Ensure serviceaccount created in correct namespace (#398)

* Ensure serviceaccount created in correct namespace

The serviceaccount for a module is created via the IRSA module. If the
namespace of a module differs from the default, it needs to also be
passed to the IRSA module. Otherwise any deployments tied to the
serviceaccount will fail to deploy pods.

* Create a non-default namespace

Create the namespace, if it is not the default "kube-system" which
(typically) exists on every cluster.

To allow the namespace to be created external to this module, allow the
IRSA config to be overridden. This should fit both my and
@vara-bonthu's proposed use cases.

* Apply reccommended changes

* Apply the fix to cert-manager

Co-authored-by: Robert Williams <[email protected]>

Author: bobdoah

modules/irsa/main.tf

@@ -1,5 +1,5 @@
 resource "kubernetes_namespace_v1" "irsa" {
-  count = var.create_kubernetes_namespace ? 1 : 0
+  count = var.create_kubernetes_namespace && var.kubernetes_namespace != "kube-system" ? 1 : 0
   metadata {
     name = var.kubernetes_namespace
 

modules/kubernetes-addons/aws-load-balancer-controller/locals.tf

@@ -41,9 +41,9 @@ locals {
   }
 
   irsa_config = {
-    kubernetes_namespace              = "kube-system"
+    kubernetes_namespace              = local.helm_config["namespace"]
     kubernetes_service_account        = local.service_account_name
-    create_kubernetes_namespace       = false
+    create_kubernetes_namespace       = try(local.helm_config["create_namespace"], true)
     create_kubernetes_service_account = true
     irsa_iam_policies                 = [aws_iam_policy.aws_load_balancer_controller.arn]
   }

modules/kubernetes-addons/cert-manager/locals.tf

@@ -33,7 +33,7 @@ locals {
   irsa_config = {
     kubernetes_namespace              = local.helm_config["namespace"]
     kubernetes_service_account        = local.service_account_name
-    create_kubernetes_namespace       = true
+    create_kubernetes_namespace       = try(local.helm_config["create_namespace"], true)
     create_kubernetes_service_account = true
   }