nodeSelector not working for webhookConfiguration

[martinspaniol]

Describe the bug
I install akri with this command:

helm install akri akri-helm-charts/akri \
  --set useLatestContainers=true \
  --set-string agent.nodeSelectors.worker="true"  \
  --set-string webhookConfiguration.nodeSelectors.worker="true"

Note: I need to use --set-string here to make "true" (a boolean value) work as a string

Result

Error: INSTALLATION FAILED: YAML parse error on akri/templates/webhook-configuration.yaml: error converting YAML to JSON: yaml: line 121: did not find expected key

Possible reason
I looked into the webhook-configuration.yaml. The nodeSelector is in line 110:

          nodeSelector:
            {{- if .Values.webhookConfiguration.nodeSelectors }}
              {{- toYaml .Values.webhookConfiguration.nodeSelectors | nindent 8 }}
            {{- end }}
            # ...
            {{- end }}

The value has an indent of 8 and I think that's the reason. Shouldn't it be 12?

I also checked with the template command. Executing this:

helm template akri akri-helm-charts/akri   \
  --set useLatestContainers=true \
  --set-string agent.nodeSelectors.worker="true" \
  --set-string webhookConfiguration.nodeSelectors.worker="true" \
  --debug

results in:

# Source: akri/templates/webhook-configuration.yaml

apiVersion: v1
kind: List
metadata:
  name: akri-webhook-configuration
  labels:
    helm.sh/chart: akri-0.13.8
    app.kubernetes.io/part-of: akri
    app.kubernetes.io/instance: akri
    app.kubernetes.io/version: "0.13.8"
    app.kubernetes.io/managed-by: Helm
items:
  - apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: akri-webhook-configuration
      namespace: default
      labels:
        helm.sh/chart: akri-0.13.8
        app.kubernetes.io/part-of: akri
        app.kubernetes.io/instance: akri
        app.kubernetes.io/version: "0.13.8"
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: akri-webhook-configuration
        app.kubernetes.io/component: admission-webhook
  - apiVersion: rbac.authorization.k8s.io/v1
    kind: Role
    metadata:
      name: akri-webhook-configuration
      namespace: default
      labels:
        helm.sh/chart: akri-0.13.8
        app.kubernetes.io/part-of: akri
        app.kubernetes.io/instance: akri
        app.kubernetes.io/version: "0.13.8"
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: akri-webhook-configuration
        app.kubernetes.io/component: admission-webhook
    rules:
    - apiGroups: [""]
      resources: ["pods"]
      verbs: ["get"]
  - apiVersion: rbac.authorization.k8s.io/v1
    kind: RoleBinding
    metadata:
      name: akri-webhook-configuration
      namespace: default
      labels:
        helm.sh/chart: akri-0.13.8
        app.kubernetes.io/part-of: akri
        app.kubernetes.io/instance: akri
        app.kubernetes.io/version: "0.13.8"
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: akri-webhook-configuration
        app.kubernetes.io/component: admission-webhook
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: Role
      name: akri-webhook-configuration
    subjects:
    - kind: ServiceAccount
      name: akri-webhook-configuration
      namespace: default
  - apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: akri-webhook-configuration
      labels:
        helm.sh/chart: akri-0.13.8
        app.kubernetes.io/part-of: akri
        app.kubernetes.io/instance: akri
        app.kubernetes.io/version: "0.13.8"
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: akri-webhook-configuration
        app.kubernetes.io/component: admission-webhook
    spec:
      replicas: 1
      selector:
        matchLabels:
          app.kubernetes.io/part-of: akri
          app.kubernetes.io/instance: akri
          app.kubernetes.io/name: akri-webhook-configuration
      template:
        metadata:
          labels:
            helm.sh/chart: akri-0.13.8
            app.kubernetes.io/part-of: akri
            app.kubernetes.io/instance: akri
            app.kubernetes.io/version: "0.13.8"
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: akri-webhook-configuration
            app.kubernetes.io/component: admission-webhook
        spec:
          serviceAccountName: akri-webhook-configuration
          containers:
          - name: webhook
            image: "ghcr.io/project-akri/akri/webhook-configuration:latest"
            imagePullPolicy: Always
            resources:
              requests:
                memory: 100Mi
                cpu: 15m
              limits:
                memory: 100Mi
                cpu: 26m
            args:
            - --tls-crt-file=/secrets/tls.crt
            - --tls-key-file=/secrets/tls.key
            - --port=8443
            volumeMounts:
            - name: secrets
              mountPath: /secrets
              readOnly: true
          volumes:
            - name: secrets
              secret:
                secretName: akri-webhook-configuration
          tolerations:
            - key: node-role.kubernetes.io/master
              effect: NoSchedule
          nodeSelector:
        worker: "true" # <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< this seems wrong
            "kubernetes.io/os": linux

Take note of the second last line with the nodeSelector.

[yujinkim-msft]

Hi @martinspaniol thank you so much for submitting this bug -- we will take a look at this shortly!

[yujinkim-msft]

@scb01