Fix flyte-to-union prefix and add singleTenantOrgID to selfhosted DP

charts/controlplane/values.yaml

@@ -1013,6 +1013,15 @@ flyte:
         maxOpenConnections: 20
         connMaxLifeTime: 120s
   configmap:
+    # --- Namespace Mapping (flyteadmin) ---
+    # Controls how flyteadmin maps project-domain pairs to Kubernetes namespaces.
+    # MUST match the dataplane's namespace_mapping value.
+    # Default (if unset): "{{ project }}-{{ domain }}"
+    #
+    # namespace_config:
+    #   namespace_mapping:
+    #     template: "{{ project }}-{{ domain }}"
+
     adminServer:
       admin:
         endpoint: 'dns:///{{ .Values.global.UNION_HOST }}'

charts/dataplane/templates/clusterresourcesync/configmap.yaml

@@ -35,7 +35,8 @@ data:
       {{- tpl (toYaml .) $ | nindent 6 }}
   {{- end }}
 
-  {{- with .Values.config.namespace_mapping }}
+  {{- $nsMapping := .Values.config.namespace_mapping | default .Values.namespace_mapping }}
+  {{- with $nsMapping }}
   namespace_mapping.yaml: |
     namespace_mapping:
       {{- tpl (toYaml .) $ | nindent 6 }}

charts/dataplane/templates/clusterresourcesync/serviceaccount.yaml

@@ -38,7 +38,7 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: clustersync-resource
+  name: union-clustersync-resource
 subjects:
   - kind: ServiceAccount
     name: union-{{ include "clusterresourcesync.serviceAccountName" . }}

charts/dataplane/templates/nodeexecutor/configmap.yaml

@@ -28,6 +28,12 @@ data:
     {{- with .Values.executor.raw_config }}
     {{- tpl (toYaml .) $ | nindent 4 }}
     {{- end }}
+    {{- if not (dig "namespace_mapping" false .Values.executor.raw_config) }}
+    {{- with .Values.namespace_mapping }}
+    namespace_mapping:
+      {{- tpl (toYaml .) $ | nindent 6 }}
+    {{- end }}
+    {{- end }}
     union:
       {{- with .Values.config.union.connection }}
       connection:

charts/dataplane/templates/operator/configmap.yaml

@@ -73,6 +73,10 @@ data:
       org:
         {{- tpl (toYaml .) $ | nindent 8 }}
     {{- end }}
+    {{- if and (not .Values.config.operator.org) .Values.namespace_mapping }}
+      org:
+        namespaceTemplate: {{ tpl (.Values.namespace_mapping.template | quote) $ }}
+    {{- end }}
     {{- if .Values.imageBuilder.enabled }}
       imageBuilder:
         enabled: {{ .Values.imageBuilder.enabled }}

charts/dataplane/templates/operator/deployment-proxy.yaml

@@ -31,7 +31,7 @@ spec:
                 name: {{ include "union-operator.fullname" . }}
             {{- if .Values.clusterresourcesync.enabled }}
             - configMap:
-                name: flyte-clusterresourcesync-config
+                name: union-clusterresourcesync-config
             {{- end }}
         {{- if .Values.secrets.admin.enable }}
         - name: secret-volume

charts/dataplane/templates/propeller/configmap.yaml

@@ -35,6 +35,12 @@ data:
 {{- with .Values.config.namespace_config }}
   namespace_config.yaml: | {{ tpl (toYaml .) $ | nindent 4 }}
 {{- end }}
+{{- if and (not .Values.config.namespace_config) .Values.namespace_mapping }}
+  namespace_config.yaml: |
+    namespace_config:
+      namespace_mapping:
+        {{- tpl (toYaml .Values.namespace_mapping) $ | nindent 8 }}
+{{- end }}
 {{- with .Values.config.resource_manager }}
   resource_manager.yaml: | {{ tpl (toYaml .) $ | nindent 4 }}
 {{- end }}

charts/dataplane/values.aws.selfhosted-intracluster.yaml

@@ -191,6 +191,10 @@ clusterresourcesync:
 # using Kubernetes internal networking (ClusterIP services).
 
 config:
+  sharedService:
+    security:
+      singleTenantOrgID: '{{ .Values.global.ORG_NAME }}'
+
   admin:
     admin:
       # Flyteadmin endpoint (control plane admin service)

charts/dataplane/values.gcp.selfhosted-intracluster.yaml

@@ -208,6 +208,10 @@ clusterresourcesync:
 # using Kubernetes internal networking (ClusterIP services).
 
 config:
+  sharedService:
+    security:
+      singleTenantOrgID: '{{ .Values.global.ORG_NAME }}'
+
   # Override storage paths to use gs:// instead of s3://
   core:
     propeller:

charts/dataplane/values.yaml

@@ -625,7 +625,11 @@ databricks:
   enabled: false
   plugin_config: { }
 
-# -- Custom namespace mapping for mapping Union runs to Kubernetes namespaces.
+# -- Namespace mapping template for mapping Union runs to Kubernetes namespaces.
+# This is the canonical source of truth. All dataplane services (propeller,
+# clusterresourcesync, operator, executor) will inherit this value unless
+# explicitly overridden in their service-specific config sections
+# (config.namespace_config, config.operator.org, executor.raw_config).
 namespace_mapping: {}
   # template: "{{`{{ project }}`}}-{{`{{ domain }}`}}"
 

tests/generated/dataplane.additional-podlabels.yaml

@@ -1623,7 +1623,7 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: clustersync-resource
+  name: union-clustersync-resource
 subjects:
   - kind: ServiceAccount
     name: union-clustersync-system
@@ -2955,7 +2955,7 @@ spec:
             - configMap:
                 name: union-operator
             - configMap:
-                name: flyte-clusterresourcesync-config
+                name: union-clusterresourcesync-config
         - name: secret-volume
           secret:
             secretName: union-secret-auth

tests/generated/dataplane.aws.eks-automode.yaml

@@ -1833,7 +1833,7 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: clustersync-resource
+  name: union-clustersync-resource
 subjects:
   - kind: ServiceAccount
     name: union-clustersync-system
@@ -3493,7 +3493,7 @@ spec:
             - configMap:
                 name: union-operator
             - configMap:
-                name: flyte-clusterresourcesync-config
+                name: union-clusterresourcesync-config
         - name: secret-volume
           secret:
             secretName: union-secret-auth

tests/generated/dataplane.aws.with-ingress.yaml

@@ -1635,7 +1635,7 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: clustersync-resource
+  name: union-clustersync-resource
 subjects:
   - kind: ServiceAccount
     name: union-clustersync-system
@@ -2961,7 +2961,7 @@ spec:
             - configMap:
                 name: union-operator
             - configMap:
-                name: flyte-clusterresourcesync-config
+                name: union-clusterresourcesync-config
         - name: secret-volume
           secret:
             secretName: union-secret-auth

tests/generated/dataplane.aws.yaml

@@ -1274,6 +1274,9 @@ data:
     logger:
       level: 4
       show-source: true
+  namespace_mapping.yaml: |
+    namespace_mapping:
+      template: '{{ project }}-{{ domain }}'
 ---
 # Source: dataplane/templates/clusterresourcesync/configmap.yaml
 apiVersion: v1
@@ -1493,6 +1496,8 @@ data:
           cpu: 4096
           gpu: 256
           memory: 2Ti
+    namespace_mapping:
+      template: '{{ project }}-{{ domain }}'
     union:
       connection:
         host: dns:///test-controlplane-host
@@ -1632,6 +1637,8 @@ data:
           endpoint: 'http://flytepropeller:10254'
         proxy:
           endpoint: 'http://union-operator-proxy:10254'
+      org:
+        namespaceTemplate: "{{ project }}-{{ domain }}"
       imageBuilder:
         enabled: true
         executionNamespaceLabels:
@@ -1795,6 +1802,10 @@ data:
     logger:
       level: 4
       show-source: true
+  namespace_config.yaml: |
+    namespace_config:
+      namespace_mapping:
+        template: '{{ project }}-{{ domain }}'
   resource_manager.yaml: | 
     propeller:
       resourcemanager:
@@ -2633,7 +2644,7 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: clustersync-resource
+  name: union-clustersync-resource
 subjects:
   - kind: ServiceAccount
     name: union-clustersync-system
@@ -4412,7 +4423,7 @@ spec:
   template:
     metadata:
       annotations:
-        configChecksum: "4c10925a32e76bd929981340593aa27527dc5f5827716a704f673db74981dc5"
+        configChecksum: "96e08b4b50439ee97d49319af9b9c392cffe7461c4ffe74aeaa4860d09c0aa8"
 
       labels:
 
@@ -4628,7 +4639,7 @@ spec:
   template:
     metadata:
       annotations:
-        configChecksum: "71f13cdc28f478300a3a90f5237a97936a1d96315c52911dff8b0756be1304f"
+        configChecksum: "abb00a305bfda2dcf825ac2267a95fe083054bb9ce97bb8bc3f2be362fd863e"
       labels:
 
         app: executor
@@ -4729,7 +4740,7 @@ spec:
   template:
     metadata:
       annotations:
-        configChecksum: "aa0b3e931973af95466cb9c822de00987868ffab27ce820f7949f1b507fca88"
+        configChecksum: "071c066b54a8d9b15360f8d98529029af0e3c7748deb7436d95df1ef3ac4578"
 
       labels:
 
@@ -4745,7 +4756,7 @@ spec:
             - configMap:
                 name: union-operator
             - configMap:
-                name: flyte-clusterresourcesync-config
+                name: union-clusterresourcesync-config
         - name: secret-volume
           secret:
             secretName: union-secret-auth
@@ -4866,7 +4877,7 @@ spec:
   template:
     metadata:
       annotations:
-        configChecksum: "aa0b3e931973af95466cb9c822de00987868ffab27ce820f7949f1b507fca88"
+        configChecksum: "071c066b54a8d9b15360f8d98529029af0e3c7748deb7436d95df1ef3ac4578"
 
       labels:
 
@@ -4983,7 +4994,7 @@ spec:
         platform.union.ai/service-group: release-name
         app.kubernetes.io/managed-by: Helm
       annotations:
-        configChecksum: "ed08f5a0ef5d77051b1af982bca6e255e12245db7f508442075567beabe1106"
+        configChecksum: "ce28c1ece19c982aaa77267a6d9f6b1818e9477097b789666fbe0d216d37060"
 
     spec:
       securityContext:
@@ -5138,7 +5149,7 @@ spec:
   template:
     metadata:
       annotations:
-        configChecksum: "ed08f5a0ef5d77051b1af982bca6e255e12245db7f508442075567beabe1106"
+        configChecksum: "ce28c1ece19c982aaa77267a6d9f6b1818e9477097b789666fbe0d216d37060"
 
       labels:
 

tests/generated/dataplane.azure-custom-storage-prefix.yaml

@@ -1730,7 +1730,7 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: clustersync-resource
+  name: union-clustersync-resource
 subjects:
   - kind: ServiceAccount
     name: union-clustersync-system
@@ -3059,7 +3059,7 @@ spec:
             - configMap:
                 name: union-operator
             - configMap:
-                name: flyte-clusterresourcesync-config
+                name: union-clusterresourcesync-config
         - name: secret-volume
           secret:
             secretName: union-secret-auth

tests/generated/dataplane.azure.yaml

@@ -2607,7 +2607,7 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: clustersync-resource
+  name: union-clustersync-resource
 subjects:
   - kind: ServiceAccount
     name: union-clustersync-system
@@ -4388,7 +4388,7 @@ spec:
             - configMap:
                 name: union-operator
             - configMap:
-                name: flyte-clusterresourcesync-config
+                name: union-clusterresourcesync-config
         - name: secret-volume
           secret:
             secretName: union-secret-auth

tests/generated/dataplane.cost.yaml

@@ -1512,7 +1512,7 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: clustersync-resource
+  name: union-clustersync-resource
 subjects:
   - kind: ServiceAccount
     name: union-clustersync-system
@@ -2721,7 +2721,7 @@ spec:
             - configMap:
                 name: union-operator
             - configMap:
-                name: flyte-clusterresourcesync-config
+                name: union-clusterresourcesync-config
         - name: secret-volume
           secret:
             secretName: union-secret-auth

tests/generated/dataplane.dcgm-exporter.yaml

@@ -1758,7 +1758,7 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: clustersync-resource
+  name: union-clustersync-resource
 subjects:
   - kind: ServiceAccount
     name: union-clustersync-system
@@ -3286,7 +3286,7 @@ spec:
             - configMap:
                 name: union-operator
             - configMap:
-                name: flyte-clusterresourcesync-config
+                name: union-clusterresourcesync-config
         - name: secret-volume
           secret:
             secretName: union-secret-auth