chore(charts): Add separate namespace field for trace collector service account (#14539)

* chore(docs): Update tracing documentation

This clarifies the tracing documentation that the trace collector must be meshed, along with the specifics of how the service account name for the collector should be set.

Signed-off-by: Scott Fleener <[email protected]>

* chore(docs): Include `serviceAccountNamespace` for tracing collector

This separates out the service account namespace from the name to make it clearer how to set the correct service account for the trace collector.

Signed-off-by: Scott Fleener <[email protected]>

* chore(docs): Make docs clearer about what needs to be set for the collector mesh identity

Signed-off-by: Scott Fleener <[email protected]>

* fix(test): Update tracing test values

Signed-off-by: Scott Fleener <[email protected]>

* feat(charts): Switch ServiceAccountName to separate Name and Namespace fields

Signed-off-by: Scott Fleener <[email protected]>

* fix: Change deprecated casing for lint

Signed-off-by: Scott Fleener <[email protected]>

* chore: Rename fields and semantics of tracing identity

Signed-off-by: Scott Fleener <[email protected]>

* chore: Fix bad auto-rename

Signed-off-by: Scott Fleener <[email protected]>

* chore: Change to breaking API change

Signed-off-by: Scott Fleener <[email protected]>

---------

Signed-off-by: Scott Fleener <[email protected]>

Author: sfleen

charts/linkerd-control-plane/values.yaml

@@ -281,15 +281,23 @@ proxy:
   # Configures tracing in the proxy and how they are exported
   tracing:
     # -- Enables trace collection and export in the proxy
-    enable: false
+    enabled: false
     traceServiceName: linkerd-proxy
     collector:
       # -- The collector endpoint to send traces to.
       endpoint: ""
-      # -- The identity of the collector in the linkerd mesh. If the collector
-      # is unmeshed, this should remain unset.
+      # -- The identity of the collector in the linkerd mesh.
       meshIdentity:
+        # -- Mesh identity name for the trace collector. This should be set to
+        # the name of the service account attached to the collector. If
+        # there's no explicitly set service account, this will probably be
+        # "default".
         serviceAccountName: ""
+        # -- Mesh identity namespace for the trace collector. This should be
+        # set to the namespace of the service account attached to the
+        # collector. If there's no explicitly set service account, this is the
+        # namespace of the collector.
+        namespace: ""
   inbound:
     server:
       http2:

charts/partials/templates/_proxy.tpl

@@ -148,7 +148,7 @@ env:
   value: 30s
 - name: LINKERD2_PROXY_OUTBOUND_METRICS_HOSTNAME_LABELS
   value: {{ .Values.proxy.metrics.hostnameLabels | quote }}
-{{ if .Values.proxy.tracing | default (dict) | dig "enable" false -}}
+{{ if .Values.proxy.tracing | default (dict) | dig "enabled" false -}}
 - name: LINKERD2_PROXY_TRACE_ATTRIBUTES_PATH
   value: /var/run/linkerd/podinfo/labels
 - name: LINKERD2_PROXY_TRACE_PROTOCOL
@@ -160,10 +160,14 @@ env:
 {{- end }}
 - name: LINKERD2_PROXY_TRACE_COLLECTOR_SVC_ADDR
   value: {{ .Values.proxy.tracing.collector.endpoint }}
-{{ if .Values.proxy.tracing.collector.meshIdentity.serviceAccountName -}}
+{{- if empty .Values.proxy.tracing.collector.meshIdentity.serviceAccountName }}
+{{- fail "proxy.tracing.collector.meshIdentity.serviceAccountName must be set if proxy tracing is enabled" }}
+{{- end }}
+{{- if empty .Values.proxy.tracing.collector.meshIdentity.namespace }}
+{{- fail "proxy.tracing.collector.meshIdentity.namespace must be set if proxy tracing is enabled" }}
+{{- end }}
 - name: LINKERD2_PROXY_TRACE_COLLECTOR_SVC_NAME
-  value: {{ .Values.proxy.tracing.collector.meshIdentity.serviceAccountName }}.serviceaccount.identity.{{.Release.Namespace}}.{{ .Values.clusterDomain }}
-{{ end -}}
+  value: {{ .Values.proxy.tracing.collector.meshIdentity.serviceAccountName }}.{{ .Values.proxy.tracing.collector.meshIdentity.namespace }}.serviceaccount.identity.{{.Release.Namespace}}.{{ .Values.clusterDomain }}
 - name: LINKERD2_PROXY_TRACE_EXTRA_ATTRIBUTES
   value: |
     k8s.pod.ip=$(_pod_ip)

cli/cmd/install_test.go

@@ -125,12 +125,13 @@ func TestRender(t *testing.T) {
 				HostnameLabels: false,
 			},
 			Tracing: &charts.ProxyTracing{
-				Enable:           false,
+				Enabled:          false,
 				TraceServiceName: "linkerd-proxy",
 				Collector: &charts.ProxyTracingCollector{
 					Endpoint: "",
 					MeshIdentity: &charts.ProxyTracingCollectorIdentity{
 						ServiceAccountName: "",
+						Namespace:          "",
 					},
 				},
 			},