Iotedge: Install IoT Edge in pre existing namespace

[alexcpn]

There is a use case to install IoT Edge in a pre-existing namespace. Basically, we want to create a kubernetes namespace and assign a namespace to a particular node in a multi-node edge cluster and also assign other fencing to the namespace like roles and permission so that we can install any third party MS IoT Edge compatible applications on the namespace without worrying about it interfering with our critical services running on Edge. Edge in our case is a multinode Edge, you can say slimmed-down server nodes.

Raising the issue here as advised on https://github.com/MicrosoftDocs/azure-docs/issues/34589

Expected Behavior

Should be able to install IoT Edge in a namespace that is provided

Current Behavior

helm install --name k8s-edge3 --set "deviceConnectionString=HostName=alexcpn-iot-hub.azure-devices.net;DeviceId=ndac-app-fake;SharedAccessKey=..." edgek8s/edge-kubernetes --namespace msiot-alexcpn-iot-hub-xx-app-fake
Error: release k8s-edge3 failed: namespaces "msiot-alexcpn-iot-hub-xxx-app-fake" already exists

Steps to Reproduce

1.Create a namespace in your kubernetes edge cluster
2..Create an iot hub in MS Azure

1. Create and assing an device to the hub. Get the connection string of the device
2. Install the Iot-hub in your Edge while specifying the namespace you want it to be installed on

edge-agent logs

Error: release k8s-edge3 failed: namespaces "msiot-alexcpn-iot-hub-xxx-app-fake" already exists

<Paste here>

edge-hub logs

<Paste here>

Additional Information

[ancaantochi]

@alexcpn, please rotate the device SAS key because it was added in this issue description

[alexcpn]

Yes, I had taken care of that.

[veyalla]

FYI @avranju @darobs

[avranju]

Thanks for filing this. This is exactly the approach we are taking for the GA release of this integration. You will be able to specify the namespace to use for a given deployment.

[alexcpn]

@avranju Thanks. One more feedback/request; In the RBAC rules in the helm chart the edge-agent component uses the _cluster-admin role_ ; Can this be changed to have only namespace level access right ? as we/ generally, no Edge Cloud provider would like to give the cluster-admin role to a third party
`` apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: "{{.Release.Name}}-service-account"
namespace: {{ include "edge-kubernetes.namespace" . | quote }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:

• kind: ServiceAccount
  name: "{{.Release.Name}}-service-account"
  namespace: {{ include "edge-kubernetes.namespace" . | quote }}
  ````

[veyalla]

Yes, this was addressed as part of:
https://github.com/Azure/iotedge/pull/1423/files#diff-d763dde5703ff408427f1d329f4037f9

@dmolokanov - fyi

[alexcpn]

hi, iany update for this

[veyalla]

@alexcpn We're preparing a public preview refresh of Kubernetes support in Nov which should address your requirements.

Could you please reach out to me at [email protected]? I'd like to understand a bit more about your use case and plans around leveraging this support.

[veyalla]

This feature was delivered in the preview refresh of Kubernetes support: https://aka.ms/edgek8sdoc