s     # 5 years
   renewBefore: 14600h0m0s  # 1.6 year, 1/3rd of the duration
   issuerRef:
-    name: {{ .Values.operator.name }}-selfsigned-issuer
+    name: {{ (include "keda.operator.name" .) }}-selfsigned-issuer
     kind: Issuer
     group: cert-manager.io
 {{- end }}

keda/templates/cert-manager/self-issuer.yaml

@@ -6,7 +6,7 @@ metadata:
   annotations:
     {{- toYaml . | nindent 4 }}
   {{- end }}
-  name: {{ .Values.operator.name }}-selfsigned-issuer
+  name: {{ (include "keda.operator.name" .) }}-selfsigned-issuer
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "keda.labels" . | indent 4 }}

keda/templates/crds/crd-cloudeventsources.yaml

@@ -8,7 +8,7 @@ metadata:
     {{- toYaml (merge .Values.crds.additionalAnnotations .Values.additionalAnnotations) | nindent 4 }}
     {{- end }}
   labels:
-    app.kubernetes.io/name: {{ .Values.operator.name }}
+    app.kubernetes.io/name: {{ (include "keda.operator.name" .) }}
     {{- include "keda.crd-labels" . | indent 4 }}
   name: cloudeventsources.eventing.keda.sh
 spec:

keda/templates/crds/crd-clustercloudeventsources.yaml

@@ -8,7 +8,7 @@ metadata:
     {{- toYaml (merge .Values.crds.additionalAnnotations .Values.additionalAnnotations) | nindent 4 }}
     {{- end }}
   labels:
-    app.kubernetes.io/name: {{ .Values.operator.name }}
+    app.kubernetes.io/name: {{ (include "keda.operator.name" .) }}
     {{- include "keda.crd-labels" . | indent 4 }}
   name: clustercloudeventsources.eventing.keda.sh
 spec:

keda/templates/crds/crd-clustertriggerauthentications.yaml

@@ -8,7 +8,7 @@ metadata:
     {{- toYaml (merge .Values.crds.additionalAnnotations .Values.additionalAnnotations) | nindent 4 }}
     {{- end }}
   labels:
-    app.kubernetes.io/name: {{ .Values.operator.name }}
+    app.kubernetes.io/name: {{ (include "keda.operator.name" .) }}
     {{- include "keda.crd-labels" . | indent 4 }}
   name: clustertriggerauthentications.keda.sh
 spec:

keda/templates/crds/crd-scaledjobs.yaml

@@ -8,7 +8,7 @@ metadata:
     {{- toYaml (merge .Values.crds.additionalAnnotations .Values.additionalAnnotations) | nindent 4 }}
     {{- end }}
   labels:
-    app.kubernetes.io/name: {{ .Values.operator.name }}
+    app.kubernetes.io/name: {{ (include "keda.operator.name" .) }}
     {{- include "keda.crd-labels" . | indent 4 }}
   name: scaledjobs.keda.sh
 spec:

keda/templates/crds/crd-scaledobjects.yaml

@@ -8,7 +8,7 @@ metadata:
     {{- toYaml (merge .Values.crds.additionalAnnotations .Values.additionalAnnotations) | nindent 4 }}
     {{- end }}
   labels:
-    app.kubernetes.io/name: {{ .Values.operator.name }}
+    app.kubernetes.io/name: {{ (include "keda.operator.name" .) }}
     {{- include "keda.crd-labels" . | indent 4 }}
   name: scaledobjects.keda.sh
 spec:

keda/templates/crds/crd-scalinggroups.yaml

@@ -8,7 +8,7 @@ metadata:
     {{- toYaml (merge .Values.crds.additionalAnnotations .Values.additionalAnnotations) | nindent 4 }}
     {{- end }}
   labels:
-    app.kubernetes.io/name: {{ .Values.operator.name }}
+    app.kubernetes.io/name: {{ (include "keda.operator.name" .) }}
     {{- include "keda.crd-labels" . | indent 4 }}
   name: scalinggroups.keda.kedify.io
 spec:

keda/templates/crds/crd-triggerauthentications.yaml

@@ -8,7 +8,7 @@ metadata:
     {{- toYaml (merge .Values.crds.additionalAnnotations .Values.additionalAnnotations) | nindent 4 }}
     {{- end }}
   labels:
-    app.kubernetes.io/name: {{ .Values.operator.name }}
+    app.kubernetes.io/name: {{ (include "keda.operator.name" .) }}
     {{- include "keda.crd-labels" . | indent 4 }}
   name: triggerauthentications.keda.sh
 spec:

keda/templates/kedify-agent-secret-rbac.yaml

@@ -18,7 +18,7 @@ rules:
   resources: ["secrets"]
   verbs: ["get"]
   resourceNames:
-  - {{ .Values.certificates.secretName | quote }}
+  - {{ (include "keda.certificates.secretName" .) | quote }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding

keda/templates/kedify-tenant-registration-configmap.yaml

@@ -15,11 +15,11 @@ data:
   name: {{ printf "%s/%s" .Release.Namespace .Release.Name | quote }}
   namespace: {{ .Release.Namespace | quote }}
   watchNamespace: {{ .Values.watchNamespace | default .Release.Namespace | quote }}
-  address: {{ .Values.kedify.multitenant.address | default (printf "%s.%s.svc.%s:9666" .Values.operator.name .Release.Namespace .Values.clusterDomain) | quote }}
+  address: {{ .Values.kedify.multitenant.address | default (printf "%s.%s.svc.%s:9666" (include "keda.operator.name" .) .Release.Namespace .Values.clusterDomain) | quote }}
   {{- if .Values.kedify.multitenant.authority }}
   authority: {{ .Values.kedify.multitenant.authority | quote }}
   {{- end }}
-  tlsSecretRef: {{ .Values.certificates.secretName | quote }}
+  tlsSecretRef: {{ (include "keda.certificates.secretName" .) | quote }}
   isDefaultTenant: {{ eq .Values.kedify.multitenant.mode "default" | quote }}
-  operatorDeploymentName: {{ .Values.operator.name | quote }}
+  operatorDeploymentName: {{ (include "keda.operator.name" .) | quote }}
 {{- end }}

keda/templates/manager/ciliumnetworkpolicy.yaml

@@ -2,21 +2,21 @@
 apiVersion: "cilium.io/v2"
 kind: CiliumNetworkPolicy
 metadata:
-  name: {{ .Values.operator.name }}
+  name: {{ (include "keda.operator.name" .) }}
   namespace: {{ .Release.Namespace }}
   {{- with .Values.additionalAnnotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
   {{- end }}
   labels:
-    app: {{ .Values.operator.name }}
-    name: {{ .Values.operator.name }}
-    app.kubernetes.io/name: {{ .Values.operator.name }}
+    app: {{ (include "keda.operator.name" .) }}
+    name: {{ (include "keda.operator.name" .) }}
+    app.kubernetes.io/name: {{ (include "keda.operator.name" .) }}
     {{- include "keda.labels" . | indent 4 }}
 spec:
   endpointSelector:
     matchLabels:
-      app: {{ .Values.operator.name }}
+      app: {{ (include "keda.operator.name" .) }}
   egress:
     - toEntities:
         - kube-apiserver

keda/templates/manager/clusterrole.yaml

@@ -7,9 +7,9 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
   labels:
-    app.kubernetes.io/name: {{ .Values.operator.name }}
+    app.kubernetes.io/name: {{ (include "keda.operator.name" .) }}
     {{- include "keda.labels" . | indent 4 }}
-  name: {{ .Values.operator.name }}
+  name: {{ (include "keda.operator.name" .) }}
 rules:
 - apiGroups:
   - ""
@@ -169,7 +169,7 @@ metadata:
   labels:
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
-    app.kubernetes.io/name: {{ .Values.operator.name }}
+    app.kubernetes.io/name: {{ (include "keda.operator.name" .) }}
     {{- include "keda.labels" . | indent 4 }}
 rules:
 - apiGroups:
@@ -203,7 +203,7 @@ metadata:
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
     rbac.authorization.k8s.io/aggregate-to-view: "true"
-    app.kubernetes.io/name: {{ .Values.operator.name }}
+    app.kubernetes.io/name: {{ (include "keda.operator.name" .) }}
     {{- include "keda.labels" . | indent 4 }}
 rules:
 - apiGroups:
@@ -238,9 +238,9 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
   labels:
-    app.kubernetes.io/name: {{ $.Values.operator.name }}
+    app.kubernetes.io/name: {{ (include "keda.operator.name" $) }}
     {{- include "keda.labels" $ | indent 4 }}
-  name: {{ $.Values.operator.name }}-token-creator-{{ $r.name }}
+  name: {{ (include "keda.operator.name" $) }}-token-creator-{{ $r.name }}
   namespace: {{ $r.namespace }}
 rules:
 - apiGroups:
@@ -260,17 +260,17 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
   labels:
-    app.kubernetes.io/name: {{ $.Values.operator.name }}
+    app.kubernetes.io/name: {{ (include "keda.operator.name" $) }}
     {{- include "keda.labels" $ | indent 4 }}
-  name: {{ $.Values.operator.name }}-token-creator-{{ $r.name }}
+  name: {{ (include "keda.operator.name" $) }}-token-creator-{{ $r.name }}
   namespace: {{ $r.namespace }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: {{ $.Values.operator.name }}-token-creator-{{ $r.name }}
+  name: {{ (include "keda.operator.name" $) }}-token-creator-{{ $r.name }}
 subjects:
 - kind: ServiceAccount
-  name: {{ $.Values.operator.name }}
+  name: {{ (include "keda.operator.name" $) }}
   namespace: {{ $.Release.Namespace }}
 {{- end }}
 {{- end }}

keda/templates/manager/clusterrolebindings.yaml

@@ -8,16 +8,16 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
   labels:
-    app.kubernetes.io/name: {{ .Values.operator.name }}
+    app.kubernetes.io/name: {{ (include "keda.operator.name" .) }}
     {{- include "keda.labels" . | indent 4 }}
-  name: {{ .Values.operator.name }}
+  name: {{ (include "keda.operator.name" .) }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: {{ .Values.operator.name }}
+  name: {{ (include "keda.operator.name" .) }}
 subjects:
 - kind: ServiceAccount
-  name: {{ (.Values.serviceAccount.operator).name | default .Values.serviceAccount.name }}
+  name: {{ include "keda.operator.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
 {{- else }}
   {{- $namespaces := uniq (append (splitList "," .Values.watchNamespace) .Release.Namespace) -}}
@@ -32,17 +32,17 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
   labels:
-    app.kubernetes.io/name: {{ $.Values.operator.name }}
+    app.kubernetes.io/name: {{ (include "keda.operator.name" $) }}
     {{- include "keda.labels" $ | indent 4 }}
-  name: {{ $.Values.operator.name }}
+  name: {{ (include "keda.operator.name" $) }}
   namespace: {{ . | trim }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: {{ $.Values.operator.name }}
+  name: {{ (include "keda.operator.name" $) }}
 subjects:
 - kind: ServiceAccount
-  name: {{ ($.Values.serviceAccount.operator).name | default $.Values.serviceAccount.name }}
+  name: {{ include "keda.operator.serviceAccountName" $ }}
   namespace: {{ $.Release.Namespace }}
 ---
   {{- end }}