Validate command creates k8s namespace

[hnicke]

Bug

Current Behavior

When running garden validate, garden creates the target k8s namespace (if it doesn't exist).
garden validate fails if the configured kube-context is not available.

Expected behavior

• garden valdiate should not have any sideeffects or they should be documented
• garden validate should not require write permission for the target cluster
• particurlarily, it should not create a namespace
• I'd prefer if garden validate wouldn't fail if the configured context is invalid

garden version
0.12.46

[hnicke]

I've stumbled across a similar issue today: garden update-remote will fail if it can't connect to the cluster. I expect that the update-remote command does not try to connect to the k8s cluster at all. Or is there a reason..?

[Orzelius]

@hnicke thanks for pointing that out! We'll work on fixing both as it's weird behavior and makes these commands way slower than they should be

[stale]

This issue has been automatically marked as stale because it hasn't had any activity in 90 days. It will be closed in 14 days if no further activity occurs (e.g. changing labels, comments, commits, etc.). Please feel free to tag a maintainer and ask them to remove the label if you think it doesn't apply. Thank you for submitting this issue and helping make Garden a better product!

[hnicke]

still relevant

[alexkuretz]

This also occurs when using the garden logs command, if the namespace doesn't exist (usually occurs when a dev typo's the namespace name while trying to view logs in a deployment) garden creates an empty namespace.

BUILDVERSION=garden-test garden logs --env main

project.garden.yml snippet:

- name: main  
    defaultNamespace: ${local.env.BUILDVERSION}  
    providers:  
      - name: kubernetes  
        context: arn:aws:eks:us-west-2:${var.aws-account}:cluster/${var.cluster-name}

Per Albert from Garden:

Currently this is expected behaviour as you're passing the namespace via defaultNamespace: ${local.env.BUILDVERSION}
Garden creating the namespace is a side effect of #3327
It's currently not an easy fix but one day we'll get do it.
I'd recommend to create an exec initscript that validates the BUILDVERSION env var and throws if it's not correct. Then you could make the kubernetes provider depend on the exec provider which would validate the namespace before kubernetes provider attempts to create it.