From 88abae90ba0cac29c323d4e6f9acdb9ecc3769c6 Mon Sep 17 00:00:00 2001
From: Kjeld Schouten <info@kjeldschouten.nl>
Date: Sun, 20 Oct 2024 12:06:18 +0200
Subject: [PATCH] fix(clustertool): move spegel into its own namespace

---
 .../kubernetes/core/kyverno-policies/app/patch-gha.yaml    | 4 ++--
 .../{kube-system => system}/spegel/app/helm-release.yaml   | 2 +-
 .../generic/kubernetes/system/spegel/app/namespace.yaml    | 7 +++++++
 clustertool/pkg/gencmd/bootstrap.go                        | 2 +-
 4 files changed, 11 insertions(+), 4 deletions(-)
 rename clustertool/embed/generic/kubernetes/{kube-system => system}/spegel/app/helm-release.yaml (97%)
 create mode 100644 clustertool/embed/generic/kubernetes/system/spegel/app/namespace.yaml

diff --git a/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/patch-gha.yaml b/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/patch-gha.yaml
index cdd96e2f9c5..56c1f3a9a12 100644
--- a/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/patch-gha.yaml
+++ b/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/patch-gha.yaml
@@ -25,5 +25,5 @@ spec:
                   - dockerd
                   - --host=unix:///var/run/docker.sock
                   - --group=123
-                  - --registry-mirror=http://spegel-registry.kube-system.svc.cluster.local:5000
-                  - --insecure-registry=http://spegel-registry.kube-system.svc.cluster.local:5000
+                  - --registry-mirror=http://spegel-registry.spegel.svc.cluster.local:5000
+                  - --insecure-registry=http://spegel-registry.spegel.svc.cluster.local:5000
diff --git a/clustertool/embed/generic/kubernetes/kube-system/spegel/app/helm-release.yaml b/clustertool/embed/generic/kubernetes/system/spegel/app/helm-release.yaml
similarity index 97%
rename from clustertool/embed/generic/kubernetes/kube-system/spegel/app/helm-release.yaml
rename to clustertool/embed/generic/kubernetes/system/spegel/app/helm-release.yaml
index 994fd219b48..b3799acdc6b 100644
--- a/clustertool/embed/generic/kubernetes/kube-system/spegel/app/helm-release.yaml
+++ b/clustertool/embed/generic/kubernetes/system/spegel/app/helm-release.yaml
@@ -4,7 +4,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
   name: spegel
-  namespace: kube-system
+  namespace: spegel
 spec:
   interval: 30m
   chart:
diff --git a/clustertool/embed/generic/kubernetes/system/spegel/app/namespace.yaml b/clustertool/embed/generic/kubernetes/system/spegel/app/namespace.yaml
new file mode 100644
index 00000000000..c275d6eff84
--- /dev/null
+++ b/clustertool/embed/generic/kubernetes/system/spegel/app/namespace.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: spegel
+    labels:
+        pod-security.kubernetes.io/enforce: privileged
+        topolvm.io/webhook: ignore
diff --git a/clustertool/pkg/gencmd/bootstrap.go b/clustertool/pkg/gencmd/bootstrap.go
index a1dee0b4705..de28edbf9d6 100644
--- a/clustertool/pkg/gencmd/bootstrap.go
+++ b/clustertool/pkg/gencmd/bootstrap.go
@@ -165,7 +165,7 @@ func RunBootstrap(args []string) {
     close(stopCh)
 
     prioCharts := []fluxhandler.HelmChart{
-        {filepath.Join(helper.ClusterPath, "/kubernetes/kube-system/spegel/app"), false, true},
+        {filepath.Join(helper.ClusterPath, "/kubernetes/system/spegel/app"), false, true},
         {filepath.Join(helper.ClusterPath, "/kubernetes/system/cert-manager/app"), false, false},
     }
     fluxhandler.InstallCharts(prioCharts, HelmRepos, false)